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CHAPTER 1 
ABOUT THIS MANUAL 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C & 2D: Instruction Set 
Reference (order numbers 253666, 253667, 326018 and 334569) are part of a set that describes the architecture 
and programming environment of all Intel 64 and IA-32 architecture processors. Other volumes in this set are: 


° The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (Order 
Number 253665). 


° The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C & 3D: System 
Programming Guide (order numbers 253668, 253669, 326019 and 332831). 


° The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers 
(order number 335592), 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture 
and programming environment of Intel 64 and IA-32 processors. The Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C & 2D, describe the instruction set of the processor and the opcode struc- 
ture. These volumes apply to application programmers and to programmers who write operating systems or exec- 
utives. The Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C & 3D, describe 
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating- 
system and BIOS designers. In addition, the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3B, addresses the programming environment for classes of software that host operating systems. The 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, describes the model-specific registers 
of Intel 64 and IA-32 processors. 


1.1 INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL 


This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which 
include: 


* Pentium® processors 

° P6 family processors 

* Pentium® 4 processors 

* Pentium® M processors 

* Intel® Xeon® processors 

* Pentium® D processors 

* Pentium® processor Extreme Editions 

* 64-bit Intel® Xeon® processors 

* Intel® Core™ Duo processor 

* Intel® Core™ Solo processor 

* Dual-Core Intel® Xeon® processor LV 

* Intel® Core™2 Duo processor 

* Intel® Core™2 Quad processor Q6000 series 

* Intel® xeon® processor 3000, 3200 series 

* Intel® Xeon® processor 5000 series 

* Intel® xeon® processor 5100, 5300 series 

* Intel® Core™2 Extreme processor X7000 and X6800 series 
* Intel® Core™2 Extreme processor QX6000 series 
* Intel® Xeon® processor 7100 series 
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* Intel® Pentium® Dual-Core processor 

* Intel® Xeon® processor 7200, 7300 series 

* Intel® xeon® processor 5200, 5400, 7400 series 

* Intel® Core™2 Extreme processor QX9000 and X9000 series 
* Intel® Core™2 Quad processor Q9000 series 

* Intel® Core™2 Duo processor E8000, T9000 series 

* Intel® Atom™ processor family 


* Intel® Atom™ processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are built from 45 nm and 32 nm processes 


* Intel® Core™ i7 processor 

* Intel® Core™ i5 processor 

* Intel® Xeon® processor E7-8800/4800/2800 product families 
* Intel® Core™ i7-3930K processor 

* 2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series 
* Intel® Xeon® processor E3-1200 product family 

* Intel® Xeon® processor E5-2400/1400 product family 

* Intel® Xeon® processor E5-4600/2600/1600 product family 
* 3rd generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1200 v2 product family 

* Intel® Xeon® processor E5-2400/1400 v2 product families 

* Intel® Xeon® processor E5-4600/2600/1600 v2 product families 
* Intel® Xeon® processor E7-8800/4800/2800 v2 product families 
* 4th generation Intel® Core™ processors 

* The Intel® Core™ M processor family 

* Intel® Core™ i7-59xx Processor Extreme Edition 

* Intel® Core™ i7-49xx Processor Extreme Edition 

* Intel® Xeon® processor E3-1200 v3 product family 

* Intel® Xeon® processor E5-2600/1600 v3 product families 

* 5th generation Intel® Core™ processors 

* Intel® Xeon® processor D-1500 product family 

* Intel® Xeon® processor E5 v4 family 

* Intel® Atom™ processor X7-Z8000 and X5-Z8000 series 

* Intel® Atom™ processor Z3400 series 

* Intel® Atom™ processor Z3500 series 

* 6th generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1500m v5 product family 

* 7th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series 

* Intel® Xeon® Processor Scalable Family 

* 8th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 

* Intel® Xeon® E processors 

* 9th generation Intel® Core™ processors 

* 2nd generation Intel® Xeon® Processor Scalable Family 
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* 10th generation Intel® Core™ processors 
* 11th generation Intel® Core™ processors 
* 3rd generation Intel® Xeon® Processor Scalable Family 


P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium® 
Pro, Pentium® II, Pentium® Ill, and Pentium® III Xeon® processors. 


The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® micro- 
architecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon 
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture. 


The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved 
Pentium® M processor microarchitecture. 


The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel® 
Core™2 Duo, Intel® Core™2 Quad, and Intel® Core™2 Extreme processors are based on Intel® Core™ microarchi- 
tecture. 


The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™2 Quad processor Q9000 series, and Intel® 
Core™2 Extreme processors QX9000, X9000 series, Intel® Core™2 processor E8000 series are based on Enhanced 
Intel® Core™ microarchitecture. 


The Intel® Atom™ processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are based on the Intel® Atom™ microarchitecture and supports Intel 64 architecture. 


P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV, 
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® Atom™ 
processor Z5xx series support IA-32 architecture. 


The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel® 
Core™ 2 Duo, Intel® Core™2 Extreme, Intel® Core™2 Quad processors, Pentium® D processors, Pentium® Dual- 
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture. 


The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem 
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel® 
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the 
Westmere microarchitecture. These processors support Intel 64 architecture. 


The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7- 
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx, 
Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product 
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support 
Intel 64 architecture. 


The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2 
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec- 
ture and support Intel 64 architecture. 


The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on 
the Haswell microarchitecture and support Intel 64 architecture. 


The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme 
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture. 


The Intel® Atom™ processor Z8000 series is based on the Airmont microarchitecture. 


The Intel® Atom™ processor Z3400 series and the Intel® Atom™ processor Z3500 series are based on the Silver- 
mont microarchitecture. 


The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500 
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® Processor Scalable Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener- 
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture. 
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The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64 
architecture. 


The Intel® Atom™ processor C series, the Intel® Atom™ processor X series, the Intel® Pentium® processor J 
series, the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Gold- 
mont microarchitecture. 


The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and 
supports Intel 64 architecture. 


The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron® 
processor N series are based on the Goldmont Plus microarchitecture. 


The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces- 
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture. 


The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and 
supports Intel 64 architecture. 


The 2nd generation Intel® Xeon® Processor Scalable Family is based on the Cascade Lake product and supports 
Intel 64 architecture. 


Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based 
on the Comet Lake microarchitecture; both support Intel 64 architecture. 


Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are 
based on the Rocket Lake microarchitecture; both support Intel 64 architecture. 


Some 3rd generation Intel® Xeon® Processor Scalable Family processors are based on the Cooper Lake product, 
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture. 


IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces- 
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset 
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture. 


12 OVERVIEW OF VOLUME 2A, 2B, 2C AND 2D: INSTRUCTION SET REFERENCE 


A description of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C & 2D content 
follows: 


Chapter 1 — About This Manual. Gives an overview of all seven volumes of the Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual. It also describes the notational conventions in these manuals and lists related 
Intel® manuals and documentation of interest to programmers and hardware designers. 


Chapter 2 — Instruction Format. Describes the machine-level instruction format used for all IA-32 instructions 
and gives the allowable encodings of prefixes, the operand-identifier byte (ModR/M byte), the addressing-mode 
specifier byte (SIB byte), and the displacement and immediate bytes. 


Chapter 3 — Instruction Set Reference, A-L. Describes Intel 64 and IA-32 instructions in detail, including an 
algorithmic description of operations, the effect on flags, the effect of operand- and address-size attributes, and 

the exceptions that may be generated. The instructions are arranged in alphabetical order. General-purpose, x87 
FPU, Intel MMX™ technology, SSE/SSE2/SSE3/SSSE3/SSE4 extensions, and system instructions are included. 


Chapter 4 — Instruction Set Reference, M-U. Continues the description of Intel 64 and IA-32 instructions 
started in Chapter 3. It starts Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2B. 


Chapter 5 — Instruction Set Reference, V-Z. Continues the description of Intel 64 and IA-32 instructions 
started in chapters 3 and 4. It provides the balance of the alphabetized list of instructions and starts Intel® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 2C. 


Chapter 6 — Safer Mode Extensions Reference. Describes the safer mode extensions (SMX). SMX is intended 
for a system executive to support launching a measured environment in a platform where the identity of the soft- 
ware controlling the platform hardware can be measured for the purpose of making trust decisions. This chapter 
starts Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D. 
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Chapter 7— Instruction Set Reference Unique to Intel® Xeon Phi™ Processors. Describes the instruction 
set that is unique to Intel® Xeon Phi™ processors based on the Knights Landing and Knights Mill microarchitec- 
tures. The set is not supported in any other Intel processors. 


Appendix A — Opcode Map. Gives an opcode map for the IA-32 instruction set. 


Appendix B — Instruction Formats and Encodings. Gives the binary encoding of each form of each IA-32 
instruction. 


Appendix C — Intel® C/C++ Compiler Intrinsics and Functional Equivalents. Lists the Intel® C/C++ compiler 
intrinsics and their assembly code equivalents for each of the IA-32 MMX and SSE/SSE2/SSE3 instructions. 


1.3 NOTATIONAL CONVENTIONS 


This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for 
hexadecimal and binary numbers. A review of this notation makes the manual easier to read. 


1.3.1 Bit and Byte Order 


In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses 
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to 
two raised to the power of the bit position. IA-32 processors are “little endian” machines; this means the bytes of 
a word are numbered starting from the least significant byte. Figure 1-1 illustrates these conventions. 


Highest Data Structure 
Address 31 24 23 16 15 87 0 <— Bit offset 


Lowest 
Address 


Byte Offset 


Figure 1-1. Bit and Byte Order 


1.3.2 Reserved Bits and Software Compatibility 


In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as 
reserved, it is essential for compatibility with future processors that software treat these bits as having a future, 
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict- 
able. Software should follow these guidelines in dealing with reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers which contain such bits. 
Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 


¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, 
or reload them with values previously read from the same register. 
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NOTE 


Avoid any software dependence upon the state of reserved bits in IA-32 registers. Depending upon 
the values of reserved register bits will make software dependent upon the unspecified manner in 

which the processor handles these bits. Programs that depend upon reserved values risk incompat- 
ibility with future processors. 


1.3.3 Instruction Operands 


When instructions are represented symbolically, a subset of the IA-32 assembly language is used. In this subset, 
an instruction has the following format: 
label: mnemonic argument1, argument2, argument3 
where: 
¢ A label is an identifier which is followed by a colon. 
¢ A mnemonic is a reserved name for a class of instruction opcodes which have the same function. 


¢ The operands argumenti, argument2, and argument3 are optional. There may be from zero to three operands, 
depending on the opcode. When present, they take the form of either literals or identifiers for data items. 
Operand identifiers are either reserved names of registers or are assumed to be assigned to data items 
declared in another part of the program (which may not be shown in the example). 


When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left 
operand is the destination. 


For example: 


LOADREG: MOV EAX, SUBTOTAL 


In this example, LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand, 
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order. 


1.3.4 Hexadecimal and Binary Numbers 


Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for 
example, F82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, 
E, and F. 


Base 2 (binary) numbers are represented by a string of 1s and Os, sometimes followed by the character B (for 
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might 
arise. 


1.3.5 Segmented Addressing 


The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes. 
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes in memory. The 
range of memory that can be addressed is called an address space. 


The processor also supports segmented addressing. This is a form of addressing where a program may have many 

independent address spaces, called segments. For example, a program can keep its code (instructions) and stack 

in separate segments. Code addresses would always refer to the code space, and stack addresses would always 

refer to the stack space. The following notation is used to specify a byte address within a segment: 
Segment-register:Byte-address 

For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS 

register: 


DS:FF79H 
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The following segment address identifies an instruction address in the code segment. The CS register points to the 
code segment and the EIP register contains the address of the instruction. 


CS:EIP 


13.6 Exceptions 


An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to 
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi- 
tions. Some types of exceptions may provide error codes. An error code reports additional information about the 
error. An example of the notation used to show an exception and error code is shown below: 


#PF(fault code) 


This example refers to a page-fault exception under conditions where an error code naming a type of fault is 
reported. Under some conditions, exceptions which produce error codes may not be able to report an accurate 
code. In this case, the error code is zero, as shown below for a general-protection exception: 


#GP(0) 


1.3.7 A New Syntax for CPUID, CR, and MSR Values 


Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register 
bits, and by reading model-specific registers. We are moving toward a new syntax to represent this information. 
See Figure 1-2. 
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CPUID Input and Output 


CPUID.01H:EDX.SSE[bit 25] = 1 
e | @ 


Input value for EAX register 


Output register and feature flag or field 
name with bit position(s) 


Value (or range) of output 


Control Register Values 


CR4.OSFXSR)Ibit 9] = 1 
e | © 


Example CR name 


Feature flag or field name 
with bit position(s) 


Value (or range) of output 


Model-Specific Register Values 


IA32_MISC_ENABLE.ENABLEFOPCODED[bit 2] = 1 
|! 


Example MSR name 


Feature flag or field name with bit position(s) 


Value (or range) of output 


Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation 


1.4 RELATED LITERATURE 


Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at: 
https://software.intel.com/en-us/articles/intel-sdm 
See also: 


* The latest security information on Intel® products: 
https://www.intel.com/content/www/us/en/security-center/default.html 


° Software developer resources, guidance and insights for security advisories: 
https://software.intel.com/security-software-guidance/ 


¢ The data sheet for a particular Intel 64 or IA-32 processor 
¢ The specification update for a particular Intel 64 or IA-32 processor 


* Intel® C++ Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 
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Intel® Fortran Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


Intel® Software Development Tools: 
https://software.intel.com/en-us/intel-sdp-home 


Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four or ten volumes): 
https://software.intel.com/en-us/articles/intel-sdm 


Intel® 64 and IA-32 Architectures Optimization Reference Manual: 
https://software.intel.com/en-us/articles/intel-sdm#optimization 


Intel® Trusted Execution Technology Measured Launched Environment Programming Guide: 
http://www. intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html 


Intel® Software Guard Extensions (Intel® SGX) Information 
https://software.intel.com/en-us/isa-extensions/intel-sgx 


Developing Multi-threaded Applications: A Platform Consistent Approach: 
https://software.intel.com/sites/default/files/article/147714/51534-developing-multithreaded-applica- 
tions. pdf 


Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor: 
https://software.intel.com/sites/default/files/22/30/25602 


Performance Monitoring Unit Sharing Guide 
http://software.intel.com/file/30388 


Literature related to select features in future Intel processors are available at: 


Intel® Architecture Instruction Set Extensions Programming Reference 
https://software.intel.com/en-us/isa-extensions 


More relevant links are: 


Intel® Developer Zone: 

https://software.intel.com/en-us 

Developer centers: 

http://www. intel.com/content/www/us/en/hardware-developers/developer-centers.html 
Processor support general link: 

http://www. intel.com/support/processors/ 

Intel® Hyper-Threading Technology (Intel® HT Technology): 

http://www. intel.com/technology/platform-technology/hyper-threading/index.htm 
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CHAPTER 2 
INSTRUCTION FORMAT 


This chapter describes the instruction format for all Intel 64 and IA-32 processors. The instruction format for 
protected mode, real-address mode and virtual-8086 mode is described in Section 2.1. Increments provided for IA- 
32e mode and its sub-modes are described in Section 2.2. 


221 INSTRUCTION FORMAT FOR PROTECTED MODE, REAL-ADDRESS MODE, 
AND VIRTUAL-8086 MODE 


The Intel 64 and IA-32 architectures instruction encodings are subsets of the format shown in Figure 2-1. Instruc- 
tions consist of optional instruction prefixes (in any order), primary opcode bytes (up to three bytes), an 
addressing-form specifier (if required) consisting of the ModR/M byte and sometimes the SIB (Scale-Index-Base) 
byte, a displacement (if required), and an immediate data field (if required). 


Prefixes of _1-, 2-, or 3-byte 1 byte 1 byte Address Immediate 
1 byte each opcode f required) (if aes displacement data of 
(optional): 2 ur eaiitee! of 1, 2, or 4 1,2,0r4 
ra \ bytes or none® _ bytes or none® 
7 65 32 0 7 65 32 0 


So 


1. The REX prefix is optional, but if used must be immediately before the opcode; see Section 
2.2.1, “REX Prefixes” for additional information. 

2. For VEX encoding information, see Section 2.3, “Intel® Advanced Vector Extensions (Intel® 
AVX)”. 

3. Some rare instructions can take an 8B immediate or 8B displacement. 


Figure 2-1. Intel 64 and IA-32 Architectures Instruction Format 


2.1.1 Instruction Prefixes 


Instruction prefixes are divided into four groups, each with a set of allowable prefix codes. For each instruction, it 
is only useful to include up to one prefix code from each of the four groups (Groups 1, 2, 3, 4). Groups 1 through 4 
may be placed in any order relative to each other. 


° Group 1 
— Lock and repeat prefixes: 
¢ LOCK prefix is encoded using FOH. 


¢ REPNE/REPNZ prefix is encoded using F2H. Repeat-Not-Zero prefix applies only to string and 
input/output instructions. (F2H is also used as a mandatory prefix for some instructions. ) 


¢ REP or REPE/REPZ is encoded using F3H. The repeat prefix applies only to string and input/output 
instructions. F3H is also used as a mandatory prefix for POPCNT, LZCNT and ADOX instructions. 
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— BND prefix is encoded using F2H if the following conditions are true: 
¢ CPUID.(EAX=07H, ECX=0):EBX.MPX[bit 14] is set. 
¢ BNDCFGU.EN and/or IA32_BNDCFGS.EN is set. 


¢ When the F2 prefix precedes a near CALL, a near RET, a near JMP, a short Jcc, or a near Jcc instruction 
(see Chapter 17, “Intel® MPX,” of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). 


° Group 2 
— Segment override prefixes: 
¢ 2EH—CS segment override (use with any branch instruction is reserved). 
¢ 36H—SS segment override prefix (use with any branch instruction is reserved). 
¢ 3EH—DS segment override prefix (use with any branch instruction is reserved). 
¢ 26H—ES segment override prefix (use with any branch instruction is reserved). 
¢ 64H—FS segment override prefix (use with any branch instruction is reserved). 
* 65H—GS segment override prefix (use with any branch instruction is reserved). 
— Branch hints!?: 
¢ 2EH—Branch not taken (used only with Jcc instructions). 
¢ 3EH—Branch taken (used only with Jcc instructions). 
° Group 3 
¢ Operand-size override prefix is encoded using 66H (66H is also used as a mandatory prefix for some 
instructions). 
° Group 4 
* 67H—Address-size override prefix. 


The LOCK prefix (FOH) forces an operation that ensures exclusive use of shared memory in a multiprocessor envi- 
ronment. See “LOCK—Assert LOCK# Signal Prefix” in Chapter 3, “Instruction Set Reference, A-L,” for a description 
of this prefix. 

Repeat prefixes (F2H, F3H) cause an instruction to be repeated for each element of a string. Use these prefixes 
only with string and I/O instructions (MOVS, CMPS, SCAS, LODS, STOS, INS, and OUTS). Use of repeat prefixes 
and/or undefined opcodes with other Intel 64 or IA-32 instructions is reserved; such use may cause unpredictable 
behavior. 

Some instructions may use F2H,F3H as a mandatory prefix to express distinct functionality. 

Branch hint prefixes (2EH, 3EH) allow a program to give a hint to the processor about the most likely code path for 
a branch. Use these prefixes only with conditional branch instructions (Jcc). Other use of branch hint prefixes 
and/or other undefined opcodes with Intel 64 or IA-32 instructions is reserved; such use may cause unpredictable 
behavior. 

The operand-size override prefix allows a program to switch between 16- and 32-bit operand sizes. Either size can 
be the default; use of the prefix selects the non-default size. 

Some SSE2/SSE3/SSSE3/SSE4 instructions and instructions using a three-byte sequence of primary opcode bytes 
may use 66H as a mandatory prefix to express distinct functionality. 

Other use of the 66H prefix is reserved; such use may cause unpredictable behavior. 

The address-size override prefix (67H) allows programs to switch between 16- and 32-bit addressing. Either size 
can be the default; the prefix selects the non-default size. Using this prefix and/or other undefined opcodes when 
operands for the instruction do not reside in memory is reserved; such use may cause unpredictable behavior. 


1. Some earlier microarchitectures used these as branch hints, but recent generations have not and they are reserved for future hint 
usage. 
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Za lot Opcodes 


A primary opcode can be 1, 2, or 3 bytes in length. An additional 3-bit opcode field is sometimes encoded in the 
ModR/M byte. Smaller fields can be defined within the primary opcode. Such fields define the direction of opera- 
tion, size of displacements, register encoding, condition codes, or sign extension. Encoding fields used by an 
opcode vary depending on the class of operation. 


Two-byte opcode formats for general-purpose and SIMD instructions consist of one of the following: 
e An escape opcode byte OFH as the primary opcode and a second opcode byte. 


¢ Amandatory prefix (66H, F2H, or F3H), an escape opcode byte, and a second opcode byte (same as previous 
bullet). 


For example, CVTDQ2PD consists of the following sequence: F3 OF E6. The first byte is a mandatory prefix (it is not 
considered as a repeat prefix). 


Three-byte opcode formats for general-purpose and SIMD instructions consist of one of the following: 
e An escape opcode byte OFH as the primary opcode, plus two additional opcode bytes. 


¢ Amandatory prefix (66H, F2H, or F3H), an escape opcode byte, plus two additional opcode bytes (same as 
previous bullet). 


For example, PHADDW for XMM registers consists of the following sequence: 66 OF 38 01. The first byte is the 
mandatory prefix. 


Valid opcode expressions are defined in Appendix A and Appendix B. 


2.1.3 ModR/M and SIB Bytes 


Many instructions that refer to an operand in memory have an addressing-form specifier byte (called the ModR/M 
byte) following the primary opcode. The ModR/M byte contains three fields of information: 


° The mod field combines with the r/m field to form 32 possible values: eight registers and 24 addressing modes. 


° The reg/opcode field specifies either a register number or three more bits of opcode information. The purpose 
of the reg/opcode field is specified in the primary opcode. 


¢ The r/m field can specify a register as an operand or it can be combined with the mod field to encode an 
addressing mode. Sometimes, certain combinations of the mod field and the r/m field are used to express 
opcode information for some instructions. 


Certain encodings of the ModR/M byte require a second addressing byte (the SIB byte). The base-plus-index and 
scale-plus-index forms of 32-bit addressing require the SIB byte. The SIB byte includes the following fields: 


° The scale field specifies the scale factor. 

° The index field specifies the register number of the index register. 
° The base field specifies the register number of the base register. 
See Section 2.1.5 for the encodings of the ModR/M and SIB bytes. 


2.1.4 Displacement and Immediate Bytes 


Some addressing forms include a displacement immediately following the ModR/M byte (or the SIB byte if one is 
present). If a displacement is required, it can be 1, 2, or 4 bytes. 


If an instruction specifies an immediate operand, the operand always follows any displacement bytes. An imme- 
diate operand can be 1, 2 or 4 bytes. 
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2.1.5 Addressing-Mode Encoding of ModR/M and SIB Bytes 


The values and corresponding addressing forms of the ModR/M and SIB bytes are shown in Table 2-1 through Table 
2-3: 16-bit addressing forms specified by the ModR/M byte are in Table 2-1 and 32-bit addressing forms are in 
Table 2-2. Table 2-3 shows 32-bit addressing forms specified by the SIB byte. In cases where the reg/opcode field 
in the ModR/M byte represents an extended opcode, valid encodings are shown in Appendix B. 


In Table 2-1 and Table 2-2, the Effective Address column lists 32 effective addresses that can be assigned to the 
first operand of an instruction by using the Mod and R/M fields of the ModR/M byte. The first 24 options provide 
ways of specifying a memory location; the last eight (Mod = 11B) provide ways of specifying general-purpose, MMX 
technology and XMM registers. 


The Mod and R/M columns in Table 2-1 and Table 2-2 give the binary encodings of the Mod and R/M fields required 
to obtain the effective address listed in the first column. For example: see the row indicated by Mod = 11B, R/M = 
OOOB. The row identifies the general-purpose registers EAX, AX or AL; MMX technology register MMO; or XMM 
register XMMO. The register used is determined by the opcode byte and the operand-size attribute. 


Now look at the seventh row in either table (labeled “REG =”). This row specifies the use of the 3-bit Reg/Opcode 
field when the field is used to give the location of a second operand. The second operand must be a general- 
purpose, MMX technology, or XMM register. Rows one through five list the registers that may correspond to the 
value in the table. Again, the register used is determined by the opcode byte along with the operand-size attribute. 


If the instruction does not require a second operand, then the Reg/Opcode field may be used as an opcode exten- 
sion. This use is represented by the sixth row in the tables (labeled “/digit (Opcode)”). Note that values in row six 
are represented in decimal form. 


The body of Table 2-1 and Table 2-2 (under the label “Value of ModR/M Byte (in Hexadecimal)”) contains a 32 by 
8 array that presents all of 256 values of the ModR/M byte (in hexadecimal). Bits 3, 4 and 5 are specified by the 
column of the table in which a byte resides. The row specifies bits 0, 1 and 2; and bits 6 and 7. The figure below 
demonstrates interpretation of one table value. 


Mod 11 

RM 000 
/digit (Opcode); REG= 001 

C8H 11001000 


Figure 2-2. Table Interpretation of ModR/M Byte (C8H) 
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Table 2-1. 16-Bit Addressing Forms with the ModR/M Byte 


r8(/r) CH 
r16(/r) BP! 
r32(/r) EBP 
mmi(/r) MM5 
xmm(/r) XMM5 
(In decimal) /digit (Opcode) 0 1 2 3 4 5 

(In binary) REG = 101 


Effective Address odR/M Byte (in Hexadecimal) 


uw 
Oo}; TMMONDWYSHO 


[BX+Sl}-disp8? 
[BX+DI]+disp8 
[BP+SI}-+disp8 

[BP+DI}+disp8 


[Sl]+disp8 
[Di}+disp8 

[BP]}+disp8 
[BX]+disp8 


[BX+Sl]+disp16 
[BX+DI]+disp16 
[BP+Sl}-+disp16 
[BP+DI}+disp16 
[Sl}+disp16 
[Di}+disp16 
[BP}+disp16 
[BX]+disp16 


EAX/AX/AL/MMO/XMMO 
ECX/CX/CL/MM1/XMM 1 
EDX/DX/DL/MM2/XMM2 
E€BX/BX/BL/MM3/XMM3 
ESP/SP/AHMM4/XMM4. 
EBP/BP/CH/MM5/XMM5 
ESI/SI/DH/MM6/XMM6 
EDI/DI/BH/MM7/XMM7 


NOTES: 
1. The default segment register is SS for the effective addresses containing a BP index, DS for other effective addresses. 
2. The disp16 nomenclature denotes a 16-bit displacement that follows the ModR/M byte and that is added to the index. 


3. The disp8 nomenclature denotes an 8-bit displacement that follows the ModR/M byte and that is sign-extended and added to the 
index. 
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Table 2-2. 32-Bit Addressing Forms with the ModR/M Byte 


r8(/r) 

r16(/r) 

r32(/r) 

mmi(/r) 

xmm(/r 

(In decimal) /digit (Opcode) 

(In binary) REG = 

Effective Address 

[EBX}+disp8 011 43 4B 53 5B 63 6B 73 7B 

[--][--]}+disp8 100 44 4c 54 5C 64 6C 74 7C 

[EBP]+disp8 101 45 4D 55 5D 65 6D 75 7D 

[ESI]+disp8 110 46 4€ 56 5E 66 6E 76 7E 

[EDI]+disp8 111 47 4F 57 5F 67 6F 77 7F 

[EAX]+disp32 10 000 80 88 90 98 AO A8 BO B8 

[ECX]+disp32 001 81 89 91 99 Al AS Bl B9 

[EDX]+disp32 010 82 8A 92 9A A2 AA B2 BA 

[EBX}+disp32 011 83 8B 93 9B A3 AB B3 BB 

[--][--]}+disp32 100 84 8C 94 9C A4 AC B4 BC 

[EBP]+disp32 101 85 8D 95 9D A5 AD B5 BD 

[ESI]+disp32 110 86 8E 96 9E AG AE B6 BE 

[EDI]+disp32 111 87 8F 97 OF A7 AF B7 BF 

EAX/AX/AL/MMO/XMMO 11 000 co C8 DO D8 E0 E8 FO F8 

ECX/CX/CL/MM/XMM 1 001 C1 cg D1 D9 E1 E9 FI FO 

EDX/DX/DL/MM2/XMM2 010 C2 CA D2 DA E2 EA F2 FA 

EBX/BX/BL/MM3/XMM3 011 C3 CB D3 DB €3 EB F3 FB 

ESP/SP/AH/MM4/XMM4 100 C4 cc D4 DC E4 EC F4 FC 

EBP/BP/CH/MM5/XMM5 101 cs CD D5 DD €5 ED F5 FD 

ESI/SI/DH/MM6/XMM6 110 C6 CE D6 DE €6 EE F6 FE 

EDI/DI/BH/MM7/XMM7 111 C7 CF D7 DF €7 EF F7 FF 
NOTES: 


1. The [--][--] nomenclature means a SIB follows the ModR/M byte. 

2. The disp32 nomenclature denotes a 32-bit displacement that follows the ModR/M byte (or the SIB byte if one is present) and that is 
added to the index. 

3. The disp8 nomenclature denotes an 8-bit displacement that follows the ModR/M byte (or the SIB byte if one is present) and that is 
sign-extended and added to the index. 


Table 2-3 is organized to give 256 possible values of the SIB byte (in hexadecimal). General purpose registers used 
as a base are indicated across the top of the table, along with corresponding values for the SIB byte’s base field. 
Table rows in the body of the table indicate the register used as the index (SIB byte bits 3, 4 and 5) and the scaling 
factor (determined by SIB byte bits 6 and 7). 
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Table 2-3. 32-Bit Addressing Forms with the SIB Byte 


r32 EDX EBX ESP [*] 
(In decimal) Base = 0 1 2 3 4 5 
(In binary) Base = 010 011 100 101 


Scaled Index Value of SIB Byte (in Hexadecimal) 


[EAX*4] 10 000 80 81 82 83 84 85 86 87 
[ECX*4] 001 88 89 8A 8B 8C 8D 8E 8F 
[EDX*4] 010 90 91 92 93 94 95 96 97 
[EBX*4] 011 98 99 9A 9B 9C 9D 9E 9F 
none 100 AO Al A2 A3 A4 A5 AG A7 
[EBP*4] 101 A8 AS AA AB AC AD AE AF 
[ESI*4] 110 BO B1 B2 B3 B4 B5 B6 B7 
[EDI*4] 111 B8 B9 BA BB BC BD BE BF 
[EAX*8] 11 000 co C1 C2 C3 C4 cS C6 C7 
[ECX*8] 001 c8 cg CA CB cc CD CE CF 
[EDX*8] 010 DO D1 D2 D3 D4 D5 D6 D7 
[EBX*8] 011 D8 D9 DA DB DC DD DE DF 
none 100 E0 E1 E2 E3 €4 €5 €6 E7 
[EBP*8] 101 €8 €9 EA EB EC ED EE EF 
[ESI*8] 110 FO FI F2 F3 F4 F5 F6 F7 
[EDI*8] 111 F8 F9 FA FB FC FD FE FF 
NOTES: 


— 


. The [*] nomenclature means a disp32 with no base if the MOD is OOB. Otherwise, [*] means disp8 or disp32 + [EBP]. This provides the 
following address modes: 


MOD bits Effective Address 


00 [scaled index] + disp32 
01 [scaled index] + disp8 + [EBP] 
10 [scaled index] + disp32 + [EBP] 


22 lA-32E MODE 


IA-32e mode has two sub-modes. These are: 


¢ Compatibility Mode. Enables a 64-bit operating system to run most legacy protected mode software 
unmodified. 


° 64-Bit Mode. Enables a 64-bit operating system to run applications written to access 64-bit address space. 
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2.2.1 REX Prefixes 

REX prefixes are instruction-prefix bytes used in 64-bit mode. They do the following: 
® Specify GPRs and SSE registers. 

° Specify 64-bit operand size. 

° Specify extended control registers. 


Not all instructions require a REX prefix in 64-bit mode. A prefix is necessary only if an instruction references one 
of the extended registers or uses a 64-bit operand. If a REX prefix is used when it has no meaning, it is ignored. 


Only one REX prefix is allowed per instruction. If used, the REX prefix byte must immediately precede the opcode 
byte or the escape opcode byte (OFH). When a REX prefix is used in conjunction with an instruction containing a 
mandatory prefix, the mandatory prefix must come before the REX so the REX prefix can be immediately preceding 
the opcode or the escape byte. For example, CVTDQ2PD with a REX prefix should have REX placed between F3 and 
OF E6. Other placements are ignored. The instruction-size limit of 15 bytes still applies to instructions with a REX 
prefix. See Figure 2-3. 


Grp 1,Grp (optional) —-‘1-, 2-, or 1 byte 1 byte Address Immediate data 
2, Grp 3, 3-byte (ifrequired) (ifrequired) — displacementof of 1, 2,0r4 
Grp 4 opcode 1,2,or4 bytes bytes or none 
(optional) 


Figure 2-3. Prefix Ordering in 64-bit Mode 


2:2.151 Encoding 


Intel 64 and IA-32 instruction formats specify up to three registers by using 3-bit fields in the encoding, depending 
on the format: 


® ModR/M: the reg and r/m fields of the ModR/M byte. 

* ModR/M with SIB: the reg field of the ModR/M byte, the base and index fields of the SIB (scale, index, base) 
byte. 

¢ Instructions without ModR/M: the reg field of the opcode. 


In 64-bit mode, these formats do not change. Bits needed to define fields in the 64-bit context are provided by the 
addition of REX prefixes. 


2.2.1.2 More on REX Prefix Fields 


REX prefixes are a set of 16 opcodes that span one row of the opcode map and occupy entries 40H to 4FH. These 
opcodes represent valid instructions (INC or DEC) in IA-32 operating modes and in compatibility mode. In 64-bit 
mode, the same opcodes represent the instruction prefix REX and are not treated as individual instructions. 


The single-byte-opcode forms of the INC/DEC instructions are not available in 64-bit mode. INC/DEC functionality 
is still available using ModR/M forms of the same instructions (opcodes FF/O and FF/1). 


See Table 2-4 for a summary of the REX prefix format. Figure 2-4 though Figure 2-7 show examples of REX prefix 
fields in use. Some combinations of REX prefix fields are invalid. In such cases, the prefix is ignored. Some addi- 
tional information follows: 


° Setting REX.W can be used to determine the operand size but does not solely determine operand width. Like 
the 66H size prefix, 64-bit operand size override has no effect on byte-specific operations. 


¢ For non-byte operations: if a 66H prefix is used with prefix (REX.W = 1), 66H is ignored. 
¢ If a 66H override is used with REX and REX.W = 0, the operand size is 16 bits. 
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REX.R modifies the ModR/M reg field when that field encodes a GPR, SSE, control or debug register. REX.R is 
ignored when ModR/M specifies other registers or defines an extended opcode. 


REX.X bit modifies the SIB index field. 


REX.B either modifies the base in the ModR/M r/m field or SIB base field; or it modifies the opcode reg field 
used for accessing GPRs. 


Table 2-4. REX Prefix Fields [BITS: 0100WRXB] 


Field Name Bit Position Definition 
- 74 0100 
WwW S| O = Operand size determined by CS.D 
1 = 64 Bit Operand Size 
2 Extension of the ModR/M reg field 
1 Extension of the SIB index field 
B 0 Extension of the ModR/M r/m field, SIB base field, or Opcode reg field 
ModRM Byte 
REX PREFIX Opcode 
0100WROB 


Rrrr Bbbb 


OM17Xfig1-3 


Figure 2-4. Memory Addressing Without an SIB Byte; REX.X Not Used 


ModRM Byte | 


REX PREFIX Opcode mod reg rim 
0100WROB | rer bbb 


Rrrr Bbbb 


OM17Xfig1-4 


Figure 2-5. Register-Register Addressing (No Memory Operand); REX.X Not Used 
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REX PREFIX Opcode 
0100WRXB 


ModRM Byte 


SIB Byte 


scale index | base 
ss XXX bbb 
\ 


ie 


Xxxx  Bbbb 


OM17Xfig1-5 


Figure 2-6. Memory Addressing With a SIB Byte 


REX PREFIX 
0100WO00B 


Opcode 


Bbbb 


OM17Xfig1-6 


Figure 2-7. Register Operand Coded in Opcode Byte; REX.X & REX.R Not Used 


In the IA-32 architecture, byte registers (AH, AL, BH, BL, CH, CL, DH, and DL) are encoded in the ModR/M byte’s 
reg field, the r/m field or the opcode reg field as registers 0 through 7. REX prefixes provide an additional 
addressing capability for byte-registers that makes the least-significant byte of GPRs available for byte operations. 


Certain combinations of the fields of the ModR/M byte and the SIB byte have special meaning for register encod- 
ings. For some combinations, fields expanded by the REX prefix are not decoded. Table 2-5 describes how each 


case behaves. 
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Table 2-5. Special Cases of REX Encodings 


ModR/M or __| Sub-field Compatibility Mode | Compatibility Mode 
SIB Encodings Operation Implications Additional Implications 
ModR/M Byte | mod # 11 SIB byte present. SIB byte required for | REX prefix adds a fourth bit (b) which is not decoded 
r/m = ESP-based addressing. | (don’t care). 
b*100(ESP) SIB byte also required for R12-based addressing. 
ModR/M Byte |mod=0 Base register not EBP without a REX prefix adds a fourth bit (b) which is not decoded 
r/m = used. displacement must be | (don't care). 
b*101(EBP) done using Using RBP or R13 without displacement must be done 
mod = 01 with using mod = 01 with a displacement of 0. 
displacement of 0. 
SIB Byte index = Index register not ESP cannot be used as | REX prefix adds a fourth bit (b) which is decoded. 
0100(ESP) used. an index register. There are no additional implications. The expanded 
index field allows distinguishing RSP from R12, 
therefore R12 can be used as an index. 
SIB Byte base = Base register is Base register depends | REX prefix adds a fourth bit (b) which is not decoded. 
0101(€BP) unused ifmod=0. | on mod encoding. This requires explicit displacement to be used with 
EBP/RBP or R13. 
NOTES: 


* Don’t care about value of REX.B 


2.0.1.3 


Displacement 


Addressing in 64-bit mode uses existing 32-bit ModR/M and SIB encodings. The ModR/M and SIB displacement 
sizes do not change. They remain 8 bits or 32 bits and are sign-extended to 64 bits. 


2.2.1.4 


Direct Memory-Offset MOVs 


In 64-bit mode, direct memory-offset forms of the MOV instruction are extended to specify a 64-bit immediate 
absolute address. This address is called a moffset. No prefix is needed to specify this 64-bit memory offset. For 
these MOV instructions, the size of the memory offset follows the address-size default (64 bits in 64-bit mode). See 


Table 2-6. 
Table 2-6. Direct Memory Offset Form of MOV 
Opcode Instruction 
AO MOV AL, moffset 
Al MOV EAX, moffset 
A2 MOV moffset, AL 
A3 MOV moffset, EAX 
2.2.15 Immediates 


In 64-bit mode, the typical size of immediate operands remains 32 bits. When the operand size is 64 bits, the 
processor sign-extends all immediates to 64 bits prior to their use. 

Support for 64-bit immediate operands is accomplished by expanding the semantics of the existing move (MOV 
reg, imm16/32) instructions. These instructions (opcodes B8H - BFH) move 16-bits or 32-bits of immediate data 
(depending on the effective operand size) into a GPR. When the effective operand size is 64 bits, these instructions 
can be used to load an immediate into a GPR. A REX prefix is needed to override the 32-bit default operand size to 
a 64-bit operand size. 


For example: 


48B8 8877665544332211 MOV RAX,1122334455667788H 
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2.2.1.6 RIP-Relative Addressing 


A new addressing form, RIP-relative (relative instruction-pointer) addressing, is implemented in 64-bit mode. An 
effective address is formed by adding displacement to the 64-bit RIP of the next instruction. 


In IA-32 architecture and compatibility mode, addressing relative to the instruction pointer is available only with 
control-transfer instructions. In 64-bit mode, instructions that use ModR/M addressing can use RIP-relative 
addressing. Without RIP-relative addressing, all ModR/M modes address memory relative to zero. 

RIP-relative addressing allows specific ModR/M modes to address memory relative to the 64-bit RIP using a signed 
32-bit displacement. This provides an offset range of +2GB from the RIP. Table 2-7 shows the ModR/M and SIB 
encodings for RIP-relative addressing. Redundant forms of 32-bit displacement-addressing exist in the current 
ModR/M and SIB encodings. There is one ModR/M encoding and there are several SIB encodings. RIP-relative 
addressing is encoded using a redundant form. 

In 64-bit mode, the ModR/M Disp32 (32-bit displacement) encoding is re-defined to be RIP+Disp32 rather than 
displacement-only. See Table 2-7. 


Table 2-7. RIP-Relative Addressing 


ModR/M and SIB Sub-field Encodings | Compatibility Mode | 64-bit Mode Additional Implications in 64-bit mode 


Operation Operation 
ModR/M Byte | mod = 00 Disp32 RIP + Disp32 In 64-bit mode, if one wants to use a Disp32 
ot ior) SIB byte encoding (ndicated by MODRMa/m=100) 
as described in the next row. 
SIB Byte base = 101 (none) If mod = 00, Disp32 | Same as legacy | None 
index = 100 (none) 
scale = 0, 1,2,4 


The ModR/M encoding for RIP-relative addressing does not depend on using a prefix. Specifically, the r/m bit field 
encoding of 101B (used to select RIP-relative addressing) is not affected by the REX prefix. For example, selecting 
R13 (REX.B = 1, r/m = 101B) with mod = OOB still results in RIP-relative addressing. The 4-bit r/m field of REX.B 
combined with ModR/M is not fully decoded. In order to address R13 with no displacement, software must encode 
R13 + 0 using a 1-byte displacement of zero. 

RIP-relative addressing is enabled by 64-bit mode, not by a 64-bit address-size. The use of the address-size prefix 
does not disable RIP-relative addressing. The effect of the address-size prefix is to truncate and zero-extend the 
computed effective address to 32 bits. 


2.2.1.7 Default 64-Bit Operand Size 


In 64-bit mode, two groups of instructions have a default operand size of 64 bits (do not need a REX prefix for this 
operand size). These are: 


¢ Near branches. 
e =6All instructions, except far branches, that implicitly reference the RSP. 


22.0 Additional Encodings for Control and Debug Registers 


In 64-bit mode, more encodings for control and debug registers are available. The REX.R bit is used to modify the 
ModR/M reg field when that field encodes a control or debug register (see Table 2-4). These encodings enable the 
processor to address CR8-CR15 and DR8- DR15. An additional control register (CR8) is defined in 64-bit mode. CR8 
becomes the Task Priority Register (TPR). 

In the first implementation of IA-32e mode, CR9-CR1i5 and DR8-DR15 are not implemented. Any attempt to access 
unimplemented registers results in an invalid-opcode exception (#UD). 
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2.3 INTEL® ADVANCED VECTOR EXTENSIONS (INTEL® AVX) 


Intel AVX instructions are encoded using an encoding scheme that combines prefix bytes, opcode extension field, 
operand encoding fields, and vector length encoding capability into a new prefix, referred to as VEX. In the VEX 
encoding scheme, the VEX prefix may be two or three bytes long, depending on the instruction semantics. Despite 
the two-byte or three-byte length of the VEX prefix, the VEX encoding format provides a more compact represen- 
tation/packing of the components of encoding an instruction in Intel 64 architecture. The VEX encoding scheme 
also allows more headroom for future growth of Intel 64 architecture. 


2.3.1 Instruction Format 
Instruction encoding using VEX prefix provides several advantages: 


¢ Instruction syntax support for three operands and up-to four operands when necessary. For example, the third 
source register used by VBLENDVPD is encoded using bits 7:4 of the immediate byte. 


¢ Encoding support for vector length of 128 bits (using XMM registers) and 256 bits (using YMM registers). 
¢ Encoding support for instruction syntax of non-destructive source operands. 


° Elimination of escape opcode byte (OFH), SIMD prefix byte (66H, F2H, F3H) via a compact bit field represen- 
tation within the VEX prefix. 


¢ Elimination of the need to use REX prefix to encode the extended half of general-purpose register sets (R8- 
R15) for direct register access, memory addressing, or accessing XMM8-XMM15 (including YMM8-YMM15). 


¢ Flexible and more compact bit fields are provided in the VEX prefix to retain the full functionality provided by 
REX prefix. REX.W, REX.X, REX.B functionalities are provided in the three-byte VEX prefix only because only a 
subset of SIMD instructions need them. 


¢  ~=Extensibility for future instruction extensions without significant instruction length increase. 


Figure 2-8 shows the Intel 64 instruction encoding format with VEX prefix support. Legacy instruction without a 
VEX prefix is fully supported and unchanged. The use of VEX prefix in an Intel 64 instruction is optional, but a VEX 
prefix is required for Intel 64 instructions that operate on YMM registers or support three and four operand syntax. 
VEX prefix is not a constant-valued, “single-purpose” byte like OFH, 66H, F2H, F3H in legacy SSE instructions. VEX 
prefix provides substantially richer capability than the REX prefix. 


# Bytes 2,3 0,1 0,1,2,4 0,1 


1 1 ; 


Figure 2-8. Instruction Encoding Format with VEX Prefix 


2.3.2 VEX and the LOCK prefix 
Any VEX-encoded instruction with a LOCK prefix preceding VEX will #UD. 


2.3.3 VEX and the 66H, F2H, and F3H prefixes 
Any VEX-encoded instruction with a 66H, F2H, or F3H prefix preceding VEX will #UD. 


2.3.4 VEX and the REX prefix 
Any VEX-encoded instruction with a REX prefix proceeding VEX will #UD. 
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2.3.5 The VEX Prefix 


The VEX prefix is encoded in either the two-byte form (the first byte must be C5H) or in the three-byte form (the 
first byte must be C4H). The two-byte VEX is used mainly for 128-bit, scalar, and the most common 256-bit AVX 
instructions; while the three-byte VEX provides a compact replacement of REX and 3-byte opcode instructions 
(including AVX and FMA instructions). Beyond the first byte of the VEX prefix, it consists of a number of bit fields 
providing specific capability, they are shown in Figure 2-9. 

The bit fields of the VEX prefix can be summarized by its functional purposes: 


° Non-destructive source register encoding (applicable to three and four operand syntax): This is the first source 
operand in the instruction syntax. It is represented by the notation, VEX.vvvv. This field is encoded using 1’s 
complement form (inverted form), i.e. XMMO/YMMO/RO is encoded as 1111B, XMM15/YMM15/R15 is encoded 
as OOOOB. 


¢ Vector length encoding: This 1-bit field represented by the notation VEX.L. L= 0 means vector length is 128 bits 
wide, L=1 means 256 bit vector. The value of this field is written as VEX.128 or VEX.256 in this document to 
distinguish encoded values of other VEX bit fields. 


° REX prefix functionality: Full REX prefix functionality is provided in the three-byte form of VEX prefix. However 
the VEX bit fields providing REX functionality are encoded using 1's complement form, i.e. XMMO/YMMO/RO is 
encoded as 1111B, XMM15/YMM15/R15 is encoded as OOOOB. 


— Two-byte form of the VEX prefix only provides the equivalent functionality of REX.R, using 1’s complement 
encoding. This is represented as VEX.R. 


— Three-byte form of the VEX prefix provides REX.R, REX.X, REX.B functionality using 1’s complement 
encoding and three dedicated bit fields represented as VEX.R, VEX.X, VEX.B. 


— Three-byte form of the VEX prefix provides the functionality of REX.W only to specific instructions that need 
to override default 32-bit operand size for a general purpose register to 64-bit size in 64-bit mode. For 
those applicable instructions, VEX.W field provides the same functionality as REX.W. VEX.W field can 
provide completely different functionality for other instructions. 


Consequently, the use of REX prefix with VEX encoded instructions is not allowed. However, the intent of the 
REX prefix for expanding register set is reserved for future instruction set extensions using VEX prefix 
encoding format. 


* Compaction of SIMD prefix: Legacy SSE instructions effectively use SIMD prefixes (66H, F2H, F3H) as an 
opcode extension field. VEX prefix encoding allows the functional capability of such legacy SSE instructions 
(operating on XMM registers, bits 255:128 of corresponding YMM unmodified) to be encoded using the VEX.pp 
field without the presence of any SIMD prefix. The VEX-encoded 128-bit instruction will zero-out bits 255:128 
of the destination register. VEX-encoded instruction may have 128 bit vector length or 256 bits length. 


* Compaction of two-byte and three-byte opcode: More recently introduced legacy SSE instructions employ two 
and three-byte opcode. The one or two leading bytes are: OFH, and OFH 3AH/OFH 38H. The one-byte escape 
(OFH) and two-byte escape (OFH 3AH, OFH 38H) can also be interpreted as an opcode extension field. The 
VEX.mmmmm field provides compaction to allow many legacy instruction to be encoded without the constant 
byte sequence, OFH, OFH 3AH, OFH 38H. These VEX-encoded instruction may have 128 bit vector length or 256 
bits length. 


The VEX prefix is required to be the last prefix and immediately precedes the opcode bytes. It must follow any other 
prefixes. If VEX prefix is present a REX prefix is not supported. 


The 3-byte VEX leaves room for future expansion with 3 reserved bits. REX and the 66h/F2h/F3h prefixes are 
reclaimed for future use. 


VEX prefix has a two-byte form and a three byte form. If an instruction syntax can be encoded using the two-byte 
form, it can also be encoded using the three byte form of VEX. The latter increases the length of the instruction by 
one byte. This may be helpful in some situations for code alignment. 


The VEX prefix supports 256-bit versions of floating-point SSE, SSE2, SSE3, and SSE4 instructions. Note, certain 
new instruction functionality can only be encoded with the VEX prefix. 


The VEX prefix will #UD on any instruction containing MMX register sources or destinations. 
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Byte 0 Byte | 
(Bit Position) 7 07654 


hs 
2-byte VEX os 


R: REX.R in 1’s complement (inverted) form 
1: Same as REX.R=0 (must be | in 32-bit mode) 
0: Same as REX.R=1 (64-bit mode only) 

X: REX.X in 1’s complement (inverted) form 
1: Same as REX.X=0 (must be | in 32-bit mode) 
0: Same as REX.X=1 (64-bit mode only) 

B: REX.B in 1’s complement (inverted) form 

1: Same as REX.B=0 (Ignored in 32-bit mode). 
0: Same as REX.B=1 (64-bit mode only) 

W: opcode specific (use like REX.W, or used for opcode 

extension, or ignored, depending on the opcode byte) 


3.210 


m-mmmm: 
00000: Reserved for future use (will #UD) 
00001: implied OF leading opcode byte 
00010: implied OF 38 leading opcode bytes 
00011: implied OF 3A leading opcode bytes 
00100-11111: Reserved for future use (will #UD) 


vvvwv: a register specifier (in 1’s complement form) or 1111 if unused. 


L: Vector Length 


0: scalar or 128-bit vector 
1: 256-bit vector 


pp: opcode extension providing equivalent functionality of a SIMD prefix 
00: None 
O01: 66 
10: F3 
11: F2 


Figure 2-9. VEX bit fields 


The following subsections describe the various fields in two or three-byte VEX prefix. 


2.3.5.1 VEX Byte 0, bits[7:0] 


VEX Byte 0, bits [7:0] must contain the value 11000101b (C5h) or 11000100b (C4h). The 3-byte VEX uses the C4h 
first byte, while the 2-byte VEX uses the C5h first byte. 


2.3.5.2 VEX Byte 1, bit [7] - 


VEX Byte 1, bit [7] contains a bit analogous to a bit inverted REX.R. In protected and compatibility modes the bit 
must be set to ‘1’ otherwise the instruction is LES or LDS. 
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This bit is present in both 2- and 3-byte VEX prefixes. 


The usage of WRXB bits for legacy instructions is explained in detail section 2.2.1.2 of Intel 64 and IA-32 Architec- 
tures Software developer’s manual, Volume 2A. 


This bit is stored in bit inverted format. 


2.3.5.3. 3-byte VEX byte 1, bit[6] - ‘x’ 


Bit[6] of the 3-byte VEX byte 1 encodes a bit analogous to a bit inverted REX.X. It is an extension of the SIB Index 
field in 64-bit modes. In 32-bit modes, this bit must be set to ‘1’ otherwise the instruction is LES or LDS. 


This bit is available only in the 3-byte VEX prefix. 
This bit is stored in bit inverted format. 


2.3.5.4 3-byte VEX byte 1, bit[5] - ‘B’ 


Bit[5] of the 3-byte VEX byte 1 encodes a bit analogous to a bit inverted REX.B. In 64-bit modes, it is an extension 
of the ModR/M r/m field, or the SIB base field. In 32-bit modes, this bit is ignored. 


This bit is available only in the 3-byte VEX prefix. 
This bit is stored in bit inverted format. 


2.3.5.5  3-byte VEX byte 2, bit[7] - ‘Ww’ 


Bit[7] of the 3-byte VEX byte 2 is represented by the notation VEX.W. It can provide following functions, depending 

on the specific opcode. 

e For AVX instructions that have equivalent legacy SSE instructions (typically these SSE instructions have a 
general-purpose register operand with its operand size attribute promotable by REX.W), if REX.W promotes 
the operand size attribute of the general-purpose register operand in legacy SSE instruction, VEX.W has same 
meaning in the corresponding AVX equivalent form. In 32-bit modes for these instructions, VEX.W is silently 
ignored. 

e For AVX instructions that have equivalent legacy SSE instructions (typically these SSE instructions have oper- 
ands with their operand size attribute fixed and not promotable by REX.W), if REX.W is don’t care in legacy 
SSE instruction, VEX.W is ignored in the corresponding AVX equivalent form irrespective of mode. 

e For new AVX instructions where VEX.W has no defined function (typically these meant the combination of the 
opcode byte and VEX.mmmmm did not have any equivalent SSE functions), VEX.W is reserved as zero and 
setting to other than zero will cause instruction to #UD. 


2.3.5.6 2-byte VEX Byte 1, bits[6:3] and 3-byte VEX Byte 2, bits [6:3]- ‘vvvv’ the Source or Dest 
Register Specifier 

In 32-bit mode the VEX first byte C4 and C5 alias onto the LES and LDS instructions. To maintain compatibility with 

existing programs the VEX 2nd byte, bits [7:6] must be 11b. To achieve this, the VEX payload bits are selected to 

place only inverted, 64-bit valid fields (extended register selectors) in these upper bits. 

The 2-byte VEX Byte 1, bits [6:3] and the 3-byte VEX, Byte 2, bits [6:3] encode a field (shorthand VEX.vvvv) that 

for instructions with 2 or more source registers and an XMM or YMM or memory destination encodes the first source 

register specifier stored in inverted (1’s complement) form. 

VEX.vvvv is not used by the instructions with one source (except certain shifts, see below) or on instructions with 

no XMM or YMM or memory destination. If an instruction does not use VEX.vvvv then it should be set to 1111b 

otherwise instruction will #UD. 

In 64-bit mode all 4 bits may be used. See Table 2-8 for the encoding of the XMM or YMM registers. In 32-bit and 

16-bit modes bit 6 must be 1 (if bit 6 is not 1, the 2-byte VEX version will generate LDS instruction and the 3-byte 

VEX version will ignore this bit). 
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Table 2-8. VEX.vvvv to register name mapping 


VEX.vwwv Dest Register sacle il er or Valid ies aa 
1111B XMMO/YMMO RAX/EAX Valid 
1110B XMM1/YMM1 RCX/ECX Valid 
1101B XMM2/YMM2 RDX/EDX Valid 
1100B XMM3/YMM3 RBX/EBX Valid 
1011B XMM4/YMM4 RSP/ESP Valid 
1010B XMM5/YMM5 RBP/EBP Valid 
1001B XMM6/YMM6 RSI/ESI Valid 
1000B XMM7/YMM7 RDI/EDI Valid 
0111B XMM8/YMM8 R8/R8D Invalid 
0110B XMM9/YMM9 R9/ROD Invalid 
0101B XMM10/YMM10 R10/R10D Invalid 
0100B XMM11/YMM11 R11/R11D Invalid 
0011B XMM12/YMM12 R12/R12D Invalid 
0010B XMM13/YMM13 R13/R13D Invalid 
0001B XMM14/YMM14 R14/R14D Invalid 
0000B XMM15/YMM15 R15/R15D Invalid 

NOTES: 


1. See Section 2.5, “VEX Encoding Support for GPR Instructions” for additional details. 
2. Only the first eight General-Purpose Registers are accessible/encodable in 16/32b modes. 


The VEX.vvvv field is encoded in bit inverted format for accessing a register operand. 


2.3.6 Instruction Operand Encoding and VEX.vvvv, ModR/M 


VEX-encoded instructions support three-operand and four-operand instruction syntax. Some VEX-encoded 
instructions have syntax with less than three operands, e.g. VEX-encoded pack shift instructions support one 


source operand and one destination operand). 


The roles of VEX.vvvv, reg field of ModR/M byte (ModR/M.reg), r/m field of ModR/M byte (ModR/M.r/m) with 
respect to encoding destination and source operands vary with different type of instruction syntax. 


The role of VEX.vvvv can be summarized to three situations: 
° VEX.vvvv encodes the first source register operand, specified in inverted (1’s complement) form and is valid for 


instructions with 2 or more source operands. 


° VEX.vvvv encodes the destination register operand, specified in 1’s complement form for certain vector shifts. 
The instructions where VEX.vvvv is used as a destination are listed in Table 2-9. The notation in the “Opcode” 
column in Table 2-9 is described in detail in section 3.1.1. 


¢ VEX.vvvv does not encode any operand, the field is reserved and should contain 1111b. 


Table 2-9. Instructions with a VEX.vvvv destination 


Opcode 


Instruction mnemonic 


VEX.128.66.0F 73 /7 ib 


VPSLLDQ xmm1, xmm_2, imm8 


VEX.128.66.0F 73 /3 ib 


VPSRLDQ xmm1, xmm2, imm8 


VEX.128.66.0F 71 /2 ib 


VPSRLW xmm1, xmm2, imm8 


VEX.128.66.0F 72 /2 ib 


VPSRLD xmm1, xmmz, imm8 


VEX.128.66.0F 73 /2 ib 


VPSRLOQ xmm1, xmm2, imm8 


VEX.128.66.0F 71 /4 ib 


VPSRAW xmm1, xmm2, imm8 
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Opcode Instruction mnemonic 
VEX.128.66.0F 72 /4 ib VPSRAD xmm1, xmm2, imm8 
VEX.128.66.0F 71 /6 ib VPSLLW xmm1, xmm2, imm8 
VEX.128.66.0F 72 /6 ib VPSLLD xmm1, xmm2, imm8 
VEX.128.66.0F 73 /6 ib VPSLLOQ xmm1, xmm2, imm8 


The role of ModR/M.r/m field can be summarized to two situations: 
® ModR/M.r/m encodes the instruction operand that references a memory address. 


° For some instructions that do not support memory addressing semantics, ModR/M.r/m encodes either the 
destination register operand or a source register operand. 


The role of ModR/M.reg field can be summarized to two situations: 
® ModR/M.reg encodes either the destination register operand or a source register operand. 


° For some instructions, ModR/M.reg is treated as an opcode extension and not used to encode any instruction 
operand. 


For instruction syntax that support four operands, VEX.vvvv, ModR/M.r/m, ModR/M.reg encodes three of the four 
operands. The role of bits 7:4 of the immediate byte serves the following situation: 


¢ Imm8[7:4] encodes the third source register operand. 


2.3.6.1 3-byte VEX byte 1, bits[4:0] - “m-mmmm” 


Bits[4:0] of the 3-byte VEX byte 1 encode an implied leading opcode byte (OF, OF 38, or OF 3A). Several bits are 
reserved for future use and will #UD unless 0. 


Table 2-10. VEX.m-mmmm interpretation 


VEX.m-mmmm Implied Leading Opcode Bytes 
00000B Reserved 
00001B OF 
00010B OF 38 
00011B OF 3A 
00100-11111B Reserved 
(2-byte VEX) OF 


VEX.m-mmmm is only available on the 3-byte VEX. The 2-byte VEX implies a leading OFh opcode byte. 


2.3.6.2 2-byte VEX byte 1, bit[2], and 3-byte VEX byte 2, bit [2]- “L” 


The vector length field, VEX.L, is encoded in bit[2] of either the second byte of 2-byte VEX, or the third byte of 3- 
byte VEX. If “VEX.L = 1”, it indicates 256-bit vector operation. “VEX.L = 0” indicates scalar and 128-bit vector 
operations. 


The instruction VZEROUPPER is a special case that is encoded with VEX.L = 0, although its operation zero’s bits 
255:128 of all YMM registers accessible in the current operating mode. 


See the following table. 
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Table 2-11. VEX.L interpretation 


VEX.L Vector Length 
0 128-bit (or 32/64-bit scalar) 
1 256-bit 


2.3.6.3 2-byte VEX byte 1, bits[1:0], and 3-byte VEX byte 2, bits [1:0]- “pp” 


Up to one implied prefix is encoded by bits[1:0] of either the 2-byte VEX byte 1 or the 3-byte VEX byte 2. The prefix 
behaves as if it was encoded prior to VEX, but after all other encoded prefixes. 


See the following table. 


Table 2-12. VEX.pp interpretation 


pp Implies this prefix after other prefixes but before VEX 
00B None 
01B 66 
10B F3 
11B F2 


2.3.7 The Opcode Byte 


One (and only one) opcode byte follows the 2 or 3 byte VEX. Legal opcodes are specified in Appendix B, in color. 
Any instruction that uses illegal opcode will #UD. 


2.3.8 The MODRM, SIB, and Displacement Bytes 


The encodings are unchanged but the interpretation of reg_field or rm_field differs (see above). 


2.3.9 The Third Source Operand (Immediate Byte) 


VEX-encoded instructions can support instruction with a four operand syntax. VBLENDVPD, VBLENDVPS, and 
PBLENDVB use imm8[7:4] to encode one of the source registers. 


2.3.10 AVX Instructions and the Upper 128-bits of YMM registers 


If an instruction with a destination XMM register is encoded with a VEX prefix, the processor zeroes the upper bits 
(above bit 128) of the equivalent YMM register. Legacy SSE instructions without VEX preserve the upper bits. 


2.3.10.1 Vector Length Transition and Programming Considerations 

An instruction encoded with a VEX.128 prefix that loads a YMM register operand operates as follows: 
°® Data is loaded into bits 127:0 of the register 

¢ Bits above bit 127 in the register are cleared. 


Thus, such an instruction clears bits 255:128 of a destination YMM register on processors with a maximum vector- 
register width of 256 bits. In the event that future processors extend the vector registers to greater widths, an 
instruction encoded with a VEX.128 or VEX.256 prefix will also clear any bits beyond bit 255. (This is in contrast 
with legacy SSE instructions, which have no VEX prefix; these modify only bits 127:0 of any destination register 
operand.) 


Programmers should bear in mind that instructions encoded with VEX.128 and VEX.256 prefixes will clear any 
future extensions to the vector registers. A calling function that uses such extensions should save their state before 
calling legacy functions. This is not possible for involuntary calls (e.g., into an interrupt-service routine). It is 
recommended that software handling involuntary calls accommodate this by not executing instructions encoded 
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with VEX.128 and VEX.256 prefixes. In the event that it is not possible or desirable to restrict these instructions, 
then software must take special care to avoid actions that would, on future processors, zero the upper bits of vector 
registers. 


Processors that support further vector-register extensions (defining bits beyond bit 255) will also extend the 
XSAVE and XRSTOR instructions to save and restore these extensions. To ensure forward compatibility, software 
that handles involuntary calls and that uses instructions encoded with VEX.128 and VEX.256 prefixes should first 
save and then restore the vector registers (with any extensions) using the XSAVE and XRSTOR instructions with 
save/restore masks that set bits that correspond to all vector-register extensions. Ideally, software should rely on 
a mechanism that is cognizant of which bits to set. (E.g., an OS mechanism that sets the save/restore mask bits 
for all vector-register extensions that are enabled in XCRO.) Saving and restoring state with instructions other than 
XSAVE and XRSTOR will, on future processors with wider vector registers, corrupt the extended state of the vector 
registers - even if doing so functions correctly on processors supporting 256-bit vector registers. (The same is true 
if XSAVE and XRSTOR are used with a save/restore mask that does not set bits corresponding to all supported 
extensions to the vector registers. ) 


2.3.11 AVX Instruction Length 


The AVX instructions described in this document (including VEX and ignoring other prefixes) do not exceed 11 
bytes in length, but may increase in the future. The maximum length of an Intel 64 and IA-32 instruction remains 
15 bytes. 


2.3.12 Vector SIB (VSIB) Memory Addressing 


In Intel® Advanced Vector Extensions 2 (Intel® AVX2), an SIB byte that follows the ModR/M byte can support VSIB 
memory addressing to an array of linear addresses. VSIB addressing is only supported in a subset of Intel AVX2 
instructions. VSIB memory addressing requires 32-bit or 64-bit effective address. In 32-bit mode, VSIB addressing 
is not supported when address size attribute is overridden to 16 bits. In 16-bit protected mode, VSIB memory 
addressing is permitted if address size attribute is overridden to 32 bits. Additionally, VSIB memory addressing is 
supported only with VEX prefix. 


In VSIB memory addressing, the SIB byte consists of: 

¢ The scale field (bit 7:6) specifies the scale factor. 

° The index field (bits 5:3) specifies the register number of the vector index register, each element in the vector 
register specifies an index. 

¢ The base field (bits 2:0) specifies the register number of the base register. 


Table 2-3 shows the 32-bit VSIB addressing form. It is organized to give 256 possible values of the SIB byte (in 
hexadecimal). General purpose registers used as a base are indicated across the top of the table, along with corre- 
sponding values for the SIB byte’s base field. The register names also include R8D-R15D applicable only in 64-bit 
mode (when address size override prefix is used, but the value of VEX.B is not shown in Table 2-3). In 32-bit mode, 
R8D-R15D does not apply. 


Table rows in the body of the table indicate the vector index register used as the index field and each supported 
scaling factor shown separately. Vector registers used in the index field can be XMM or YMM registers. The left- 

most column includes vector registers VR8-VR15 (i.e. XMM8/YMM8-XMM15/YMM15), which are only available in 
64-bit mode and does not apply if encoding in 32-bit mode. 
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Table 2-13. 32-Bit VSIB Addressing Forms of the SIB Byte 


r32 EDX/ EBX/ ESP/ EBP/ 
R10D R11D R12D R13D! 
(In decimal) Base = 2 3 4 5 


1 
(In binary) Base = 010 011 100 101 


Scaled Index Value of SIB Byte (in Hexadecimal) 


VRO/VR8 

VR1/VR9 

VR2/VR10 
VR3/VR11 
VR4/VR12 
VR5/VR13 
VR6/VR14 
VR7/VR15 


VR1/VR9 
VR2/VR10 


NOTES: 
1. If ModR/M.mod = OOb, the base address is zero, then effective address is computed as [scaled vector index] + disp32. Otherwise the 
base address is computed as [EBP/R13]+ disp, the displacement is either 8 bit or 32 bit depending on the value of ModR/M.mod: 
MOD Effective Address 


O00b [Scaled Vector Register] + Disp32 
01b [Scaled Vector Register] + Disp8 + [EBP/R13] 
10b [Scaled Vector Register] + Disp32 + [EBP/R13] 


2.3.12.1 64-bit Mode VSIB Memory Addressing 


In 64-bit mode VSIB memory addressing uses the VEX.B field and the base field of the SIB byte to encode one of 
the 16 general-purpose register as the base register. The VEX.X field and the index field of the SIB byte encode one 
of the 16 vector registers as the vector index register. 


In 64-bit mode the top row of Table 2-13 base register should be interpreted as the full 64-bit of each register. 


2.4 AVX AND SSE INSTRUCTION EXCEPTION SPECIFICATION 


To look up the exceptions of legacy 128-bit SIMD instruction, 128-bit VEX-encoded instructions, and 256-bit VEX- 
encoded instruction, Table 2-14 summarizes the exception behavior into separate classes, with detailed exception 
conditions defined in sub-sections 2.4.1 through 2.5.1. For example, ADDPS contains the entry: 


“See Exceptions Type 2” 
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In this entry, "Type2” can be looked up in Table 2-14. 
The instruction’s corresponding CPUID feature flag can be identified in the fourth column of the Instruction 


summary table. 


Note: #UD on CPUID feature flags=0 is not guaranteed in a virtualized environment if the hardware supports the 


feature flag. 


NOTE 


Instructions that operate only with MMX, X87, or general-purpose registers are not covered by the 
exception classes defined in this section. For instructions that operate on MMX registers, see 
Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 


in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 


Table 2-14. Exception Class Description 


. : Floating-Point 
Exception Class Instruction set Mem arg Exceptions (#XM) 
AVX, 16/32 byte explicitly 
iyped Legacy SSE aligned bel 
AVX, 16/32 byte not explicitly 
lypere Legacy SSE aligned ee 
AVX, 
Type 3 Legacy SSE < 16 byte Yes 
AVX, 16/32 byte not explicitly 
Type4 Legacy SSE aligned be 
AVX, 
Type 5 Legacy SSE < 16 byte No 
Type 6 AVX (no Legacy SSE) Varies (At present, none do) 
AVX, 
Type 7 Legacy SSE None None 
Type 8 AVX None None 
F16C 8 or 16 byte, Not explicitly Yes 
ype aligned, no AC# 
Type 12 AVX2 Gathers Not ee no No 


See Table 2-15 for lists of instructions in each exception class. 
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Table 2-15. Instructions in each Exception Class 


Exception Class 


Instruction 


Type 1 


(V)MOVAPD, (V)MOVAPS, (V)MOVDOA, (V)MOVNTDO, (V)MOVNTDOA, (V)MOVNTPD, (V)MOVNTPS 


Type 2 


(V)ADDPD, (V)ADDPS, (V)ADDSUBPD, (V)ADDSUBPS, (V)CMPPD, (V)CMPPS, (V)CVTDQ2PS, (V)CVTPD2DQ, 
(V)CVTPD2PS, (V)CVTPS2DQ, (V)CVTTPD2DQ, (V)CVTTPS2DQ, (V)DIVPD, (V)DIVPS, (V)DPPD*, (V)DPPS*, 
VFMADD132PD, VFMADD213PD, VFMADD231PD, VFMADD132PS, VFMADD213PS, VFMADD231PS, 
VFMADDSUB132PD, VFMADDSUB213PD, VFMADDSUB231PD, VFMADDSUB132PS, VFMADDSUB213PS, 
VFMADDSUB231PS, VFMSUBADD132PD, VFMSUBADD213PD, VFMSUBADD231PD, VFMSUBADD132PS, 
VFMSUBADD213PS, VFMSUBADD231PS, VFMSUB132PD, VFMSUB213PD, VFMSUB231PD, VFMSUB132PS, 
VFMSUB213PS, VEMSUB231PS, VENMADD132PD, VFNMADD213PD, VFNMADD231PD, VFNMADD132PS, 
VENMADD213PS, VFNMADD231PS, VFNMSUB132PD, VFNMSUB213PD, VFNMSUB231PD, VFNMSUB132PS, 
VENMSUB213PS, VENMSUB231PS, (V)HADDPD, (V)HADDPS, (V)HSUBPD, (V)HSUBPS, (V)MAXPD, (V)MAXPS, 
(V)MINPD, (V)MINPS, (V)MULPD, (V)MULPS, (V)ROUNDPD, (V)ROUNDPS, (\V)SORTPD, (V)SQRTPS, (\V)SUBPD, 
(V)SUBPS 


Type 3 


(V)ADDSD, (V)ADDSS, (V)CMPSD, (V)CMPSS, (V)COMISD, (V)COMISS, (V)CVTPS2PD, (V)CVTSD2SI, (V)CVTSD2SS, 
(V)CVTSI2SD, (V)CVTSI2SS, (V)CVTSS2SD, (V)CVTSS2SI, (V)CVTTSD2SI, (V)CVTTSS2SI, (V)DIVSD, (V)DIVSS, 
VFMADD132SD, VFMADD213SD, VFMADD231SD, VFMADD132SS, VFMADD213SS, VFMADD2315SS, 
VFMSUB132SD, VFMSUB213SD, VFMSUB231SD, VFMSUB132SS, VFMSUB213SS, VFEMSUB2315SS, 
VENMADD132SD, VENMADD213SD, VENMADD231SD, VENMADD132SS, VFNMADD213SS, VFNMADD2315SS, 
VFNMSUB132SD, VFNMSUB213SD, VFNMSUB231SD, VFNMSUB132SS, VFNMSUB213SS, VFNMSUB231SS, 
(V)MAXSD, (V)MAXSS, (V)MINSD, (V)MINSS, (V)MULSD, (V)MULSS, (V)ROUNDSD, (V)ROUNDSS, (V)SQRTSD, 
SORTSS, (\V)SUBSD, (V)SUBSS, (V)UCOMISD, (V)UCOMISS 


Type 4 


(V) 
(V)AESDEC, (V)AESDECLAST, (V)AESENC, (V)AESENCLAST, (V)AESIMC, (V)AESKEYGENASSIST, (V)ANDPD, 
(V)ANDPS, (V)ANDNPD, (V)ANDNPS, (V)BLENDPD, (V)BLENDPS, VBLENDVPD, VBLENDVPS, (V)LDDQU***, 
(V)MASKMOVDQU, (V)PTEST, VTESTPS, VTESTPD, (V)MOVDQU*, (V)MOVSHDUP, (V)MOVSLDUP, (V)MOVUPD*, 
(V)MOVUPS*, (V)MPSADBW, (V)ORPD, (V)ORPS, (V)PABSB, (V)PABSW, (V)PABSD, (V)PACKSSWB, (V)PACKSSDW, 
(V)PACKUSWB, (V)PACKUSDW, (V)PADDB, (V)PADDW, (V)PADDD, (V)PADDQ, (V)PADDSB, (V)PADDSW, 
(V)PADDUSB, (V)PADDUSW, (V)PALIGNR, (V)PAND, (V)PANDN, (V)PAVGB, (V)PAVGW, (V)PBLENDVB, 
(V)PBLENDW, (V)PCMP(E/I)STRI/M***, (V)PCMPEQB, (V)PCMPEQW, (V)PCMPEQD, (V)PCMPEQQ, (V)PCMPGTB, 
(V)PCMPGTW, (V)PCMPGTD, (V)PCMPGTO, (V)PCLMULQDOQ, (V)PHADDW, (V)PHADDD, (V)PHADDSW, 
(V)PHMINPOSUW, (V)PHSUBD, (V)PHSUBW, (V)PHSUBSW, (\V)PMADDWD, (V)PMADDUBSW, (V)PMAXSB, 
(V)PMAXSW, (V)PMAXSD, (V)PMAXUB, (V)PMAXUW, (V)PMAXUD, (V)PMINSB, (V)PMINSW, (V)PMINSD, 
(V)PMINUB, (V)PMINUW, (V)PMINUD, (V)PMULHUW, (V)PMULHRSW, (V)PMULHW, (V)PMULLW, (V)PMULLD, 
(V)PMULUDQ, (V)PMULDO, (V)POR, (V)PSADBW, (V)PSHUFB, (V)PSHUFD, (V)PSHUFHW, (V)PSHUFLW, (V)PSIGNB, 
(V)PSIGNW, (V)PSIGND, (\V)PSLLW, (V)PSLLD, (V)PSLLO, (V)PSRAW, (V)PSRAD, (V)PSRLW, (V)PSRLD, (V)PSRLQ, 
(V)PSUBB, (V)PSUBW, (V)PSUBD, (V)PSUBQ, (V)PSUBSB, (V)PSUBSW, (V)PSUBUSB, (V)PSUBUSW, 
(V)PUNPCKHBW, (V)PUNPCKHWD, (V)PUNPCKHDQ, (V)PUNPCKHQDQ, (V)PUNPCKLBW, (V)PUNPCKLWD, 
(V)PUNPCKLDQ, (V)PUNPCKLQDQ, (V)PXOR, (V)RCPPS, (V)RSORTPS, (V)SHUFPD, (V)SHUFPS, (V)UNPCKHPD, 
(V)UNPCKHPS, (V)UNPCKLPD, (V)UNPCKLPS, (V)XORPD, (\V)XORPS, VPBLENDD, VPERMD, VPERMPS, VPERMPD, 
VPERMQ, VPSLLVD, VPSLLVQ, VPSRAVD, VPSRLVD, VPSRLVQ, VPERMILPD, VPERMILPS, VPERM2F128 


Type 5 


(V)CVTDQ2PD, (V)EXTRACTPS, (V)INSERTPS, (V)MOVD, (V)MOVO, (V)MOVDDUP, (V)MOVLPD, (V)MOVLPS, 
(V)MOVHPD, (V)MOVHPS, (V)MOVSD, (V)MOVSS, (V)PEXTRB, (V)PEXTRD, (V)PEXTRW, (V)PEXTRO, (V)PINSRB, 
(V)PINSRD, (V)PINSRW, (V)PINSRQ, PMOVSXBW, (V)RCPSS, (V)RSQRTSS, (V)PMOVSX/ZX, VLDMXCSR*, 
VSTMXCSR 


Type 6 


VEXTRACTF128/VEXTRACTFxxxx, VBROADCASTSS, VBROADCASTSD, VBROADCASTF1 28, VINSERTF1 28, 
VMASKMOVPS**, VMASKMOVPD**, VPMASKMOVD, VPMASKMOVQ, VBROADCASTI128, VPBROADCASTB, 
VPBROADCASTD, VPBROADCASTW, VPBROADCASTQ, VEXTRACTI128, VINSERTI128, VPERM21128 


Type 7 


(V)MOVLHPS, (V)MOVHLPS, (V)MOVMSKPD, (V)MOVMSKPS, (V)PMOVMSKB, (V)PSLLDQ, (V)PSRLDQ, (V)PSLLW, 
(V)PSLLD, (V)PSLLO, (V)PSRAW, (V)PSRAD, (V)PSRLW, (V)PSRLD, (V)PSRLO 


Type 8 


VZEROALL, VZEROUPPER 


Type 11 


VCVTPH2PS, VCVTPS2PH 


Type 12 


VGATHERDPS, VGATHERDPD, VGATHERQPS, VGATHERQPD, VPGATHERDD, VPGATHERDQ, VPGATHERQD, 
VPGATHERQQ 


(*) - Additional exception restrictions are present - see the Instruction description for details 
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(**) - Instruction behavior on alignment check reporting with mask bits of less than all 1s are the same as with mask bits of all 1s, i.e. no 


alignment checks are performed. 


(***) - PCMPESTRI, PCMPESTRM, PCMPISTRI, PCMPISTRM and LDDQU instructions do not cause #GP if the memory operand is not 


aligned to 16-Byte boundary. 


Table 2-15 classifies exception behaviors for AVX instructions. Within each class of exception conditions that are 
listed in Table 2-18 through Table 2-27, certain subsets of AVX instructions may be subject to #UD exception 


depending on the encoded value of the VEX.L field. Table 2-17 provides supplemental information of AVX instruc- 


tions that may be subject to #UD exception if encoded with incorrect values in the VEX.W or VEX.L field. 


Table 2-16. HUD Exception and VEX.W=1 Encoding 


Exception Class #UD If VEX.W = 1 in all modes HUD VEX.W pea 
non-64-bit modes 
Type 1 
Type 2 
Type 3 
Type 4 VBLENDVPD, VBLENDVPS, VPBLENDVB, VTESTPD, VTESTPS, VPBLENDD, VPERMD, 
yp VPERMPS, VPERM21128, VPSRAVD, VPERMILPD, VPERMILPS, VPERM2F128 
Type 5 
VEXTRACTF128, VBROADCASTSS, VBROADCASTSD, VBROADCASTF1 28, 
Type 6 VINSERTF128, VMASKMOVPS, VMASKMOVPD, VBROADCASTI1 28, 
VPBROADCASTB/W/D, VEXTRACTI1 28, VINSERTI128 
Type 7 
Type 8 
Type 11 VCVTPH2PS, VCVTPS2PH 
Type 12 
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Table 2-17. HUD Exception and VEX.L Field Encoding 


ScctOw')> aaniuexiab #UD If (VEX.L = 1 && AVX2 not present && AVX #UD If (VEX.L = 1 && AVX2 
Class present) present) 
Type 1 VMOVNTDQA 
Type 2 VDPPD VDPPD 
Type 3 
VMASKMOVDQU, VMPSADBW, VPABSB/W/D, VPCMP(E/I)STRIM, 
VPACKSSWB/DW, VPACKUSWB/DW, VPADDB/W/D, PHMINPOSUW 
VPADDQ, VPADDSB/W, VPADDUSB/W, VPALIGNR, VPAND, 
VPANDN, VPAVGB/W, VPBLENDVB, VPBLENDW, 
VPCMP(E/I)STRI/M, VPCMPEQB/W/D/Q, VPCMPGTB/W/D/Q, 
VPHADDW/D, VPHADDSW, VPHMINPOSUW, VPHSUBD/W, 
Rie VPHSUBSW, VPMADDWD, VPMADDUBSW, VPMAXSB/W/D, 
yp VPMAXUB/W/D, VPMINSB/W/D, VPMINUB/W/D, 
VPMULHUW, VPMULHRSW, VPMULHW/LW, VPMULLD, 
VPMULUDQ, VPMULDQ, VPOR, VPSADBW, VPSHUFB/D, 
VPSHUFHW/LW, VPSIGNB/W/D, VPSLLW/D/Q, VPSRAW/D, 
VPSRLW/D/Q, VPSUBB/W/D/Q, VPSUBSB/W, 
VPUNPCKHBW/WD/DQ, VPUNPCKHQDQ, 
VPUNPCKLBW/WD/DQ, VPUNPCKLODQ, VPXOR 
VEXTRACTPS, VINSERTPS, VMOVD, VMOVQ, VMOVLPD, Same as column 3 
ies VMOVLPS, VMOVHPD, VMOVHPS, VPEXTRB, VPEXTRD, 
yp VPEXTRW, VPEXTRQ, VPINSRB, VPINSRD, VPINSRW, 
VPINSRQ, VPMOVSX/ZX, VLDMXCSR, VSTMXCSR 
VEXTRACTF128, 
VPERM2F128, 
Type6 | VBROADCASTSD, 
VBROADCASTF128, 
VINSERTE128, 
VMOVLHPS, VMOVHLPS, VPMOVMSKB, VPSLLDQ, VMOVLHPS, VMOVHLPS 
Type 7 VPSRLDQ, VPSLLW, VPSLLD, VPSLLO, VPSRAW, VPSRAD, 
VPSRLW, VPSRLD, VPSRLO 
Type 8 
Type 11 
Type 12 
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2.4.1 Exceptions Type 1 (Aligned Memory Reference) 


Table 2-18. Type 1 Class Exception Conditions 


g |sz 
= = UD/# 
Exception ®| 3 |2%|3 Cause of Exception 
=) 2 |£e/¢ 
5 28 
X X VEX prefix. 
VEX prefix: 
X X | If XCRO[2:1] #'11b’. 
If CR4.0SXSAVE[bit 18]=0. 
Invalid Opcode, Legacy SSE instruction: 
#UD X X X X | If CRO.EM[bit 2] = 1. 


If CR4,0SFXSR[bit 9] = O. 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 


If any corresponding CPUID feature flag is ‘O’. 


Device Not Avail- 


able, #NM If CRO.TS[bit 3]=1. 


x< 

x< 
<; >< | | | X< 
< =| | KK) >< 


For an illegal address in the SS segment. 


Stack, #SS(0 , faa : 
(0) X | Ifamemory address referencing the SS segment is in a non-canonical form. 


VEX.256: Memory operand is not 32-byte aligned. 
VEX.128: Memory operand is not 16-byte aligned. 


X X X X | Legacy SSE: Memory operand is not 16-byte aligned. 
General Protec- 


tion, #GP(O) X oS illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 


X | If the memory address is in a non-canonical form. 


X X If any part of the operand lies outside the effective address space from O to FFFFH. 


Page Fault 


#PF(fault-code) X X X | For a page fault. 
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2.4.2 Exceptions Type 2 (>=16 Byte Memory Reference, Unaligned) 
Table 2-19. Type 2 Class Exception Conditions 
g |sz 
— 8 un # 
Exception Gia litte Cause of Exception 
a Sisalg 
tse 
Ss 28 
X X VEX prefix. 
X X X X | If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT [bit 10] = 0. 
VEX prefix: 
X X | lf XCRO[2:1] #‘11b" 
; If CR4.0SXSAVE[bit 18]=0. 
Invalid Opcode, 7 7 
#UD Legacy SSE instruction: 
X X X X | If CRO.EM[bit 2] = 1. 
If CR4.0SFXSR[bit 9] = 0. 
X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
Device Not Avail- os 
able, #NM X X X X | If CRO.TS[bit 3]=1. 
X For an illegal address in the SS segment. 
Stack, #SS(0) : — ; 
X | Ifamemory address referencing the SS segment is in a non-canonical form. 
X X X X | Legacy SSE: Memory operand is not 16-byte aligned. 
General Protec- X For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
tion, #GP(0) X | If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to FFFFH. 
Page Fault 
#PF(fault-code) X X X | For a page fault. 
SIMD Floating- 
point Exception, X X X X | If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT [bit 10] = 1. 


#XM 
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2.4.3 Exceptions Type 3 (<16 Byte Memory Argument) 


Table 2-20. Type 3 Class Exception Conditions 


ow |F>p 
B58 
—_ rae) a=) 2 
Exception 9|/¢ |f#n\l2 Cause of Exception 
a S gale 
E sé 
Ss é8 
X X VEX prefix. 
X X X X_ | If anunmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 0. 
VEX prefix: 


X X | If XCRO[2:1] #‘11b’. 
If CR4,0SXSAVE[bit 18]=0. 


Invalid Opcode, #UD Legacy SSE instruction: 
X X X X | If CRO.EM[bit 2] = 1. 
If CR4.0SFXSR[bit 9] = 0. 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X_| If any corresponding CPUID feature flag is ‘0’. 
Device Nor Avaliable) 361) 56 | x |:36 RCROTSIDIESIET: 
#NM 
X For an illegal address in the SS segment. 
Stack, #SS(0) : = ; 
X | Ifamemory address referencing the SS segment is in a non-canonical form. 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
; ments. 
an) PLOLecHan; X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault 


#PF(fault-code) X X X | Fora page fault. 


Alignment Check For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 


SIMD Floating-point 


Exception, #XM X X X X_ | If anunmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 1. 
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2.4.4 Exceptions Type 4 (>=16 Byte Mem Arg, No Alignment, No Floating-point Exceptions) 


Table 2-21. Type 4 Class Exception Conditions 


3s 82 
= 3 07D/# 
Exception 9/4 |£s + Cause of Exception 
[4 5 ao2|o6 
EB is§ 
Ss. lias 
X X VEX prefix. 
VEX prefix: 


X X | If XCRO[2:1] 4 ‘11b’. 

If CR4.0SXSAVE[bit 18]=0. 
Legacy SSE instruction: 

X X X X | If CRO.EM[bit 2] = 1. 

If CR4.0SFXSR[bit 9] = 0. 


Invalid Opcode, #UD 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
Pig Not Available, | x | x | x | x | iFcROTSpbit 3]=1. 
X For an illegal address in the SS segment. 


Stack, #SS(0 , 7 : 
(0) X | Ilfamemory address referencing the SS segment is in a non-canonical form. 


x xX x X | Legacy SSE: Memory operand is not 16-byte aligned.' 


X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, ments. 
#GP(0) X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault 
#PF(fault-code) X X X | Fora page fault. 
NOTES: 


1. LDDQU, MOVUPD, MOVUPS, PCMPESTRI, PCMPESTRM, PCMPISTRI, and PCMPISTRM instructions do not cause #GP if the memory 
operand is not aligned to 16-Byte boundary. 
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2.4.5 Exceptions Type 5 (<16 Byte Mem Arg and No FP Exceptions) 


Table 2-22. Type 5 Class Exception Conditions 


g Ez 
= 2 -- ee 
Exception o/4 #8 = Cause of Exception 
«~ 5 ao2le 
EB \s§ 
Ss ES 
X X VEX prefix. 
VEX prefix: 


X X | If XCRO[2:1] #'11b’. 
If CR4,0SXSAVE[bit 18]=0. 


Legacy SSE instruction: 
X X X X | If CRO.EM[bit 2] = 1. 
If CR4.0SFXSR[bit 9] = 0. 


Invalid Opcode, #UD 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X_| If any corresponding CPUID feature flag is ‘0’. 
Pov ce NOL NANADIE: | 3C.) 56 ||. 36 |) SC. ROSEN, 
#NM 
X For an illegal address in the SS segment. 
Stack, #SS(0) : a : 
X_ | Ifamemory address referencing the SS segment is in a non-canonical form. 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
: ments. 
jc) PROLEEHON, X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault 
#PF(fault-code) X X X | Fora page fault. 
Alignment Check xX Xx Xx For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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Exceptions Type 6 (VEX-Encoded Instructions without Legacy SSE Analogues) 


Note: At present, the AVX instructions in this category do not generate floating-point exceptions. 


Table 2-23. Type 6 Class Exception Conditions 


g |Ez 
_ 8 \va/# 
Exception o| 4 |\#% = Cause of Exception 
=| 2 |g2/6 
Ss £8 
X X VEX prefix. 
X xX If XCRO[2:1] #‘11b’. 
‘aaidicneea If CR4.0SXSAVE[bit 18]=0. 
aici rei X | X | Ifpreceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, ae 
#NM X X | If CRO.TS[bit 3]=1. 
Stack, #55(0) X For an illegal address in the SS segment. 
‘ X | Ilfamemory address referencing the SS segment is in a non-canonical form. 
. For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, x ments 
#GP(0 : 
(0) X | If the memory address is in a non-canonical form. 
Page Fault 
#PF(fault-code) X X | For apage fault. 
Alignment Check X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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2.4.7 Exceptions Type 7 (No FP Exceptions, No Memory Arg) 


Table 2-24. Type 7 Class Exception Conditions 


g Ez 
= 2 -- ee 
Exception o/4 #8 = Cause of Exception 
«~ 5 ao2le 
EB \s§ 
Ss ES 
X X VEX prefix. 
VEX prefix: 


X X | If XCRO[2:1] #'11b’. 
If CR4,0SXSAVE[bit 18]=0. 


; Legacy SSE instruction: 
Invalid Opcode, UD | y | y | yx | x | IfCROEMpbit 2] =1. 


If CR4,0SFXSR[bit 9] = 0. 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X_ | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, Xx Xx | If CRO.TS[bit 3]=1. 


#NM 


2.4.8 Exceptions Type 8 (AVX and No Memory Argument) 


Table 2-25. Type 8 Class Exception Conditions 


Exception Cause of Exception 


Real 
Virtual-8086 
Protected and 
Compatibility 
64-bit 


Invalid Opcode, #UD | X 


x< 


Always in Real or Virtual-8086 mode. 


x< 


If XCRO[2:1] #'11b’. 

If CR4.OSXSAVE[bit 18]=0. 

If CPUID.O1H.ECX.AVX[bit 28]=0. 
If VEX.vwwv # 11118. 


Xx X X X If proceeded by a LOCK prefix (FOH). 


Device Not Available, X X If CRO.TS[bit 3]=1. 
#NM 
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2.4.9 Exceptions Type 11 (VEX-only, Mem Arg, No AC, Floating-point Exceptions) 
Table 2-26. Type 11 Class Exception Conditions 
g Be 
= 8 ~~ 
Exception 9/4 |#% a Cause of Exception 
“|2 |ge/4 
5 28 
Invalid Opcode, HUD | X X VEX prefix. 
X X VEX prefix: 
If XCRO[2:1] #‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X If any corresponding CPUID feature flag is ‘0’. 
Device Not Avail- X X X X If CRO.TS[bit 3]=1. 
able, #NM 
Stack, #SS(0) X For an illegal address in the SS segment. 
X If amemory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF X X X For a page fault. 
(fault-code) 
SIMD Floating-Point X X X X If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT [bit 10] = 1. 


Exception, #XM 
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2.4.10 Exceptions Type 12 (VEX-only, VSIB Mem Arg, No AC, No Floating-point Exceptions) 


Table 2-27. Type 12 Class Exception Conditions 


a=) 
2 52 
_ 8 |\va|/ # 
. oO ' Vos Oo . 
Exception a os tal y Cause of Exception 
“| 2 \|#e ¢ 
5 2s 
Invalid Opcode, HUD | X X VEX prefix. 
X X VEX prefix: 
If XCRO[2:1] 4 ‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X NA | If address size attribute is 16 bit. 
X X X X If ModR/M.mod = ‘11b’. 
x Xx x x If ModR/M.rm # ‘100b’. 
X X X X If any corresponding CPUID feature flag is ‘O’. 
X X X X If any vector register is used more than once between the destination register, 


mask register and the index register in VSIB addressing. 
Device Not Available, | X X X X If CRO.TS[bit 3]=1. 


#NM 
Stack, #SS(0) X For an illegal address in the SS segment. 

X If amemory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 

X If the memory address is in a non-canonical form. 

X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 

Page Fault #PF (fault- X X X For a page fault. 
code) 


2.5 VEX ENCODING SUPPORT FOR GPR INSTRUCTIONS 


VEX prefix may be used to encode instructions that operate on neither YMM nor XMM registers. VEX-encoded 
general-purpose-register instructions have the following properties: 


* Instruction syntax support for three encodable operands. 


* Encoding support for instruction syntax of non-destructive source operand, destination operand encoded via 
VEX.vvvv, and destructive three-operand syntax. 


¢ Elimination of escape opcode byte (OFH), two-byte escape via a compact bit field representation within the VEX 
prefix. 


° Elimination of the need to use REX prefix to encode the extended half of general-purpose register sets (R8-R15) 
for direct register access or memory addressing. 


¢ Flexible and more compact bit fields are provided in the VEX prefix to retain the full functionality provided by 
REX prefix. REX.W, REX.X, REX.B functionalities are provided in the three-byte VEX prefix only. 


¢ VEX-encoded GPR instructions are encoded with VEX.L=0. 
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Any VEX-encoded GPR instruction with a 66H, F2H, or F3H prefix preceding VEX will #UD. 
Any VEX-encoded GPR instruction with a REX prefix proceeding VEX will #UD. 
VEX-encoded GPR instructions are not supported in real and virtual 8086 modes. 


2.5.1 Exceptions Type 13 (VEX-Encoded GPR Instructions) 


The exception conditions applicable to VEX-encoded GPR instruction differs from those of legacy GPR instructions. 
Table 2-28 lists VEX-encoded GPR instructions. The exception conditions for VEX-encoded GRP instructions are 
found in Table 2-29 for those instructions which have a default operand size of 32 bits and 16-bit operand size is 
not encodable. 


Table 2-28. VEX-Encoded GPR Instructions 
Exception Class Instruction 
Type 13 ANDN, BEXTR, BLSI, BLSMSK, BLSR, BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX 


(*) - Additional exception restrictions are present - see the Instruction description for details. 


Table 2-29. Type 13 Class Exception Conditions 


a=) 
2/52 
= & |\val # 
. oO T os Oo . 
Exception a s/t) y Cause of Exception 
“| 2 {#8 ¢ 
5 \2s 
Invalid Opcode, #UD | X X X X If BMI1/BMI2 CPUID feature flag is ‘0’. 
X X If a VEX prefix is present. 
X X X X If VEX.L = 1. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
Stack, #SS(0) X X X For an illegal address in the SS segment. 
X If a memory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null 
segment selector. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF(fault- X X X For a page fault. 
code) 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 


2.6 INTEL® AVX-512 ENCODING 


The majority of the Intel AVX-512 family of instructions (operating on 512/256/128-bit vector register operands) 
are encoded using a new prefix (called EVEX). Opmask instructions (operating on opmask register operands) are 
encoded using the VEX prefix. The EVEX prefix has some parts resembling the instruction encoding scheme using 
the VEX prefix, and many other capabilities not available with the VEX prefix. 
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The significant feature differences between EVEX and VEX are summarized below. 


EVEX is a 4-Byte prefix (the first byte must be 62H); VEX is either a 2-Byte (C5H is the first byte) or 3-Byte 
(C4H is the first byte) prefix. 


EVEX prefix can encode 32 vector registers (KXMM/YMM/ZMM) in 64-bit mode. 


EVEX prefix can encode an opmask register for conditional processing or selection control in EVEX-encoded 
vector instructions. Opmask instructions, whose source/destination operands are opmask registers and treat 
the content of an opmask register as a single value, are encoded using the VEX prefix. 


EVEX memory addressing with disp8 form uses a compressed disp8 encoding scheme to improve the encoding 
density of the instruction byte stream. 


EVEX prefix can encode functionality that are specific to instruction classes (e.g., packed instruction with 
“load+op” semantic can support embedded broadcast functionality, floating-point instruction with rounding 
semantic can support static rounding functionality, floating-point instruction with non-rounding arithmetic 
semantic can support “suppress all exceptions” functionality). 


2.6.1 Instruction Format and EVEX 


The placement of the EVEX prefix in an IA instruction is represented in Figure 2-10. Note that the values contained 
within brackets are optional. 


# of bytes: 4 1 y 1 2,4 1 
[Prefixes] EVEX Opcode ModR/M [SIB] [Disp16,32] [Immediate] 
1 
[Disp8*N] 


Figure 2-10. AVX-512 Instruction Format and the EVEX Prefix 


The EVEX prefix is a 4-byte prefix, with the first two bytes derived from unused encoding form of the 32-bit-mode- 
only BOUND instruction. The layout of the EVEX prefix is shown in Figure 2-11. The first byte must be 62H, followed 
by three payload bytes, denoted as PO, P1, and P2 individually or collectively as P[23:0] (see Figure 2-11). 


EVEX 62H PO P1 P2 
7 6 5 4 3 2 1 0 
PO R x B R’ ) 0 m m P[7:0] 
7 6 5 4 3 2 1 0 
P4 Ww Vv Vv v Vv 1 p p P[15:8] 
7 6 5 4 3 2 1 0 
P2 z lL L b Vv a a a P[23:16] 


Figure 2-11. Bit Field Layout of the EVEX Prefix! 


NOTES: 
1. See Table 2-30 for additional details on bit fields. 
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Table 2-30. EVEX Prefix Bit Field Functional Grouping 


Notation Bit field Group Position Comment 

-- Reserved P[3 : 2] Must be 0. 

-- Fixed Value P[10] Must be 1. 

EVEX.mm Compressed legacy escape P[1: 0} Identical to low two bits of VEX.mmmmm. 

EVEX.pp Compressed legacy prefix P[9 : 8] Identical to VEX.pp. 

EVEX.RXB Next-8 register specifier modifier P[7 :5] Combine with ModR/M.reg, ModR/M.rm (base, index/vidx). This 
field is encoded in bit inverted format. 

EVEX.R’ High-16 register specifier modifier P[4] Combine with EVEX.R and ModR/M.reg. This bit is stored in 
inverted format. 

EVEX.X High-16 register specifier modifier P[6] Combine with EVEX.B and ModR/M.rm, when SIB/VSIB absent. 

EVEX.vvvv VVVV register specifier P[14:11] | Same as VEX.vvvv. This field is encoded in bit inverted format. 

EVEX.V' High-16 VVVV/VIDX register specifier | P[19] Combine with EVEX.vvvv or when VSIB present. This bit is 
stored in inverted format. 

EVEX.aaa Embedded opmask register specifier P[18: 16] 

EVEX.W Osize promotion/Opcode extension P[15] 

EVEX.z Zeroing/Merging P[23] 

EVEX.b Broadcast/RC/SAE Context P[20] 

EVEX.LU'L Vector length/RC P[22:21] 


The bit fields in P[23:0] are divided into the following functional groups (Table 2-30 provides a tabular summary): 
Reserved bits: P[3:2] must be 0, otherwise #UD. 
Fixed-value bit: P[10] must be 1, otherwise #UD. 
Compressed legacy prefix/escape bytes: P[1:0] is identical to the lowest 2 bits of VEX.mmmmm; P[9:8] is 


identical to VEX.pp. 


Operand specifier modifier bits for vector register, general purpose register, memory addressing: P[7:5] allows 
access to the next set of 8 registers beyond the low 8 registers when combined with ModR/M register specifiers. 


Operand specifier modifier bit for vector register: P[4] (or EVEX.R’) allows access to the high 16 vector register 
set when combined with P[7] and ModR/M.reg specifier; P[6] can also provide access to a high 16 vector 
register when SIB or VSIB addressing are not needed. 


Non-destructive source /vector index operand specifier: P[19] and P[14:11] encode the second source vector 
register operand in a non-destructive source syntax, vector index register operand can access an upper 16 
vector register using P[19]. 


Op-mask register specifiers: P[18:16] encodes op-mask register set kO-k7 in instructions operating on vector 
registers. 


EVEX.W: P[15] is similar to VEX.W which serves either as opcode extension bit or operand size promotion to 
64-bit in 64-bit mode. 


Vector destination merging/zeroing: P[23] encodes the destination result behavior which either zeroes the 
masked elements or leave masked element unchanged. 


Broadcast/Static-rounding/SAE context bit: P[20] encodes multiple functionality, which differs across different 
classes of instructions and can affect the meaning of the remaining field (EVEX.L’L). The functionality for the 
following instruction classes are: 


— Broadcasting a single element across the destination vector register: this applies to the instruction class 
with Load+Op semantic where one of the source operand is from memory. 


— Redirect L’L field (P[22:21]) as static rounding control for floating-point instructions with rounding 
semantic. Static rounding control overrides MXCSR.RC field and implies “Suppress all exceptions” (SAE). 
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— Enable SAE for floating -point instructions with arithmetic semantic that is not rounding. 

— For instruction classes outside of the afore-mentioned three classes, setting EVEX.b will cause #UD. 
* Vector length/rounding control specifier: P[22:21] can serve one of three options. 

— Vector length information for packed vector instructions. 

— Ignored for instructions operating on vector register content as a single data element. 


— Rounding control for floating-point instructions that have a rounding semantic and whose source and 
destination operands are all vector registers. 


2.6.2 Register Specifier Encoding and EVEX 


EVEX-encoded instruction can access 8 opmask registers, 16 general-purpose registers and 32 vector registers in 
64-bit mode (8 general-purpose registers and 8 vector registers in non-64-bit modes). EVEX-encoding can support 
instruction syntax that access up to 4 instruction operands. Normal memory addressing modes and VSIB memory 
addressing are supported with EVEX prefix encoding. The mapping of register operands used by various instruction 
syntax and memory addressing in 64-bit mode are shown in Table 2-31. Opmask register encoding is described in 
Section 2.6.3. 


Table 2-31. 32-Register Support in 64-bit Mode Using EVEX with Embedded REX Bits 


4! 3 [2:0] Reg. Type Common Usages 

REG EVEX.R’ REX.R modrm.reg GPR, Vector Destination or Source 
VVVV EVEX.\V" EVEX.vvvv GPR, Vector 2ndSource or Destination 
RM EVEX.X EVEX.B modrm.r/m GPR, Vector 1st Source or Destination 
BASE 0 EVEX.B modrm.r/m GPR memory addressing 
INDEX 0 EVEX.X sib.index GPR memory addressing 
VIDX EVEX.V' EVEX.X sib.index Vector VSIB memory addressing 
NOTES: 


1. Not applicable for accessing general purpose registers. 


The mapping of register operands used by various instruction syntax and memory addressing in 32-bit modes are 
shown in Table 2-32. 


Table 2-32. EVEX Encoding Register Specifiers in 32-bit Mode 


[2:0] Reg. Type Common Usages 
REG modrm.reg GPR, Vector Destination or Source 
VVVV EVEX.vvv GPR, Vector 2nd Source or Destination 
RM modrm.r/m GPR, Vector 1st Source or Destination 
BASE modrm.r/m GPR Memory Addressing 
INDEX sib.index GPR Memory Addressing 
VIDX sib.index Vector VSIB Memory Addressing 
2.6.3 Opmask Register Encoding 


There are eight opmask registers, kKO-k7. Opmask register encoding falls into two categories: 


* Opmask registers that are the source or destination operands of an instruction treating the content of opmask 
register as a scalar value, are encoded using the VEX prefix scheme. It can support up to three operands using 
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standard modR/M byte’s reg field and rm field and VEX.vvvv. Such a scalar opmask instruction does not 
support conditional update of the destination operand. 


¢ Anopmask register providing conditional processing and/or conditional update of the destination register of a 
vector instruction is encoded using EVEX.aaa field (see Section 2.6.4). 


¢ An opmask register serving as the destination or source operand of a vector instruction is encoded using 
standard modR/M byte’s reg field and rm fields. 


Table 2-33. Opmask Register Specifier Encoding 


[2:0] Register Access Common Usages 
REG modrm.reg kO-k7 Source 
VVVV VEX.vvvv kO-k7 2nd Source 
RM modrm.r/m kO-7 1st Source 
{k1} EVEX.aaa kO!-k7 Opmask 


NOTES: 
1. Instructions that overwrite the conditional mask in opmask do not permit using kO as the embedded mask. 


2.6.4 Masking Support in EVEX 


EVEX can encode an opmask register to conditionally control per-element computational operation and updating of 
result of an instruction to the destination operand. The predicate operand is known as the opmask register. The 
EVEX.aaa field, P[18:16] of the EVEX prefix, is used to encode one out of a set of eight 64-bit architectural regis- 
ters. Note that from this set of 8 architectural registers, only k1 through k7 can be addressed as predicate oper- 
ands. kO can be used as a regular source or destination but cannot be encoded as a predicate operand. 


AVX-512 instructions support two types of masking with EVEX.z bit (P[23]) controlling the type of masking: 


¢ Merging-masking, which is the default type of masking for EVEX-encoded vector instructions, preserves the old 
value of each element of the destination where the corresponding mask bit has a 0. It corresponds to the case 
of EVEX.z = 0. 


¢ Zeroing-masking, is enabled by having the EVEX.z bit set to 1. In this case, an element of the destination is set 
to 0 when the corresponding mask bit has a 0 value. 


AVX-512 Foundation instructions can be divided into the following groups: 
¢ Instructions which support “zeroing-masking”. 
— Also allow merging-masking. 
¢ Instructions which require aaa = 000. 
— Do not allow any form of masking. 
¢ Instructions which allow merging-masking but do not allow zeroing-masking. 
— Require EVEX.z to be set to 0. 
— This group is mostly composed of instructions that write to memory. 
¢ Instructions which require aaa <> 000 do not allow EVEX.z to be set to 1. 
— Allow merging-masking and do not allow zeroing-masking, e.g., gather instructions. 


2.6.5 Compressed Displacement (disp8*N) Support in EVEX 


For memory addressing using disp8 form, EVEX-encoded instructions always use a compressed displacement 

scheme by multiplying disp8 in conjunction with a scaling factor N that is determined based on the vector length, 
the value of EVEX.b bit (embedded broadcast) and the input element size of the instruction. In general, the factor 
N corresponds to the number of bytes characterizing the internal memory operation of the input operand (e.g., 64 
when the accessing a full 512-bit memory vector). The scale factor N is listed in Table 2-34 and Table 2-35 below, 
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where EVEX encoded instructions are classified using the tupletype attribute. The scale factor N of each tupletype 


is listed based on the vector length (VL) and other factors affecting it. 


Table 2-34 covers EVEX-encoded instructions which has a load semantic in conjunction with additional computa- 
tional or data element movement operation, operating either on the full vector or half vector (due to conversion of 
numerical precision from a wider format to narrower format). EVEX.b is supported for such instructions for data 


element sizes which are either dword or qword (see Section 2.6.11). 


EVEX-encoded instruction that are pure load/store, and “Load+op” instruction semantic that operate on data 

element size less then dword do not support broadcasting using EVEX.b. These are listed in Table 2-35. Table 2-35 
also includes many broadcast instructions which perform broadcast using a subset of data elements without using 
EVEX.b. These instructions and a few data element size conversion instruction are covered in Table 2-35. Instruc- 
tion classified in Table 2-35 do not use EVEX.b and EVEX.b must be 0, otherwise #UD will occur. 


The tupletype will be referenced in the instruction operand encoding table in the reference page of each instruction, 
providing the cross reference for the scaling factor N to encoding memory addressing operand. 


Note that the disp8*N rules still apply when using 16b addressing. 


Table 2-34. Compressed Displacement (DISP8*N) Affected by Embedded Broadcast 


TupleType | EVEX.b | InputSize | EVEX.W | Broadcast | N (VL=128) | N(VL=256) | N(VL=512) Comment 
0 32bit 0 none 16 32 64 
1 32bit 0 {1 tox} 4 4 4 Load+Op (Full Vector 
Full 
fe) 64bit 1 none 16 32 64 Dword/Qword) 
1 64bit 1 {1 tox} 8 8 8 
0 32bit 0 none 8 16 32 
Half Load+Op (Half Vector) 
1 32bit 0 {1 tox} 4 4 4 
Table 2-35. EVEX DISP8*N for Instructions Not Affected by Embedded Broadcast 
TupleType InputSize | EVEX.W | N (VL= 128) | N (VL= 256) | N (VL= 512) Comment 
Full Mem N/A N/A 16 32 64 Load/store or subDword full vector 
8bit N/A 1 1 1 
16bit N/A 2 2 2 
Tuple1 Scalar 1Tuple 
32bit 0 4 4 4 
64bit 1 8 8 8 
32bit N/A 4 4 4 i 
Tuple1 Fixed 1 Tuple, memsize not affected by 
64bit N/A 8 8 8 EVEX.W 
32bit 0 8 8 8 
Tuple2 Broadcast (2 elements) 
64bit 1 NA 16 16 
32bit 0 NA 16 16 
Tuple4 Broadcast (4 elements) 
64bit 1 NA NA 32 
Tuples 32bit 0 NA NA 32 Broadcast (8 elements) 
Half Mem N/A N/A 16 32 SubQword Conversion 
Quarter Mem N/A N/A 8 16 SubDword Conversion 
Eighth Mem N/A N/A 4 8 SubWord Conversion 
Mem128 N/A N/A 16 16 16 Shift count from memory 
MOVDDUP N/A N/A 32 64 VMOVDDUP 
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2.6.6 EVEX Encoding of Broadcast/Rounding/SAE Support 
EVEX.b can provide three types of encoding context, depending on the instruction classes: 


¢ Embedded broadcasting of one data element from a source memory operand to the destination for vector 
instructions with “load+op” semantic. 


¢ Static rounding control overriding MXCSR.RC for floating-point instructions with rounding semantic. 


¢ “Suppress All exceptions” (SAE) overriding MXCSR mask control for floating-point arithmetic instructions that 
do not have rounding semantic. 


2.6.7 Embedded Broadcast Support in EVEX 


EVEX encodes an embedded broadcast functionality that is supported on many vector instructions with 32-bit 
(double word or single-precision floating-point) and 64-bit data elements, and when the source operand is from 
memory. EVEX.b (P[20]) bit is used to enable broadcast on load-op instructions. When enabled, only one element 
is loaded from memory and broadcasted to all other elements instead of loading the full memory size. 


The following instruction classes do not support embedded broadcasting: 

¢ Instructions with only one scalar result is written to the vector destination. 
¢ Instructions with explicit broadcast functionality provided by its opcode. 

¢ Instruction semantic is a pure load or a pure store operation. 


2.6.8 Static Rounding Support in EVEX 


Static rounding control embedded in the EVEX encoding system applies only to register-to-register flavor of 
floating-point instructions with rounding semantic at two distinct vector lengths: (i) scalar, (ii) 512-bit. In both 
cases, the field EVEX.L’L expresses rounding mode control overriding MXCSR.RC if EVEX.b is set. When EVEX.b is 
set, “suppress all exceptions” is implied. The processor behaves as if all MXCSR masking controls are set. 


2.6.9 SAE Support in EVEX 


The EVEX encoding system allows arithmetic floating-point instructions without rounding semantic to be encoded 
with the SAE attribute. This capability applies to scalar and 512-bit vector lengths, register-to-register only, by 
setting EVEX.b. When EVEX.b is set, “suppress all exceptions” is implied. The processor behaves as if all MKXCSR 
masking controls are set. 


2.6.10 Vector Length Orthogonality 


The architecture of EVEX encoding scheme can support SIMD instructions operating at multiple vector lengths. 
Many AVX-512 Foundation instructions operate at 512-bit vector length. The vector length of EVEX encoded vector 
instructions are generally determined using the L’L field in EVEX prefix, except for 512-bit floating-point, reg-reg 
instructions with rounding semantic. The table below shows the vector length corresponding to various values of 
the L’L bits. When EVEX is used to encode scalar instructions, L’L is generally ignored. 

When EVEX.b bit is set for a register-register instructions with floating-point rounding semantic, the same two bits 
P2[6:5] specifies rounding mode for the instruction, with implied SAE behavior. The mapping of different instruc- 
tion classes relative to the embedded broadcast/rounding/SAE control and the EVEX.L’L fields are summarized in 
Table 2-36. 
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Table 2-36. EVEX Embedded Broadcast/Rounding/SAE and Vector Length on Vector Instructions 


Position P2[4] P2[6:5] P2[6:5] 
Broadcast/Rounding/SAE Context EVEX.b EVEX.U’L EVEX.RC 
Reg-reg, FP Instructions w/ rounding semantic or SAE Enable static rounding Vector length Implied OOb: SAE + RNE 
control (SAE implied) (512 bit or scalar) 01b: SAE + RD 
10b: SAE + RU 
11b: SAE + RZ 
Load+op Instructions w/ memory source Broadcast Control OOb: 128-bit NA 
Other Instructions ( Must be 0 (otherwise ne a NA 
Explicit Load/Store/Broadcast/Gather/Scatter) #UD) 11b: Reserved (#UD) 


2.6.11 #UD Equations for EVEX 


Instructions encoded using EVEX can face three types of UD conditions: state dependent, opcode independent and 
opcode dependent. 


2.6.11.1 State Dependent #UD 


In general, attempts of execute an instruction, which required OS support for incremental extended state compo- 
nent, will #UD if required state components were not enabled by OS. Table 2-37 lists instruction categories with 
respect to required processor state components. Attempts to execute a given category of instructions while 
enabled states were less than the required bit vector in XCRO shown in Table 2-37 will cause #UD. 


Table 2-37. OS XSAVE Enabling Requirements of Instruction Categories 


Instruction Categories Vector Register State Access Required XCRO Bit Vector [7:0] 
Legacy SIMD prefix encoded Instructions (e.g SSE) XMM XXXXXX1 1b 
VEX-encoded instructions operating on YMM YMM XXXXX111b 
EVEX-encoded 128-bit instructions ZMM 111xx111b 
EVEX-encoded 256-bit instructions ZMM 111xx111b 
EVEX-encoded 512-bit instructions ZMM 111xx111b 
VEX-encoded instructions operating on opmask k-reg 111xxx11b 


2.6.11.2 Opcode Independent #UD 


A number of bit fields in EVEX encoded instruction must obey mode-specific but opcode-independent patterns 
listed in Table 2-38. 


Table 2-38. Opcode Independent, State Dependent EVEX Bit Fields 


Position Notation 64-bit HUD Non-64-bit #UD 
P[3: 2] - if >O if >O 
P[10] -- if O if O 
P[1: 0] EVEX.mm if OOb if OOb 
P[7 : 6] EVEX.RX None (valid) None (BOUND if EVEX.RX != 11b) 
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This section describes legal values for the rest of the EVEX bit fields. Table 2-39 lists the #UD conditions of EVEX 
prefix bit fields which encodes or modifies register operands. 


Table 2-39. #UD Conditions of Operand-Encoding EVEX Prefix Bit Fields 


INSTRUCTION FORMAT 


Notation Position Operand Encoding 64-bit HUD Non-64-bit #UD 
EVEX.R P[7] ModRM.reg encodes k-reg If EVEX.R = 0 None (BOUND if 
ModRM.reg is opcode extension None (ignored) EVEX.RX I= 11D) 
ModRM.reg encodes all other registers None (valid) 
EVEX.X P[6] ModRM.r/m encodes ZMM/YMM/XMM None (valid) 
ModRM.r/m encodes k-reg or GPR None (ignored) 
ModRM.r/m without SIB/VSIB None (ignored) 
ModRM.r/m with SIB/VSIB None (valid) 
EVEX.B P[5] ModRM.r/m encodes k-reg None (ignored) None (ignored) 
ModRM.r/m encodes other registers None (valid) 
ModRM.r/m base present None (valid) 
ModRM.r/m base not present None (ignored) 
EVEX.R’ P[4] ModRM.reg encodes k-reg or GPR If O None (ignored) 
ModRM.reg is opcode extension None (ignored) 
ModRM.reg encodes ZMM/YMM/XMM None (valid) 
EVEX.vvvv P[14: 11] | vvwwv encodes ZMM/YMM/XMM None (valid) None (valid) 
P[14] ignored 
Otherwise If!=1111b Ifl=1111b 
EVEX.V’ P[19] Encodes ZMM/YMM/XMM None (valid) If O 
If O If O 


Otherwise 


Table 2-40 lists the #UD conditions of instruction encoding of opmask register using EVEX.aaa and EVEX.z 


Table 2-40. #UD Conditions of Opmask Related Encoding Field 


Notation Position Operand Encoding 64-bit HUD Non-64-bit #UD 
EVEX.aaa P[18: 16] | Instructions do not use opmask for conditional processing!. If aaa != OOOb If aaa != OOOb 
Opmask used as conditional processing mask and updated | If aaa = OOOb If aaa = OOOb; 
at completion®. 
Opmask used as conditional processing. None (valid?) None (valid') 
EVEX.2z P[23] Vector instruction using opmask as source or destination*. | If EVEX.z != 0 If EVEX.2 != 0 
Store instructions or gather/scatter instructions. If EVEX.z != O If EVEX.2 != O 
Instruction supporting conditional processing mask with If EVEX.z != 0 If EVEX.z != 0 
EVEX.aaa = OOOb. 
VEX.vvvv Varies K-regs are instruction operands not mask control. If vvvv = Oxxxb None 
NOTES: 


1. E.g., VPBROADCASTMxxx, VPMOVM2x, VPMOVx2M. 


2. E.g., Gather/Scatter family. 


3. aaa can take any value. A value of 000 indicates that there is no masking on the instruction; in this case, all elements will be pro- 
cessed as if there was a mask of ‘all ones’ regardless of the actual value in KO. 
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4. E.g., VFPCLASSPD/PS, VCMPB/D/Q/W family, VPMOVM2x, VPMOVxeM. 
Table 2-41 lists the #UD conditions of EVEX bit fields that depends on the context of EVEX.b. 


Table 2-41. #UD Conditions Dependent on EVEX.b Context 


Notation Position Operand Encoding 64-bit HUD Non-64-bit #UD 
EVEX.L'Lb P[22 : 20] | Reg-reg, FP instructions with rounding semantic. None (valid') None (valid’) 
Other reg-reg, FP instructions that can cause #XM. None (valid?) None (valid) 
Other reg-mem instructions in Table 2-34. None (valid) None (valid?) 
Other instruction classes* in Table 2-35. If EVEX.b > 0 If EVEX.b > O 
NOTES: 


1. UL specifies rounding control, see Table 2-36, supports {er} syntax. 

2.UL specifies vector length, see Table 2-36, supports {sae} syntax. 

3. UL specifies vector length, see Table 2-36, supports embedded broadcast syntax 
4. UL specifies either vector length or ignored. 


2.6.12 Device Not Available 
EVEX-encoded instructions follow the same rules when it comes to generating #NM (Device Not Available) excep- 
tion. In particular, it is generated when CRO.TS[bit 3]= 1. 


2.6.13 Scalar Instructions 


EVEX-encoded scalar SIMD instructions can access up to 32 registers in 64-bit mode. Scalar instructions support 
masking (using the least significant bit of the opmask register), but broadcasting is not supported. 


2] EXCEPTION CLASSIFICATIONS OF EVEX-ENCODED INSTRUCTIONS 


The exception behavior of EVEX-encoded instructions can be classified into the classes shown in the rest of this 
section. The classification of EVEX-encoded instructions follow a similar framework as those of AVX and AVX2 
instructions using the VEX prefix. Exception types for EVEX-encoded instructions are named in the style of 

“E##” or with a suffix “E##XX”. The “##” designation generally follows that of AVX/AVX2 instructions. The 
majority of EVEX encoded instruction with “Load+op” semantic supports memory fault suppression, which is repre- 
sented by E##. The instructions with “Load+op” semantic but do not support fault suppression are named 
“E##NF”. A summary table of exception classes by class names are shown below. 


Table 2-42. EVEX-Encoded Instruction Exception Class Summary 


Exception Class Instruction set Mem arg (#XM) 

Type €1 Vector Moves/Load/Stores Explicitly aligned, w/ fault suppression None 

Type E1NF Vector Non-temporal Stores Explicitly aligned, no fault suppression None 
Type E2 FP Vector Load+op Support fault suppression Yes 
Type E2NF FP Vector Load+op No fault suppression Yes 
Type €3 FP Scalar/Partial Vector, Load+Op Support fault suppression Yes 
Type E3NF FP Scalar/Partial Vector, Load+Op No fault suppression Yes 
Type E4 Integer Vector Load+op Support fault suppression No 
Type E4NF Integer Vector Load+op No fault suppression No 
Type €5 Legacy-like Promotion Varies, Support fault suppression No 
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Table 2-42. EVEX-Encoded Instruction Exception Class Summary 


Exception Class Instruction set Mem arg (#XM) 
Type ESNF Legacy-like Promotion Varies, No fault suppression No 
Type E6 Post AVX Promotion Varies, w/ fault suppression No 
Type E6NF Post AVX Promotion Varies, no fault suppression No 
Type E7NM Register-to-register op None None 
Type EONF Miscellaneous 128-bit Vector-length Specific, no fault suppression None 
Type E10 Non-XF Scalar Vector Length ignored, w/ fault suppression None 
Type E10NF Non-XF Scalar Vector Length ignored, no fault suppression None 
Type E11 VCVTPH2PS, VCVTPS2PH Half Vector Length, w/ fault suppression Yes 
Type E12 Gather and Scatter Family VSIB addressing, w/ fault suppression None 
Type E12NP Gather and Scatter Prefetch Family VSIB addressing, w/o page fault None 


Table 2-43 lists EVEX-encoded instruction mnemonic by exception classes. 


Table 2-43. EVEX Instructions in Each Exception Class 


Exception Class 


Instruction 


Type €1 


VMOVAPD, VMOVAPS, VMOVDQA32, VMOVDQA64 


Type E1NF 


VMOVNTDQ, VMOVNTDOA, VMOVNTPD, VMOVNTPS 


Type E2 


VADDPD, VADDPS, VCMPPD, VCMPPS, VCVTDQ2PS, VCVTPD2DQ, VCVTPD2PS, VCVTPD2QQ, VCVTPD2UQQ, 
VCVTPD2UDQ, VCVTPS2DQ, VCVTPS2UDQS, VCVTQQ2PD, VCVTQQ2PS, VCVTTPD2DQ, VCVTTPD2QQ, 
VCVTTPD2UDQ, VCVTTPD2UQQ, VCVTTPS2DQ, VCVTTPS2UDQ, VCVTUDQ2PS, VCVTUQQ2PD, VCVTUQQ2PS, 
VDIVPD, VDIVPS, VEXP2PD, VEXP2PS, VFIXUPIMMPD, VFIXUPIMMPS, VFMADDxxxPD, VFMADDxxxPS, 
VFMADDSUBxxxPD, VFMADDSUBxxxPS, VFMSUBADDxxxPD, VFMSUBADDxxxPS, VFMSUBxxxPD, VFMSUBxxxPS, 
VFNMADDxxxPD, VFNMADDxxxPS, VFNMSUBxxxPD, VFNMSUBxxxPS, VGETEXPPD, VGETEXPPS, VGETMANTPD, 
VGETMANTPS, VMAXPD, VMAXPS, VMINPD, VMINPS, VMULPD, VMULPS, VRANGEPD, VRANGEPS, VREDUCEPD, 
VREDUCEPS, VRNDSCALEPD, VRNDSCALEPS, VRCP28PD, VRCP28PS, VRSQRT28PD, VRSQRT28PS, VSCALEFPD, 
VSCALEFPS, VSQRTPD, VSQRTPS, VSUBPD, VSUBPS 


Type E3 


VADDSD, VADDSS, VCMPSD, VCMPSS, VCVTPS2Q0, VCVTPS2UQQ, VCVTPS2PD, VCVTSD2SS, VCVTSS2SD, 
VCVTTPS2QQ, VCVTTPS2UQQ, VDIVSD, VDIVSS, VFMADDxxxSD, VFMADDxxxSS, VFMSUBxxxSD, VFMSUBxxxSS, 
VFNMADDxxxSD, VFNMADDxxxSS, VFNMSUBxxxSD, VFNMSUBxxxSS, VFIXUPIMMSD, VFIXUPIMMSS, VGETEXPSD, 
VGETEXPSS, VGETMANTSD, VGETMANTSS, VMAXSD, VMAXSS, VMINSD, VMINSS, VMULSD, VMULSS, VRANGESD, 
VRANGESS, VREDUCESD, VREDUCESS, VRNDSCALESD, VRNDSCALESS, VSCALEFSD, VSCALEFSS, VRCP28SD, 
VRCP28SS, VRSQRT28SD, VRSQRT28SS, VSQRTSD, VSQRTSS, VSUBSD, VSUBSS 


Type E3NF 


VCOMISD, VCOMISS, VCVTSD2SI, VCVTSD2USI, VCVTSI2SD, VCVTSI2SS, VCVTSS2SI, VCVTSS2USI, VCVTTSD2SI, 
VCVTTSD2USI, VCVTTSS2SI, VCVTTSS2USI, VCVTUSI2SD, VCVTUSI2SS, VUCOMISD, VUCOMISS 


Type E4 


VANDPD, VANDPS, VANDNPD, VANDNPS, VBLENDMPD, VBLENDMPS, VFPCLASSPD, VFPCLASSPS, VORPD, VORPS, 
VPABSD, VPABSQ, VPADDD, VPADDQ, VPANDD, VPANDQ, VPANDND, VPANDNQ, VPBLENDMB, VPBLENDMD, 
VPBLENDMQ, VPBLENDMW, VPCMPD, VPCMPEQD, VPCMPEQQ, VPCMPGTD, VPCMPGTQ, VPCMPQ, VPCMPUD, 
VPCMPUQ, VPLZCNTD, VPLZCNTQ, VPMADD52LUQ, VPMADD52HUQ, VPMAXSD, VPMAXSQ, VPMAXUD, VPMAXUQ, 
VPMINSD, VPMINSQ, VPMINUD, VPMINUQ, VPMULLD, VPMULLQ, VPMULUDQ, VPMULDQ, VPORD, VPORQ, VPROLD, 
VPROLQ, VPROLVD, VPROLVQ, VPRORD, VPRORQ, VPRORVD, VPRORVQ, (VPSLLD, VPSLLQ, VPSRAD, VPSRAQ, 
VPSRAVW, VPSRAVD, VPSRAVW, VPSRAVQ, VPSRLD, VPSRLQ)', VPSUBD, VPSUBQ, VPSUBUSB, VPSUBUSW, 
VPTERNLOGD, VPTERNLOGQ, VPTESTMD, VPTESTMQ, VPTESTNMD, VPTESTNMQ, VPXORD, VPXORQ, VPSLLVD, 
VPSLLVQ, VRCP14PD, VRCP14PS, VRSORT14PD, VRSQRT14PS, VXORPD, VXORPS 
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Table 2-43. EVEX Instructions in Each Exception Class (Contd.) 


Exception Class 


Instruction 


E4.nb@ 


VCOMPRESSPD, VCOMPRESSPS, VEXPANDPD, VEXPANDPS, VMOVDQU8, VMOVDQU16, VMOVDQU32, 
VMOVDQU64, VMOVUPD, VMOVUPS, VPABSB, VPABSW, VPADDB, VPADDW, VPADDSB, VPADDSW, VPADDUSB, 
VPADDUSW, VPAVGB, VPAVGW, VPCMPB, VPCMPEQB, VPCMPEQW, VPCMPGTB, VPCMPGTW, VPCMPW, VPCMPUB, 
VPCMPUW, VPCOMPRESSD, VPCOMPRESSQ, VPEXPANDD, VPEXPANDQ, VPMAXSB, VPMAXSW, VPMAXUB, 
VPMAXUW, VPMINSB, VPMINSW, VPMINUB, VPMINUW, VPMULHRSW, VPMULHUW, VPMULHW, VPMULLW, 
VPSLLVW, VPSLLW, VPSRAW, VPSRLVW, VPSRLW, VPSUBB, VPSUBW, VPSUBSB, VPSUBSW, VPTESTMB, 
VPTESTMW, VPTESTNMB, VPTESTNMW 


Type E4NF 


VALIGND, VALIGNQ, VPACKSSDW, VPACKUSDW, VPCONFLICTD, VPCONFLICTQ, VPERMD, VPERMI2D, VPERMI2PS, 
VPERMI2PD, VPERMI2Q, VPERMPD, VPERMPS, VPERMQ, VPERMT2D, VPERMT2PS, VPERMT2Q, VPERMT2PD, 
VPERMILPD, VPERMILPS, VPMULTISHIFTQB, VPSHUFD, VPUNPCKHDQ, VPUNPCKHQDQ, VPUNPCKLDQ, 
VPUNPCKLOQDQ, VSHUFF32X4, VSHUFF64X2, VSHUFI32X4, VSHUFI64X2, VSHUFPD, VSHUFPS, VUNPCKHPD, 
VUNPCKHPS, VUNPCKLPD, VUNPCKLPS 


E4NF.nb@ 


VDBPSADBW, VPACKSSWB, VPACKUSWB, VPALIGNR, VPMADDWD, VPMADDUBSW, VMOVSHDUP, VMOVSLDUP, 
VPSADBW, VPSHUFB, VPSHUFHW, VPSHUFLW, VPSLLDQ, VPSRLDQ, VPSLLW, VPSRAW, VPSRLW, (VPSLLD, 
VPSLLOQ, VPSRAD, VPSRAQ, VPSRLD, VPSRLQ)?, VPUNPCKHBW, VPUNPCKHWD, VPUNPCKLBW, VPUNPCKLWD, 
VPERMW, VPERMI2W, VPERMT2W 


Type €5 


Type ESNF 


PMOVSXBW, PMOVSXBW, PMOVSXBD, PMOVSXBQ, PMOVSXWD, PMOVSXWQ, PMOVSXDQ, PMOVZXBW, 
PMOVZXBD, PMOVZXBQ, PMOVZXWD, PMOVZXWQ, PMOVZXDOQ, VCVTDQ2PD, VCVTUDQ2PD, VPMOVSXxx, 
VPMOVZXxx 


VMOVDDUP 


Type E6 


VBROADCASTF32X2, VBROADCASTF32X4, VBROADCASTF64X2, VBROADCASTF32X8, VBROADCASTF64X4, 
VBROADCASTI32X2, VBROADCASTI32X4, VBROADCASTI64X2, VBROADCASTI32X8, VBROADCASTI64X4, 
VBROADCASTSD, VBROADCASTSS, VFPCLASSSD, VFPCLASSSS, VPBROADCASTB, VPBROADCASTD, 
VPBROADCASTW, VPBROADCASTQ, VPMOVQB, VPMOVSQB, VPMOVUSQB, VPMOVQW, VPMOVSQW, VPMOVUSQW, 
VPMOVQD, VPMOVSQD, VPMOVUSQD, VPMOVDB, VPMOVSDB, VPMOVUSDB, VPMOVDW, VPMOVSDW, 
VPMOVUSDW, VPMOVWB, VPMOVSWB, VPMOVUSWB 


Type E6NF 


VEXTRACTF32X4, VEXTRACTF32X8, VEXTRACTF64X2, VEXTRACTF64X4, VEXTRACTI32X4, VEXTRACTI32X8, 
VEXTRACTI64X2, VEXTRACTI64X4, VINSERTF32X4, VINSERTF32X8, VINSERTF64X2, VINSERTF64X4, 
VINSERTI32X4, VINSERTI32X8, VINSERTI64X2, VINSERTI64X4, VPBROADCASTMB2Q, VPBROADCASTMW2D 


Type 
€7NM.128+ 


VMOVHLPS, VMOVLHPS 


Type E7NM. 


(VPBROADCASTD, VPBROADCASTQ, VPBROADCASTB, VPBROADCASTW)?, VPMOVB2M, VPMOVD2M, VPMOVM2B, 
VPMOVM2D, VPMOVM2Q, VPMOVM2W, VPMOVQ2M, VPMOVW2M 


Type EONF 


VEXTRACTPS, VINSERTPS, VMOVHPD, VMOVHPS, VMOVLPD, VMOVLPS, VMOVD, VMOVQ, VPEXTRB, VPEXTRD, 
VPEXTRW, VPEXTRQ, VPINSRB, VPINSRD, VPINSRW, VPINSRQ 


Type E10 


VMOVSD, VMOVSS, VRCP14SD, VRCP14SS, VRSQRT14SD, VRSQRT14SS 


Type €10NF 


(VCVTSI2SD, VCVTUSI2SD)® 


Type €11 


VCVTPH2PS, VCVTPS2PH 


Type E12 


VGATHERDPS, VGATHERDPD, VGATHEROPS, VGATHERQPD, VPGATHERDD, VPGATHERDQ, VPGATHERQD, 
VPGATHERQQ, VPSCATTERDD, VPSCATTERDQ, VPSCATTERQD, VPSCATTERQQ, VSCATTERDPD, VSCATTERDPS, 
VSCATTERQPD, VSCATTERQPS 


Type E12NP 


NOTES: 


VGATHERPFODPD, VGATHERPFODPS, VGATHERPFOQPD, VGATHERPFOOPS, VGATHERPF1 DPD, VGATHERPF1DPS, 
VGATHERPF1QPD, VGATHERPF1 QPS, VSCATTERPFODPD, VSCATTERPFODPS, VSCATTERPFOQPD, 
VSCATTERPFOOQPS, VSCATTERPF1DPD, VSCATTERPF1 DPS, VSCATTERPF1QPD, VSCATTERPF1QPS 


1. Operand encoding Full tupletype with immediate. 
2. Embedded broadcast is not supported with the “.nb” suffix. 
3. Operand encoding Mem1 28 tupletype. 
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4. #UD raised if EVEX.U’L !=00b (VL=128). 
5. The source operand is a general purpose register. 


6. WO encoding only. 


INSTRUCTION FORMAT 


2.7.1 Exceptions Type E1 and E1NF of EVEX-Encoded Instructions 


EVEX-encoded instructions with memory alignment restrictions, and supporting memory fault suppression follow 


exception class E1. 


Table 2-44. Type E1 Class Exception Conditions 


Exception 


Real 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, 
#UD 


>< | Virtual 80x86 


If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

* QOpcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 

* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
= If EVEX.UL I= 10b (VL=512). 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘O’. 


Device Not Avail- 
able, #NM 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is in 
a non-canonical form. 


EVEX.512: Memory operand is not 64-byte aligned. 
EVEX.256: Memory operand is not 32-byte aligned. 
EVEX.128: Memory operand is not 16-byte aligned. 


General Protection, 
#GP(0) 


If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 


Page Fault 
#PF(fault-code) 


If fault suppression not set, and a page fault. 
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INSTRUCTION FORMAT 


EVEX-encoded instructions with memory alignment restrictions, but do not support memory fault suppression 
follow exception class E1NF. 


Table 2-45. Type E1NF Class Exception Conditions 


g |E2 
x | oO 
as | 8 |38| 5 
Exception a © /28! 3 Cause of Exception 
[74 © o al + 
| Le wo 
ho ° ro) 
S |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 

If EVEX.U'L != 10b (VL=512). 


Invalid Opcode, 
#UD 


Xx X X X | If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Device Not Avail- 


able, #NM X | X | X | X J IFCRO.TS[bit 3]=1. 


X For an illegal address in the SS segment. 


Stack, #SS(0 
©) X_ | lfamemory address referencing the SS segment is in a non-canonical form. 


EVEX.512: Memory operand is not 64-byte aligned. 
X X | EVEX.256: Memory operand is not 32-byte aligned. 
EVEX.128: Memory operand is not 16-byte aligned. 


General Protection, x For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 


X_ | If the memory address is in a non-canonical form. 


X X If any part of the operand lies outside the effective address space from O to FFFFH. 


Page Fault 


#PF(fault-code) X | X | X | Fora page fault. 
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2.7.2 


INSTRUCTION FORMAT 


Exceptions Type E2 of EVEX-Encoded Instructions 


EVEX-encoded vector instructions with arithmetic semantic follow exception class E2. 


Table 2-46. Type E2 Class Exception Conditions 


a=) 
es 
= = o0S|# 
Exception o|<s5/25|2 Cause of Exception 
~/si¢els 
E\|ssg 
> lav 
X Xx If EVEX prefix present. 
X X X X | lf an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 0. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
Invalid Opcode, X X |* Opcode independent #UD condition in Table 2-38. 
#UD * Operand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.UL I= 10b (VL=512). 
X X If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X_ | If any corresponding CPUID feature flag is ‘O’. 
Device Not Avail- ee 
able, #NM X X X X | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x._| If fault suppression not set, and a memory address referencing the SS segment is in a 
non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the CS, 
DS, ES, FS or GS segments. 
General Protec- ; 4 : 
tion, #GP(0) X_ | If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 
Page Fault : 
#PF(fault-code) X X X | If fault suppression not set, and a page fault. 
Alignment Check For 2, 4, or 8 byte memory access if alignment checking is enabled and an unaligned 
X X X : : ie ; 
#AC(0) memory access is made while the current privilege level is 3. 
SIMD Floating- F : i 
point Exception, X X X X il a SIMD floating-point exception, {sae} or {er} not set, and CR4.0SXMMEX- 
#XM ‘ 
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27.3 


Exceptions Type E3 and E3NF of EVEX-Encoded Instructions 


EVEX-encoded scalar instructions with arithmetic semantic that support memory fault suppression follow exception 


class E3. 
Table 2-47. Type E3 Class Exception Conditions 
g |E2 
x | oO 
os | 8 |38/ 5 
Exception & ae o 3 < Cause of Exception 
5 Le wo 
E jes 
> |av 
X X If EVEX prefix present. 
X X X X | If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 0. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
; X X |= Qpcode independent #UD condition in Table 2-38. 
Invalid Opcode, #UD * Operand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
Xx X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, X X X X | IFCRO.TS[bit 3]=1. 
#NM 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x _| If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in 
the CS, DS, ES, FS or GS segments. 
oo ELOrC Euan X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
ea #PF (fault X Xx X_ | If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
SIMD Floating-point X X X x If an unmasked SIMD floating-point exception, {sae} or {er} not set, and CR4.0SX- 


Exception, #XM 


MMEXCPT[bit 10] = 1. 
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EVEX-encoded scalar instructions with arithmetic semantic that do not support memory fault suppression follow 
exception class E3NF. 


Table 2-48. Type E3NF Class Exception Conditions 


® |ee 
x | os 
a | 8 |3el| 5 
Exception 2 = 3 @| + Cause of Exception 

=) £eE wo 
E jes 
> |av 

X X EVEX prefix. 

X X X X_ | lfanunmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 0. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 


X X X X_ | If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
Xx X X X_| If any corresponding CPUID feature flag is ‘0’. 


Invalid Opcode, HUD 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X For an illegal address in the SS segment. 
Stack, #SS(0) 


X | lfamemory address referencing the SS segment is in a non-canonical form. 


For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 


General Protection, ar ; 
X_ | If the memory address is in a non-canonical form. 


#GP(0) 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault #PF(fault- X X x | Fora page fault. 
code) 


Alignment Check For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 


SIMD Floating-point If an unmasked SIMD floating-point exception, {sae} or {er} not set, and CR4.0SX- 
Exception, #XM MMEXCPT[bit 10] = 1. 
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2.7.4 Exceptions Type E4 and E4NF of EVEX-Encoded Instructions 


EVEX-encoded vector instructions that cause no SIMD FP exception and support memory fault suppression follow 
exception class E4. 


Table 2-49. Type E4 Class Exception Conditions 


g |Ee 
x | oS 
a |e |es| Ss 
Exception a — |# al ¥ Cause of Exception 
[ad o i=] a Tt 
> 2 = wo 
= ° 
= c Oo 
> |aVv 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 

Operand encoding #UD conditions in Table 2-39. 

Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != O and in E4.nb subclass (see E4.nb entries in Table 2-43). 
If EVEX.U'L != 10b (VL=512). 


Invalid Opcode, #UD 


X X X X_| If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X If fault suppression not set, and an illegal address in the SS segment. 


Stack, #SS(0) lf fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


If fault suppression not set, and an illegal memory operand effective address in 


X 
General Protection, the CS, DS, ES, FS or GS segments. 
#GP(0) X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
ae AEE Gault: X X X_| If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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INSTRUCTION FORMAT 


EVEX-encoded vector instructions that do not cause SIMD FP exception nor support memory fault suppression 
follow exception class E4NF. 


Table 2-50. Type E4NF Class Exception Conditions 


o |ee 
x | oS 
; 3s |e |Be|s 
Exception {a —= |So| ¥ Cause of Exception 
~ oO © a! 6 
Se |#E 
= |eo 
S |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 

Operand encoding #UD conditions in Table 2-39. 

Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != O and in E4NF.nb subclass (see E4NF.nb entries in Table 2-43). 
If EVEX.U'L != 10b (VL=512). 


X X X X_| If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X Xx X X_ | If any corresponding CPUID feature flag is ‘0’. 


Invalid Opcode, #UD 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X For an illegal address in the SS segment. 


Stack, #SS(0 
©) X | lfamemory address referencing the SS segment is in a non-canonical form. 


For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 


. ments. 
General Protection, 


#GP(0) X_| If the memory address is in a non-canonical form. 


If any part of the operand lies outside the effective address space from O to 
FFFFH. 


Page Fault #PF(fault- 


code) X X | X | Fora page fault. 
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INSTRUCTION FORMAT 


2.7.5 Exceptions Type E5 and E5NF 


EVEX-encoded scalar/partial-vector instructions that cause no SIMD FP exception and support memory fault 


suppression follow exception class E5. 


Table 2-51. Type E5 Class Exception Conditions 


Invalid Opcode, #UD 


g |E2 
x | oO 
a | 8 |es|s 
Exception g = 3 @| + Cause of Exception 
=) Le wo 
E j|/e6 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
X y |" Opcode independent #UD condition in Table 2-38. 


Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 
If EVEX.b != 0. 

If EVEX.UL != 10b (VL=512). 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


If CRO.TS[bit 3]=1. 


#AC(0) 


#NM 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x. | If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 
pe PROUEETION, X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
oo #PF (fault X X X_| If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


unaligned memory access is made while the current privilege level is 3. 


EVEX-encoded scalar/partial vector instructions that do not cause SIMD FP exception nor support memory fault 


suppression follow exception class ESNF. 
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INSTRUCTION FORMAT 


Table 2-52. Type E5NF Class Exception Conditions 


g |Z2 
x | o= 
a | 8 |esl| Ss 
Exception & ae o 3 = Cause of Exception 
| £e Ww 
E ile6 
> |aV 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
X y |* Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
= If EVEX.UL I= 10b (VL=512). 
X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X If any corresponding CPUID feature flag is ‘O’. 
Device Not Available, ie 
#NM X X X X | If CRO.TS[bit 3]=1. 
X If an illegal address in the SS segment. 
Stack, #SS(0) - — - 
X | lfamemory address referencing the SS segment is in a non-canonical form. 
X If an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
General Protection, X_ | If the memory address is in a non-canonical form. 
#GP(0) If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault #PF(fault- X X x | Fora page fault 
code) 
Alignment Check xX X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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2.7.6 Exceptions Type E6 and E6NF 
Table 2-53. Type E6 Class Exception Conditions 
o |ee 
x | 9= 
a |e |esl 5 
Exception 2 a o o + Cause of Exception 
3 Le wo 
= Co 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X x |" Opcode independent #UD condition in Table 2-38. 
« QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
= If EVEX.UL I= 10b (VL=512). 
X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X_ | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, ee 
#NM X X | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x. | If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
; X If fault suppression not set, and an illegal memory operand effective address in the 
pray Protection, CS, DS, ES, FS or GS segments. 
X_| If fault suppression not set, and the memory address is in a non-canonical form. 
ea APE fault: X X_| If fault suppression not set, and a page fault. 
Alignment Check xX X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded instructions that do not cause SIMD FP exception nor support memory fault suppression follow 


exception class E6NF. 


Table 2-54. Type E6NF Class Exception Conditions 


#AC(0) 


g lze 
x | oS 
Exception 3 ® 3 2 5 Cause of Exception 
i e/ 3 igs 3 i 
e |3§ 
5 a8 
Invalid Opcode, #UD X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X x |" Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
= If EVEX.UL I= 10b (VL=512). 
X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X_ | If any corresponding CPUID feature flag is ‘0’. 
rites NOnAvetaes x | X | IfCRO.TS[bit 3]=1. 
Stack, #SS(0) X For an illegal address in the SS segment. 
ack, 
X | lfamemory address referencing the SS segment is in a non-canonical form. 
iPinteed X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
eneral Protection, ments. 
#GP(0) ia P 
X_ | If the memory address is in a non-canonical form. 
i ia AEA: X | X | Fora page fault. 
Alignment Check Xx X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


unaligned memory access is made while the current privilege level is 3. 
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2.7.7 Exceptions Type E7NM 


EVEX-encoded instructions that cause no SIMD FP exception and do not reference memory follow exception class 
E7NM. 


Table 2-55. Type E7NM Class Exception Conditions 


g |Ee 
x | c= 
a |e |esl 5S 
Exception 2 alt a] } Cause of Exception 
3 |2 = wo 
E leo 
> |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 

Instruction specific EVEX.L'L restriction not met. 


Invalid Opcode, #UD 


X X X X_ | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_| If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


#NM X X | If CRO.TS[bit 3]=1. 
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INSTRUCTION FORMAT 


Exceptions Type E9 and EONF 


EVEX-encoded vector or partial-vector instructions that do not cause no SIMD FP exception and support memory 


fault suppression follow exception class E9. 


Table 2-56. Type E9 Class Exception Conditions 


Exception 


Real 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


x< 


>< | Virtual 80x86 


If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

* Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 

If EVEX.U'L != OOb (VL=128). 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘O’. 


Device Not Available, 
#NM 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


General Protection, 
#GP(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF(fault- 
code) 


Alignment Check 
#AC(0) 


If fault suppression not set, and a page fault. 


For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded vector or partial-vector instructions that must be encoded with VEX.L’L = 0, do not cause SIMD FP 
exception nor support memory fault suppression follow exception class EONF. 


Table 2-57. Type EONF Class Exception Conditions 


® |ee 
x | o= 
3s | 8 |eesl|s 
Exception o — |fal u Cause of Exception 
[4 © © al + 
=| Le wo 
c ° o 
S |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 

If EVEX.U’L != OOb (VL=128). 


Invalid Opcode, #UD 


X X X X | If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X If an illegal address in the SS segment. 


Stack, #SS(0 
) X | lfamemory address referencing the SS segment is in a non-canonical form. 


X If an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
General Protection, X_ | If the memory address is in a non-canonical form. 
#GP(O) If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault #PF(fault- X X x | Fora page fault 
code) 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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2.7.9 Exceptions Type E10 and E10NF 


EVEX-encoded scalar instructions that ignore EVEX.L’L vector length encoding, do not cause a SIMD FP exception, 
and support memory fault suppression follow exception class E10. 


Table 2-58. Type E10 Class Exception Conditions 


g |E2 
x | o= 
os | 8 |38/ 5 
Exception & = 3 @| + Cause of Exception 
=) Le is) 
E leo 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
X X |= Opcode independent #UD condition in Table 2-38. 
: * QOperand encoding #UD conditions in Table 2-39. 
Invalid Opeode, #UD * Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
X X If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X If any corresponding CPUID feature flag is ‘O’. 
Device Not Available, sh 
#NM X X X X_ | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x _| If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 
ali Protecuen X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 
ie BPE (rault X X X_ | If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded scalar instructions that ignore EVEX.L’L vector length encoding, do not cause a SIMD FP exception, 
and do not support memory fault suppression follow exception class ELONF. 


Table 2-59. Type E10NF Class Exception Conditions 
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o jee 
x | oS 
as | 8 |3e| 5 ; 
Exception g = 3 @| + Cause of Exception 
=| Le wo 
E les 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X X |= Opcode independent #UD condition in Table 2-38. 
. * QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcade, #UD * Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X If any corresponding CPUID feature flag is ‘0’. 
Ee meee Ie) Se cde (196. WPCROTSESTST. 
#NM 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x. | If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 
al PHO EEDD X_ | If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
a BPE (taut: X X X_ | If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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Exception Type E11 (EVEX-only, Mem Arg, No AC, Floating-point Exceptions) 


EVEX-encoded instructions that can cause SIMD FP exception, memory operand support fault suppression but do 


not cause #AC follow exception class E11. 


Table 2-60. Type E11 Class Exception Conditions 


Exception 


Real 


Virtual 80x86 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, HUD 


X 


If EVEX prefix present. 


x< 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

* QOpcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 

* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
= If EVEX.UL I= 10b (VL=512). 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘O’. 


Device Not Available, 
#NM 


x< | XK | XK | OX 


< | K | <1 X< 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


General Protection, 


If fault suppression not set, and an illegal memory operand effective address in the 


#GP(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF (fault- 
code) 


SIMD Floating-Point 


If an unmasked SIMD floating-point exception, {sae} not set, and CR4.0OSXMMEX- 


Exception, #XM 


If fault suppression not set, and a page fault. 


CPT[bit 10] = 1. 
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2.7.11 Exception Type E12 and E12NP (VSIB Mem Arg, No AC, No Floating-point Exceptions) 


Table 2-61. Type E12 Class Exception Conditions 


g Ee 
x | 9= 
. as |e sels ; 
Exception & = 3 @| + Cause of Exception 
2 i|ee| © 
= |26 
> |av 
Invalid Opcode, #UD_ | X X If EVEX prefix present. 
X X If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
* QOpcode independent #UD condition in Table 2-38. 
* Qperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
= If EVEX.b I= 0. 
* If EVEX.UL I= 10b (VL=512). 
= Ifvvvwv!= 11171b. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X NA | If address size attribute is 16 bit. 
X X X X If ModR/M.mod = ‘11b’. 
X X X X If ModR/M.rm != ‘100b". 
X X X X If any corresponding CPUID feature flag is ‘O’. 
X X X X If kO is used (gather or scatter operation). 
X X X X If index = destination register (gather operation). 
Device Not Available, | X X X X If CRO.TS[bit 3]=1. 
#NM 
Stack, #SS(0) X For an illegal address in the SS segment. 
X If amemory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF (fault- X X X For a page fault. 
code) 
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EVEX-encoded prefetch instructions that do not cause #PF follow exception class E12NP. 


Table 2-62. Type E12NP Class Exception Conditions 


INSTRUCTION FORMAT 


Exception 


Real 


Virtual 80x86 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, HUD 


X 


If EVEX prefix present. 


x< 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

« Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 

If EVEX.b != 0. 

If EVEX.U'L != 10b (VL=512). 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
If address size attribute is 16 bit. 


If ModR/M.mod = ‘11b’. 


If ModR/M.rm != ‘100b’. 
If any corresponding CPUID feature flag is ‘O’. 


If kO is used (gather or scatter operation). 


Device Not Available, 


#NM 


< | K | K< | K | OK) xX 


< | K | OK] OK] OK] OK] OK | OX< 


x< | K | K< | KX | xX 


If CRO.TS[bit 3]=1. 
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2.8 EXCEPTION CLASSIFICATIONS OF OPMASK INSTRUCTIONS 


The exception behavior of VEX-encoded opmask instructions are listed below. 
Exception conditions of Opmask instructions that do not address memory are listed as Type K20. 


Table 2-63. TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg) 


g |Ee 
x | o= 
a | 8 |esl| ss : 
Exception 2 = o @ a Cause of Exception 
2/36 ° 
= |2o 
> |av 
Invalid Opcode, HUD | X X X X If relevant CPUID feature flag is ‘0’. 
X X If a VEX prefix is present. 
X X If CR4.0SXSAVE[bit 18]=0. 


If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

* Opcode independent #UD condition in Table 2-38. 
* Operand encoding #UD conditions in Table 2-39. 


If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 


X X If ModRM‘[7:6] != 11b. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 
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Exception conditions of Opmask instructions that address memory are listed as Type K21. 


Table 2-64. TYPE K21 Exception Definition (VEX-Encoded OpMask Instructions Addressing Memory) 


#AC(0) 


o |ee 
x | 9 = 
a | 2 |\be| 5 
Exception 2 = o 9) < Cause of Exception 
2 Pa = wo 
= Cfo 
> |ayv 
Invalid Opcode, #UD | X X X If relevant CPUID feature flag is ‘0’. 
X If a VEX prefix is present. 
X X If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
« Opcode independent #UD condition in Table 2-38. 
« Operand encoding #UD conditions in Table 2-39. 
Device Not Available, Xx X X x | IF CRO.TS[bit 3]=1. 
#NM 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
Stack, #SS(0) X For an illegal address in the SS segment. 
X If a memory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null 
segment selector. 
X If the memory address is in a non-canonical form. 
X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF(fault- X X For a page fault. 
code) 
Alignment Check X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


unaligned memory access is made while the current privilege level is 3. 
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CHAPTER 3 
INSTRUCTION SET REFERENCE, A-L 


This chapter describes the instruction set for the Intel 64 and IA-32 architectures (A-L) in IA-32e, protected, 
virtual-8086, and real-address modes of operation. The set includes general-purpose, x87 FPU, MMX, 
SSE/SSE2/SSE3/SSSE3/SSE4, AESNI/PCLMULQDQ, AVX and system instructions. See also Chapter 4, “Instruction 
Set Reference, M-U,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2B, and 
Chapter 5, “Instruction Set Reference, V-Z,” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2C. 


For each instruction, each operand combination is described. A description of the instruction and its operand, an 
operational description, a description of the effect of the instructions on flags in the EFLAGS register, and a 
summary of exceptions that can be generated are also provided. 


3.1 INTERPRETING THE INSTRUCTION REFERENCE PAGES 


This section describes the format of information contained in the instruction reference pages in this chapter. It 
explains notational conventions and abbreviations used in these sections. 


3.1.1 Instruction Format 


The following is an example of the format used for each instruction description in this chapter. The heading below 
introduces the example. The table below provides an example summary table. 


CMC—Complement Carry Flag [this is an example] 


Opcode Instruction Op/En | 64/32-bit | CPUID Description 
Mode Feature Flag 
F5 CMC ZO VIV NA Complement carry flag. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 


ZO NA NA NA NA 
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3.1.1.1 Opcode Column in the Instruction Summary Table (Instructions without VEX Prefix) 


The “Opcode” column in the table above shows the object code produced for each form of the instruction. When 
possible, codes are given as hexadecimal bytes in the same order in which they appear in memory. Definitions of 
entries other than hexadecimal bytes are as follows: 


NP — Indicates the use of 66/F2/F3 prefixes (beyond those already part of the instructions opcode) are not 
allowed with the instruction. Such use will either cause an invalid-opcode exception (#UD) or result in the 
encoding for a different instruction. 


NFx — Indicates the use of F2/F3 prefixes (beyond those already part of the instructions opcode) are not 
allowed with the instruction. Such use will either cause an invalid-opcode exception (#UD) or result in the 
encoding for a different instruction. 


REX.W — Indicates the use of a REX prefix that affects operand size or instruction semantics. The ordering of 
the REX prefix and other optional/mandatory instruction prefixes are discussed Chapter 2. Note that REX 
prefixes that promote legacy instructions to 64-bit behavior are not listed explicitly in the opcode column. 


/ digit — A digit between 0 and 7 indicates that the ModR/M byte of the instruction uses only the r/m (register 
or memory) operand. The reg field contains the digit that provides an extension to the instruction's opcode. 


/r — Indicates that the ModR/M byte of the instruction contains a register operand and an r/m operand. 


cb, cw, cd, cp, co, ct — A 1-byte (cb), 2-byte (cw), 4-byte (cd), 6-byte (cp), 8-byte (co) or 10-byte (ct) value 
following the opcode. This value is used to specify a code offset and possibly a new value for the code segment 
register. 


ib, iw, id, io — A 1-byte (ib), 2-byte (iw), 4-byte (id) or 8-byte (io) immediate operand to the instruction that 
follows the opcode, ModR/M bytes or scale-indexing bytes. The opcode determines if the operand is a signed 
value. All words, doublewords and quadwords are given with the low-order byte first. 


+rb, +rw, +rd, +ro — Indicated the lower 3 bits of the opcode byte is used to encode the register operand 
without a modR/M byte. The instruction lists the corresponding hexadecimal value of the opcode byte with low 
3 bits as OOOb. In non-64-bit mode, a register code, from 0 through 7, is added to the hexadecimal value of the 
opcode byte. In 64-bit mode, indicates the four bit field of REX.b and opcode[2:0] field encodes the register 
operand of the instruction. “+ro” is applicable only in 64-bit mode. See Table 3-1 for the codes. 


+i — A number used in floating-point instructions when one of the operands is ST(i) from the FPU register stack. 
The number i (which can range from 0 to 7) is added to the hexadecimal byte given at the left of the plus sign 
to form a single opcode byte. 


Table 3-1. Register Codes Associated With +rb, +rw, +rd, +ro 


byte register word register dword register quadword register 
(64-Bit Mode only) 
= a=) u a=) = a=) u ao) 
£ a @ 2 co @ £ a ‘o 2 a @ 
4b & 8B & FE & & B&B & & 
2 | jg |g ~ |j@ |@ FF @& | FF  & 
A None 0 AX None 0 EAX None 0 RAX None 0 
CL None 1 CX None 1 ECX None 1 RCX None 1 
DL None 2 DX None 2 EDX None 2 RDX None 2 
BL None 3 BX None 3 EBX None 3 RBX None 3 
AH Not 4 SP None 4 ESP None 4 N/A N/A N/A 
encodab 
le (N.E.) 
CH N.E. 5 BP None 5 EBP None 5 N/A N/A N/A 
DH N.E. 6 Sl None 6 ESI None 6 N/A N/A N/A 
BH N.E. 7 DI None 7 EDI None 7 N/A N/A N/A 
SPL Yes 4 SP None 4 ESP None 4 RSP None 4 
BPL Yes 5 BP None 5 EBP None 5 RBP None 5 
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Table 3-1. Register Codes Associated With +rb, +rw, +rd, +ro (Contd.) 


byte register word register dword register quadword register 

(64-Bit Mode only) 
g om 3 «|S rn ae a a g a a 
r=) 5 fot 5 oa. ie 25 a op 25 a 
& = e & Pd & = Pd & Pd 
SIL Yes 6 Sl None 6 ESI None 6 RSI None 6 
DIL Yes 7 DI None 7 EDI None 7 RDI None 7 

Registers R8 - R15 (see below): Available in 64-Bit Mode Only 

R8B Yes 0 R8W Yes 0 R8D Yes 0 R8 Yes 0 
RSB Yes 1 ROW Yes 1 RSD Yes 1 RQ Yes 1 
R10B Yes 2 R10W Yes 2 R10D Yes 2 R10 Yes 2 
R11B Yes 3 R11W Yes 3 R11D Yes 3 R11 Yes 3 
R12B Yes 4 R12W Yes 4 R12D Yes 4 R12 Yes 4 
R13B Yes 5 R13W Yes 5 R13D Yes 5 R13 Yes 5 
R14B Yes 6 R14W Yes 6 R14D Yes 6 R14 Yes 6 
R15B Yes 7 R15W Yes 7 R15D Yes 7 R15 Yes 7 


3.1.1.2 Opcode Column in the Instruction Summary Table (Instructions with VEX prefix) 


In the Instruction Summary Table, the Opcode column presents each instruction encoded using the VEX prefix in 
following form (including the modR/M byte if applicable, the immediate byte if applicable): 


VEX.[128,256].[66,F2,F3].0F/OF3A/0F38.[W0,W1] opcode [/r] [/ib,/is4] 


° VEX — Indicates the presence of the VEX prefix is required. The VEX prefix can be encoded using the three- 
byte form (the first byte is C4H), or using the two-byte form (the first byte is C5H). The two-byte form of VEX 
only applies to those instructions that do not require the following fields to be encoded: VEX.mmmmm, VEX.W, 
VEX.X, VEX.B. Refer to Section 2.3 for more detail on the VEX prefix. 


The encoding of various sub-fields of the VEX prefix is described using the following notations: 


— 128,256: VEX.L field can be 0 (denoted by VEX.128 or VEX.LZ) or 1 (denoted by VEX.256). The VEX.L field 
can be encoded using either the 2-byte or 3-byte form of the VEX prefix. The presence of the notation 
VEX.256 or VEX.128 in the opcode column should be interpreted as follows: 


¢ If VEX.256 is present in the opcode column: The semantics of the instruction must be encoded with 
VEX.L = 1. An attempt to encode this instruction with VEX.L= 0 can result in one of two situations: (a) 
if VEX.128 version is defined, the processor will behave according to the defined VEX.128 behavior; (b) 
an #UD occurs if there is no VEX.128 version defined. 


¢ If VEX.128 is present in the opcode column but there is no VEX.256 version defined for the same 
opcode byte: Two situations apply: (a) For VEX-encoded, 128-bit SIMD integer instructions, software 
must encode the instruction with VEX.L = 0. The processor will treat the opcode byte encoded with 
VEX.L= 1 by causing an #UD exception; (b) For VEX-encoded, 128-bit packed floating-point instruc- 
tions, software must encode the instruction with VEX.L = 0. The processor will treat the opcode byte 
encoded with VEX.L= 1 by causing an #UD exception (e.g. VMOVLPS). 


¢ If VEX.LIG is present in the opcode column: The VEX.L value is ignored. This generally applies to VEX- 
encoded scalar SIMD floating-point instructions. Scalar SIMD floating-point instruction can be distin- 
guished from the mnemonic of the instruction. Generally, the last two letters of the instruction 
mnemonic would be either “SS", “SD", or “SI* for SIMD floating-point conversion instructions. 


¢ If VEX.LZ is present in the opcode column: The VEX.L must be encoded to be OB, an #UD occurs if 
VEX.L is not zero. 


— 66,F2,F3: The presence or absence of these values map to the VEX.pp field encodings. If absent, this 
corresponds to VEX.pp=OOB. If present, the corresponding VEX.pp value affects the “opcode” byte in the 
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same way as if a SIMD prefix (66H, F2H or F3H) does to the ensuing opcode byte. Thus a non-zero encoding 
of VEX.pp may be considered as an implied 66H/F2H/F3H prefix. The VEX.pp field may be encoded using 
either the 2-byte or 3-byte form of the VEX prefix. 


OF,OF3A,0F38: The presence maps to a valid encoding of the VEX.mmmmm field. Only three encoded 
values of VEX.mmmmm are defined as valid, corresponding to the escape byte sequence of OFH, OF3AH 
and OF38H. The effect of a valid VEX.mmmmm encoding on the ensuing opcode byte is same as if the corre- 
sponding escape byte sequence on the ensuing opcode byte for non-VEX encoded instructions. Thus a valid 
encoding of VEX.mmmmm may be consider as an implies escape byte sequence of either OFH, OF3AH or 
OF38H. The VEX.mmmmm field must be encoded using the 3-byte form of VEX prefix. 


OF,OF3A,0F38 and 2-byte/3-byte VEX: The presence of OF3A and OF38 in the opcode column implies 
that opcode can only be encoded by the three-byte form of VEX. The presence of OF in the opcode column 
does not preclude the opcode to be encoded by the two-byte of VEX if the semantics of the opcode does not 
require any subfield of VEX not present in the two-byte form of the VEX prefix. 


wo: VEX.W=0. 
W1: VEX.W=1. 


The presence of W0/W1 in the opcode column applies to two situations: (a) it is treated as an extended 
opcode bit, (b) the instruction semantics support an operand size promotion to 64-bit of a general-purpose 
register operand or a 32-bit memory operand. The presence of W1 in the opcode column implies the opcode 
must be encoded using the 3-byte form of the VEX prefix. The presence of WO in the opcode column does 
not preclude the opcode to be encoded using the C5H form of the VEX prefix, if the semantics of the opcode 
does not require other VEX subfields not present in the two-byte form of the VEX prefix. Please see Section 
2.3 on the subfield definitions within VEX. 


WIG: can use C5H form (if not requiring VEX.mmmmm) or VEX.W value is ignored in the C4H form of VEX 
prefix. 


If WIG is present, the instruction may be encoded using either the two-byte form or the three-byte form of 
VEX. When encoding the instruction using the three-byte form of VEX, the value of VEX.W is ignored. 


opcode — Instruction opcode. 


/is4 — An 8-bit immediate byte is present containing a source register specifier in either imm8[7:4] (for 64-bit 
mode) or imm8[6:4] (for 32-bit mode), and instruction-specific payload in imm8[3:0]. 


In general, the encoding o f VEX.R, VEX.X, VEX.B field are not shown explicitly in the opcode column. The 
encoding scheme of VEX.R, VEX.X, VEX.B fields must follow the rules defined in Section 2.3. 


EVEX.[128,256,512,LLIG].[66,F2,F3].0F/OF3A/0F38.[W0,W1,WIG] opcode [/r] [ib] 


EVEX — The EVEX prefix is encoded using the four-byte form (the first byte is 62H). Refer to Section 2.6.1 for 
more detail on the EVEX prefix. 


3-4 


The encoding of various sub-fields of the EVEX prefix is described using the following notations: 


128, 256, 512, LLIG: This corresponds to the vector length; three values are allowed by EVEX: 512-bit, 
256-bit and 128-bit. Alternatively, vector length is ignored (LIG) for certain instructions; this typically 
applies to scalar instructions operating on one data element of a vector register. 


66,F2,F3: The presence of these value maps to the EVEX.pp field encodings. The corresponding VEX.pp 
value affects the “opcode” byte in the same way as if a SIMD prefix (66H, F2H or F3H) does to the ensuing 
opcode byte. Thus a non-zero encoding of VEX.pp may be considered as an implied 66H/F2H/F3H prefix. 


OF,OF3A,0F38: The presence maps to a valid encoding of the EVEX.mmm field. Only three encoded values 
of EVEX.mmm are defined as valid, corresponding to the escape byte sequence of OFH, OF3AH and OF38H. 
The effect of a valid EVEX.mmm encoding on the ensuing opcode byte is the same as if the corresponding 
escape byte sequence on the ensuing opcode byte for non-EVEX encoded instructions. Thus a valid 
encoding of EVEX.mmm may be considered as an implied escape byte sequence of either OFH, OF3AH or 
OF38H. 


wo: EVEX.W=0. 
W1: EVEX.W=1. 
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— WIG: EVEX.W bit ignored 
opcode — Instruction opcode. 


In general, the encoding of EVEX.R and R’, EVEX.X and X’, and EVEX.B and B’ fields are not shown explicitly in 
the opcode column. 


NOTE 


Previously, the terms NDS, NDD and DDS were used in instructions with an EVEX (or VEX) prefix. 
These terms indicated that the vvvv field was valid for encoding, and specified register usage. 
These terms are no longer necessary and are redundant with the instruction operand encoding 
tables provided with each instruction. The instruction operand encoding tables give explicit details 
on all operands, indicating where every operand is stored and if they are read or written. If vvvv is 
not listed as an operand in the instruction operand encoding table, then EVEX (or VEX) vvvv must 
be 0b1111. 


= Oe Instruction Column in the Opcode Summary Table 


The “Instruction” column gives the syntax of the instruction statement as it would appear in an ASM386 program. 
The following is a list of the symbols used to represent operands in the instruction statements: 


rel8 — A relative address in the range from 128 bytes before the end of the instruction to 127 bytes after the 
end of the instruction. 


rel16, rel32 — A relative address within the same code segment as the instruction assembled. The rel16 
symbol applies to instructions with an operand-size attribute of 16 bits; the rel32 symbol applies to instructions 
with an operand-size attribute of 32 bits. 


ptri16:16, ptri6:32 — A far pointer, typically to a code segment different from that of the instruction. The 
notation 16:16 indicates that the value of the pointer has two parts. The value to the left of the colon is a 16- 
bit selector or value destined for the code segment register. The value to the right corresponds to the offset 
within the destination segment. The ptr16:16 symbol is used when the instruction's operand-size attribute is 
16 bits; the ptr16:32 symbol is used when the operand-size attribute is 32 bits. 


r8 — One of the byte general-purpose registers: AL, CL, DL, BL, AH, CH, DH, BH, BPL, SPL, DIL and SIL; or one 
of the byte registers (R8B - R15B) available when using REX.R and 64-bit mode. 


r16 — One of the word general-purpose registers: AX, CX, DX, BX, SP, BP, SI, DI; or one of the word registers 
(R8-R15) available when using REX.R and 64-bit mode. 


r32 — One of the doubleword general-purpose registers: EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI; or one of 
the doubleword registers (R8D - R15D) available when using REX.R in 64-bit mode. 


r64 — One of the quadword general-purpose registers: RAX, RBX, RCX, RDX, RDI, RSI, RBP, RSP, R8-R1i5. 
These are available when using REX.R and 64-bit mode. 


imm8s — An immediate byte value. The imm8 symbol is a signed number between -128 and +127 inclusive. 
For instructions in which imm8 is combined with a word or doubleword operand, the immediate value is sign- 
extended to form a word or doubleword. The upper byte of the word is filled with the topmost bit of the 
immediate value. 


imm1i6 — An immediate word value used for instructions whose operand-size attribute is 16 bits. This is a 
number between -32,768 and +32,767 inclusive. 

imm32 — An immediate doubleword value used for instructions whose operand-size attribute is 32 
bits. It allows the use of a number between +2,147,483,647 and -2,147,483,648 inclusive. 


imm64 — An immediate quadword value used for instructions whose operand-size attribute is 64 bits. 
The value allows the use of a number between +9,223,372,036,854,775,807 and - 
9,223,372,036,854,775,808 inclusive. 


r/m8 — A byte operand that is either the contents of a byte general-purpose register (AL, CL, DL, BL, AH, CH, 
DH, BH, BPL, SPL, DIL and SIL) or a byte from memory. Byte registers R8B - R15B are available using REX.R in 
64-bit mode. 


r/mié6 — A word general-purpose register or memory operand used for instructions whose operand-size 
attribute is 16 bits. The word general-purpose registers are: AX, CX, DX, BX, SP, BP, SI, DI. The contents of 
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memory are found at the address provided by the effective address computation. Word registers R8W - RISW 
are available using REX.R in 64-bit mode. 


¢ r/m32 — A doubleword general-purpose register or memory operand used for instructions whose operand- 
size attribute is 32 bits. The doubleword general-purpose registers are: EAX, ECX, EDX, EBX, ESP, EBP, ESI, 
EDI. The contents of memory are found at the address provided by the effective address computation. 
Doubleword registers R8D - R15D are available when using REX.R in 64-bit mode. 


¢ r/m64 — A quadword general-purpose register or memory operand used for instructions whose operand-size 
attribute is 64 bits when using REX.W. Quadword general-purpose registers are: RAX, RBX, RCX, RDX, RDI, 
RSI, RBP, RSP, R8-R15; these are available only in 64-bit mode. The contents of memory are found at the 
address provided by the effective address computation. 


¢ reg — A general-purpose register used for instructions when the width of the register does not matter to the 
semantics of the operation of the instruction. The register can be r16, r32, or r64. 


°° m-—A16-, 32- or 64-bit operand in memory. 


¢ m8 — A byte operand in memory, usually expressed as a variable or array name, but pointed to by the 
DS:(E)SI or ES:(E)DI registers. In 64-bit mode, it is pointed to by the RSI or RDI registers. 


¢ mi6 — A word operand in memory, usually expressed as a variable or array name, but pointed to by the 
DS:(E)SI or ES:(E)DI registers. This nomenclature is used only with the string instructions. 


¢ m32 — Adoubleword operand in memory, usually expressed as a variable or array name, but pointed to by the 
DS:(E)SI or ES:(E)DI registers. This nomenclature is used only with the string instructions. 


¢ m64— Amemory quadword operand in memory. 
¢ mi28 — A memory double quadword operand in memory. 


°* mi6:16, m16:32 & m16:64 — A memory operand containing a far pointer composed of two numbers. The 
number to the left of the colon corresponds to the pointer's segment selector. The number to the right 
corresponds to its offset. 


* mi16&32, m16&16, M32&32, m16&64 — A memory operand consisting of data item pairs whose sizes are 
indicated on the left and the right side of the ampersand. All memory addressing modes are allowed. The 
mi6&16 and m32&32 operands are used by the BOUND instruction to provide an operand containing an upper 
and lower bounds for array indices. The m16&32 operand is used by LIDT and LGDT to provide a word with 
which to load the limit field, and a doubleword with which to load the base field of the corresponding GDTR and 
IDTR registers. The m16&64 operand is used by LIDT and LGDT in 64-bit mode to provide a word with which to 
load the limit field, and a quadword with which to load the base field of the corresponding GDTR and IDTR 
registers. 


¢ m80Obcd— A Binary Coded Decimal (BCD) operand in memory, 80 bits. 


° moffs8, moffs16, moffs32, moffs64 — A simple memory variable (memory offset) of type byte, word, or 
doubleword used by some variants of the MOV instruction. The actual address is given by a simple offset 
relative to the segment base. No ModR/M byte is used in the instruction. The number shown with moffs 
indicates its size, which is determined by the address-size attribute of the instruction. 

° Sreg — Asegment register. The segment register bit assignments are ES = 0, CS = 1, SS = 2, DS = 3, FS = 4, 
and GS = 5. 

° m32fp, m64fp, mM80fp — A single-precision, double-precision, and double extended-precision (respectively) 
floating-point operand in memory. These symbols designate floating-point values that are used as operands for 
x87 FPU floating-point instructions. 

°* mi16int, m32int, M64int — A word, doubleword, and quadword integer (respectively) operand in memory. 
These symbols designate integers that are used as operands for x87 FPU integer instructions. 


¢ ST or ST(O) — The top element of the FPU register stack. 
° ST(i) — The ith element from the top of the FPU register stack (/ := 0 through 7). 
¢* mm — An MMxX register. The 64-bit MMX registers are: MMO through MM7. 


°* mm/m32 — The low order 32 bits of an MMX register or a 32-bit memory operand. The 64-bit MMX registers 
are: MMO through MM7. The contents of memory are found at the address provided by the effective address 
computation. 
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mm/m64 — An MMxX register or a 64-bit memory operand. The 64-bit MMX registers are: MMO through MM7. 
The contents of memory are found at the address provided by the effective address computation. 

xmm — An XMM register. The 128-bit XMM registers are: XMMO through XMM7; XMM8 through XMM15 are 
available using REX.R in 64-bit mode. 

xmm/m32— An XMM register or a 32-bit memory operand. The 128-bit XMM registers are XMMO through 
XMM7; XMMB8 through XMM15 are available using REX.R in 64-bit mode. The contents of memory are found at 
the address provided by the effective address computation. 

xmm/m64 — An XMM register or a 64-bit memory operand. The 128-bit SIMD floating-point registers are 
XMMO through XMM7; XMMB8 through XMM15 are available using REX.R in 64-bit mode. The contents of 
memory are found at the address provided by the effective address computation. 

xmm/m128 — An XMM register or a 128-bit memory operand. The 128-bit XMM registers are XMMO through 
XMM7; XMMB8 through XMM15 are available using REX.R in 64-bit mode. The contents of memory are found at 
the address provided by the effective address computation. 

<XMMO>-— Indicates implied use of the XMMO register. 


When there is ambiguity, xmm1 indicates the first source operand using an XMM register and xmm2 the second 
source operand using an XMM register. 


Some instructions use the XMMO register as the third source operand, indicated by <XMMO>. The use of the 
third XMM register operand is implicit in the instruction encoding and does not affect the ModR/M encoding. 


ymm — A YMM register. The 256-bit YMM registers are: YMMO through YMM7; YMM8 through YMM15 are 
available in 64-bit mode. 


m256 — A 32-byte operand in memory. This nomenclature is used only with AVX instructions. 
ymm/m256 — A YMM register or 256-bit memory operand. 

<YMMO>— Indicates use of the YMMO register as an implicit argument. 

bnd — A 128-bit bounds register. BNDO through BND3. 


mib — A memory operand using SIB addressing form, where the index register is not used in address calcu- 
lation, Scale is ignored. Only the base and displacement are used in effective address calculation. 


m512 — A 64-byte operand in memory. 
zmm/m512 — A ZMM register or 512-bit memory operand. 


{k1}{z} — A mask register used as instruction writemask. The 64-bit k registers are: k1 through k7. 
Writemask specification is available exclusively via EVEX prefix. The masking can either be done as a merging- 
masking, where the old values are preserved for masked out elements or as a zeroing masking. The type of 
masking is determined by using the EVEX.z bit. 


{k1} — Without {z}: a mask register used as instruction writemask for instructions that do not allow zeroing- 
masking but support merging-masking. This corresponds to instructions that require the value of the aaa field 
to be different than 0 (e.g., gather) and store-type instructions which allow only merging-masking. 


k1 — A mask register used as a regular operand (either destination or source). The 64-bit k registers are: kO 
through k7. 


mV — A vector memory operand; the operand size is dependent on the instruction. 


vm32{x,y, Zz} — A vector array of memory operands specified using VSIB memory addressing. The array of 
memory addresses are specified using a common base register, a constant scale factor, and a vector index 
register with individual elements of 32-bit index value in an XMM register (vm32x), a YMM register (vm32y) or 
a ZMM register (vm322z). 

vm64{x,y, z} — A vector array of memory operands specified using VSIB memory addressing. The array of 
memory addresses are specified using a common base register, a constant scale factor, and a vector index 
register with individual elements of 64-bit index value in an XMM register (vm64x), a YMM register (vm64y) or 
a ZMM register (vm64z). 

zmm/m512/m32bcst — An operand that can be a ZMM register, a 512-bit memory location or a 512-bit 
vector loaded from a 32-bit memory location. 


zmm/m512/m64bcst — An operand that can be a ZMM register, a 512-bit memory location or a 512-bit 
vector loaded from a 64-bit memory location. 
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¢ <ZMMO> — Indicates use of the ZMMO register as an implicit argument. 


° {er} — Indicates support for embedded rounding control, which is only applicable to the register-register form 
of the instruction. This also implies support for SAE (Suppress All Exceptions). 


° {sae} — Indicates support for SAE (Suppress All Exceptions). This is used for instructions that support SAE, 
but do not support embedded rounding control. 

* SRC1 — Denotes the first source operand in the instruction syntax of an instruction encoded with the 
VEX/EVEX prefix and having two or more source operands. 

¢ SRC2 — Denotes the second source operand in the instruction syntax of an instruction encoded with the 
VEX/EVEX prefix and having two or more source operands. 


¢ SRC3 — Denotes the third source operand in the instruction syntax of an instruction encoded with the 
VEX/EVEX prefix and having three source operands. 

¢ SRC — The source in a single-source instruction. 

° DST — The destination in an instruction. This field is encoded by reg_field. 

In the instruction encoding, the MODRM byte is represented several ways depending on the role it plays. The 

MODRM byte has 3 fields: 2-bit MODRM.MOD field, a 3-bit MODRM.REG field and a 3-bit MODRM.RM field. When all 

bits of the MODRM byte have fixed values for an instruction, the 2-hex nibble value of that byte is presented after 

the opcode in the encoding boxes on the instruction description pages. When only some fields of the MODRM byte 

must contain fixed values, those values are specified as follows: 

¢ If only the MODRM.MOD must be 0b11, and MODRM.REG and MODRM.RM fields are unrestricted, this is 
denoted as 11:rrr:bbb. The rrr correspond to the 3-bits of the MODRM.REG field and the bbb correspond to 
the 3-bits of the MODMR.RM field. 


¢ If the MODRM.MOD field is constrained to be a value other than 0b11, i.e., it must be one of Ob00, 0b01, or 
0b1i0, then we use the notation !(11). 


e If the MODRM.REG field had a specific required value, e.g., 0b101, that would be denoted as mm:101:bbb. 


3.1.1.4 Operand Encoding Column in the Instruction Summary Table 


The “operand encoding” column is abbreviated as Op/En in the Instruction Summary table heading. Instruction 
operand encoding information is provided for each assembly instruction syntax using a letter to cross reference to 
a row entry in the operand encoding definition table that follows the instruction summary table. The operand 
encoding table in each instruction reference page lists each instruction operand (according to each instruction 
syntax and operand ordering shown in the instruction column) relative to the ModRM byte, VEX.vvvv field or addi- 
tional operand encoding placement. 


EVEX encoded instructions employ compressed disp8*N encoding of the displacement bytes, where N is defined in 
Table 2-34 and Table 2-35, according to tupletypes. The tupletype for an instruction is listed in the operand 
encoding definition table where applicable. 


NOTES 
¢ = The letters in the Op/En column of an instruction apply ONLY to the encoding definition table 
immediately following the instruction summary table. 
° Inthe encoding definition table, the letter ‘r’ within a pair of parenthesis denotes the content of 
the operand will be read by the processor. The letter ‘w’ within a pair of parenthesis denotes the 
content of the operand will be updated by the processor. 


3.1.1.5 64/32-bit Mode Column in the Instruction Summary Table 


The “64/32-bit Mode” column indicates whether the opcode sequence is supported in (a) 64-bit mode or (b) the 
Compatibility mode and other IA-32 modes that apply in conjunction with the CPUID feature flag associated specific 
instruction extensions. 


The 64-bit mode support is to the left of the ‘slash’ and has the following notation: 
° V— Supported. 
¢ I —Not supported. 
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¢ N.E. — Indicates an instruction syntax is not encodable in 64-bit mode (it may represent part of a sequence of 
valid instructions in other modes). 


¢ N.P. — Indicates the REX prefix does not affect the legacy instruction in 64-bit mode. 
¢ N.I. — Indicates the opcode is treated as a new instruction in 64-bit mode. 


¢ N.S. — Indicates an instruction syntax that requires an address override prefix in 64-bit mode and is not 
supported. Using an address override prefix in 64-bit mode may result in model-specific execution behavior. 


The Compatibility/Legacy Mode support is to the right of the ‘slash’ and has the following notation: 
e V — Supported. 
e I — Not supported. 


e N.E. — Indicates an Intel 64 instruction mnemonics/syntax that is not encodable; the opcode sequence is not 
applicable as an individual instruction in compatibility mode or IA-32 mode. The opcode may represent a valid 
sequence of legacy IA-32 instructions. 


3.1.1.6 CPUID Support Column in the Instruction Summary Table 


The fourth column holds abbreviated CPUID feature flags (e.g., appropriate bit in CPUID.1.ECX, CPUID.1.EDX 
for SSE/SSE2/SSE3/SSSE3/SSE4.1/SSE4.2/AESNI/PCLMULQDQ/AVX/RDRAND support) that indicate processor 
support for the instruction. If the corresponding flag is ‘0’, the instruction will #UD. 


= ae eg Description Column in the Instruction Summary Table 


The “Description” column briefly explains forms of the instruction. 


3.1.1.8 Description Section 


Each instruction is then described by number of information sections. The “Description” section describes the 
purpose of the instructions and required operands in more detail. 
Summary of terms that may be used in the description section: 


° Legacy SSE — Refers to SSE, SSE2, SSE3, SSSE3, SSE4, AESNI, PCLMULQDQ and any future instruction sets 
referencing XMM registers and encoded without a VEX prefix. 


© VEX.vvvv — The VEX bit field specifying a source or destination register (in 1’s complement form). 
¢ rm_field — shorthand for the ModR/M r/m field and any REX.B 
¢ reg_field — shorthand for the ModR/M reg field and any REX.R 


3.1.1.9 Operation Section 


The “Operation” section contains an algorithm description (frequently written in pseudo-code) for the instruction. 
Algorithms are composed of the following elements: 


* Comments are enclosed within the symbol pairs “(*” and “*)”. 


* Compound statements are enclosed in keywords, such as: IF, THEN, ELSE and FI for an if statement; DO and 
OD for a do statement; or CASE... OF for a case statement. 


¢ Aregister name implies the contents of the register. A register name enclosed in brackets implies the contents 
of the location whose address is contained in that register. For example, ES:[DI] indicates the contents of the 
location whose ES segment relative address is in register DI. [SI] indicates the contents of the address 
contained in register SI relative to the SI register’s default segment (DS) or the overridden segment. 


¢ Parentheses around the “E” in a general-purpose register name, such as (E)SI, indicates that the offset is read 
from the SI register if the address-size attribute is 16, from the ESI register if the address-size attribute is 32. 
Parentheses around the “R” in a general-purpose register name, (R)SI, in the presence of a 64-bit register 
definition such as (R)SI, indicates that the offset is read from the 64-bit RSI register if the address-size 
attribute is 64. 
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Brackets are used for memory operands where they mean that the contents of the memory location is a 
segment-relative offset. For example, [SRC] indicates that the content of the source operand is a segment- 
relative offset. 


A :=B indicates that the value of B is assigned to A. 


The symbols =, #, >, <, =, and < are relational operators used to compare two values: meaning equal, not 
equal, greater or equal, less or equal, respectively. A relational expression such as A=B is TRUE if the value of 
A is equal to B; otherwise it is FALSE. 


The expression “« COUNT” and “» COUNT” indicates that the destination operand should be shifted left or right 
by the number of bits indicated by the count operand. 


The following identifiers are used in the algorithmic descriptions: 


OperandSize and AddressSize — The OperandSize identifier represents the operand-size attribute of the 
instruction, which is 16, 32 or 64-bits. The AddressSize identifier represents the address-size attribute, which 
is 16, 32 or 64-bits. For example, the following pseudo-code indicates that the operand-size attribute depends 
on the form of the MOV instruction used. 


IF Instruction = MOVW 
THEN OperandSize := 16; 
ELSE 
IF Instruction = MOVD 
THEN OperandSize := 32; 
ELSE 
IF Instruction = MOVQ 
THEN OperandSize := 64; 
Fl; 
Fl; 
Fl; 
See “Operand-Size and Address-Size Attributes” in Chapter 3 of the Inte/® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 1, for guidelines on how these attributes are determined. 
StackAddrSize — Represents the stack address-size attribute associated with the instruction, which has a 
value of 16, 32 or 64-bits. See “Address-Size Attribute for Stack” in Chapter 6, “Procedure Calls, Interrupts, and 
Exceptions,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1. 
SRC — Represents the source operand. 
DEST — Represents the destination operand. 
MAXVL — The maximum vector register width pertaining to the instruction. This is not the vector-length 
encoding in the instruction's encoding but is instead determined by the current value of XCRO. For details, refer 
to the table below. Note that the value of MAXVL is the largest of the features enabled. Future processors may 
define new bits in XCRO whose setting may imply other values for MAXVL. 


MAXVL Definition 
XCRO Component MAXVL 
XCRO.SSE 128 
XCRO.AVX 256 
XCRO.{ZMM_Hi256, Hi16_ZMM, OPMASK} 512 


The following functions are used in the algorithmic descriptions: 


ZeroExtend(value) — Returns a value zero-extended to the operand-size attribute of the instruction. For 
example, if the operand-size attribute is 32, zero extending a byte value of -10 converts the byte from F6H to 
a doubleword value of OOOOOOF6H. If the value passed to the ZeroExtend function and the operand-size 
attribute are the same size, ZeroExtend returns the value unaltered. 


SignExtend(value) — Returns a value sign-extended to the operand-size attribute of the instruction. For 
example, if the operand-size attribute is 32, sign extending a byte containing the value -10 converts the byte 
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from F6H to a doubleword value of FFFFFFF6H. If the value passed to the SignExtend function and the operand- 
size attribute are the same size, SignExtend returns the value unaltered. 


SaturateSignedWordToSignedByte — Converts a signed 16-bit value to a signed 8-bit value. If the signed 
16-bit value is less than -128, it is represented by the saturated value -128 (80H); if it is greater than 127, it 
is represented by the saturated value 127 (7FH). 


SaturateSignedDwordToSignedWord — Converts a signed 32-bit value to a signed 16-bit value. If the 
signed 32-bit value is less than -32768, it is represented by the saturated value -32768 (8000H),; if it is 
greater than 32767, it is represented by the saturated value 32767 (7FFFH). 


SaturateSignedWordToUnsignedByte — Converts a signed 16-bit value to an unsigned 8-bit value. If the 
signed 16-bit value is less than zero, it is represented by the saturated value zero (OOH); if it is greater than 
255, it is represented by the saturated value 255 (FFH). 


SaturateToSignedByte — Represents the result of an operation as a signed 8-bit value. If the result is less 
than -128, it is represented by the saturated value -128 (80H); if it is greater than 127, it is represented by 
the saturated value 127 (7FH). 


SaturateToSignedWord — Represents the result of an operation as a signed 16-bit value. If the result is less 
than -32768, it is represented by the saturated value -32768 (8000H); if it is greater than 32767, it is 
represented by the saturated value 32767 (7FFFH). 


SaturateToUnsignedByte — Represents the result of an operation as a signed 8-bit value. If the result is less 
than zero it is represented by the saturated value zero (OOH); if it is greater than 255, it is represented by the 
saturated value 255 (FFH). 


SaturateToUnsignedWord — Represents the result of an operation as a signed 16-bit value. If the result is 
less than zero it is represented by the saturated value zero (OOH); if it is greater than 65535, it is represented 
by the saturated value 65535 (FFFFH). 


LowOrderWord(DEST * SRC) — Multiplies a word operand by a word operand and stores the least significant 
word of the doubleword result in the destination operand. 


HighOrderWord(DEST * SRC) — Multiplies a word operand by a word operand and stores the most 
significant word of the doubleword result in the destination operand. 


Push(value) — Pushes a value onto the stack. The number of bytes pushed is determined by the operand-size 
attribute of the instruction. See the “Operation” subsection of the “PUSH—Push Word, Doubleword or 
Quadword Onto the Stack” section in Chapter 4 of the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2B. 


Pop() — removes the value from the top of the stack and returns it. The statement EAX := Pop(); assigns to 
EAX the 32-bit value from the top of the stack. Pop will return either a word, a doubleword or a quadword 
depending on the operand-size attribute. See the “Operation” subsection in the “POP—Pop a Value from the 
Stack” section of Chapter 4 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2B. 


PopRegisterStack — Marks the FPU ST(0) register as empty and increments the FPU register stack pointer 
(TOP) by 1. 

Switch-Tasks — Performs a task switch. 

Bit(BitBase, BitOffset) — Returns the value of a bit within a bit string. The bit string is a sequence of bits in 
memory or a register. Bits are numbered from low-order to high-order within registers and within memory 


bytes. If the BitBase is a register, the BitOffset can be in the range 0 to [15, 31, 63] depending on the mode 
and register size. See Figure 3-1: the function Bit[RAX, 21] is illustrated. 


63 31 21 0 


—_— Offset := 21 


Figure 3-1. Bit Offset for BIT[RAX, 21] 


Vol.2A 3-11 


INSTRUCTION SET REFERENCE, A-L 


If BitBase is a memory address, the BitOffset has different ranges depending on the operand size (see Table 
3-2). 


Table 3-2. Range of Bit Positions Specified by Bit Offset Operands 


Operand Size Immediate BitOffset Register BitOffset 
16 Oto15 -2'to2'-1 
32 0 to 31 <2") toe? 1 
64 0 to 63 =2) tg 291 


The addressed bit is numbered (Offset MOD 8) within the byte at address (BitBase + (BitOffset DIV 8)) where 
DIV is signed division with rounding towards negative infinity and MOD returns a positive number (see 
Figure 3-2). 


7 5 07 07 0 


BitBase +1 BitBase | BitBase-1 


aren =413 


7 07 07 5 0 


BitBase L BitBase-1 BitBase —2 


BitOffset :=-11 zi 


Figure 3-2. Memory Bit Indexing 


3.1.1.10 Intel® C/C++ Compiler Intrinsics Equivalents Section 


The Intel C/C++ compiler intrinsic functions give access to the full power of the Intel Architecture Instruction Set, 
while allowing the compiler to optimize register allocation and instruction scheduling for faster execution. Most of 
these functions are associated with a single IA instruction, although some may generate multiple instructions or 
different instructions depending upon how they are used. In particular, these functions are used to invoke instruc- 
tions that perform operations on vector registers that can hold multiple data elements. These SIMD instructions 
use the following data types. 


© _ mi28,__m256 and __m512 can represent 4, 8 or 16 packed single-precision floating-point values, and are 
used with the vector registers and SSE, AVX, or AVX-512 instruction set extension families. The __m128 data 
type is also used with various single-precision floating-point scalar instructions that perform calculations using 
only the lowest 32 bits of a vector register; the remaining bits of the result come from one of the sources or are 
set to zero depending upon the instruction. 


e  __mi28d, __m256d and __m512d can represent 2, 4 or 8 packed double-precision floating-point values, and 
are used with the vector registers and SSE, AVX, or AVX-512 instruction set extension families. The __m128d 
data type is also used with various double-precision floating-point scalar instructions that perform calculations 
using only the lowest 64 bits of a vector register; the remaining bits of the result come from one of the sources 
or are set to zero depending upon the instruction. 


© _ mi128i,___ m256i and __m512i can represent integer data in bytes, words, doublewords, quadwords, and 
occasionally larger data types. 
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Each of these data types incorporates in its name the number of bits it can hold. For example, the __m128 type 
holds 128 bits, and because each single-precision floating-point value is 32 bits long the __m128 type holds 
(128/32) or four values. Normally the compiler will allocate memory for these data types on an even multiple of the 
size of the type. Such aligned memory locations may be faster to read and write than locations at other addresses. 


These SIMD data types are not basic Standard C data types or C++ objects, so they may be used only with the 
assignment operator, passed as function arguments, and returned from a function call. If you access the internal 
members of these types directly, or indirectly by using them in a union, there may be side effects affecting optimi- 
zation, so it is recommended to use them only with the SIMD instruction intrinsic functions described in this manual 
or the Intel C/C++ compiler documentation. 


Many intrinsic functions names are prefixed with an indicator of the vector length and suffixed by an indicator of 
the vector element data type, although some functions do not follow the rules below. The prefixes are: 


¢ _mm_ indicates that the function operates on 128-bit (or sometimes 64-bit) vectors. 
¢ _—mm256_ indicates the function operates on 256-bit vectors. 

¢ _mm512_ indicates that the function operates on 512-bit vectors. 

The suffixes include: 


¢ _ps, which indicates a function that operates on packed single-precision floating-point data. Packed single- 
precision floating-point data corresponds to arrays of the C/C++ type float with either 4, 8 or 16 elements. 
Values of this type can be loaded from an array using the_mm_loadu_ps, _mm256_loadu_ps, or 
_mm512_loadu_ps functions, or created from individual values using _mm_set_ps, _mm256_set_ps, or 
_mm512_set_ps functions, and they can be stored in an array using_mm_storeu_ps, _mm256_storeu_ps, or 
_mm512_storeu_ps. 


¢ _ss, which indicates a function that operates on scalar single-precision floating-point data. Single-precision 
floating-point data corresponds to the C/C++ type float, and values of type float can be converted to type 
__m128 for use with these functions using the _mm_set_ss function, and converted back using the 
_mm_cvtss_f32 function. When used with functions that operate on packed single-precision floating-point data 
the scalar element corresponds with the first packed value. 


¢  _pd, which indicates a function that operates on packed double-precision floating-point data. Packed double- 
precision floating-point data corresponds to arrays of the C/C++ type double with either 2, 4, or 8 elements. 
Values of this type can be loaded from an array using the_mm_loadu_pd, _mm256_loadu_pd, or 
_mm512_loadu_pd functions, or created from individual values using __mm_set_pd, _mm2566_set_pd, or 
_mm512_set_pd functions, and they can be stored in an array using_mm_storeu_pd, _mm256_storeu_pd, or 
_mm512_storeu_pd. 


¢ _sd, which indicates a function that operates on scalar double-precision floating-point data. Double-precision 
floating-point data corresponds to the C/C++ type double, and values of type double can be converted to type 
___m128d for use with these functions using the __mm_set_sd function, and converted back using the 
_mm_cvtsd_f64 function. When used with functions that operate on packed double-precision floating-point 
data the scalar element corresponds with the first packed value. 


¢ _epi8, which indicates a function that operates on packed 8-bit signed integer values. Packed 8-bit signed 
integers correspond to an array of signed char with 16, 32 or 64 elements. Values of this type can be created 
from individual elements using __mm_set_epi8, _mm256_set_epi8, or _mm512_set_epi8 functions. 


¢ _epil6, which indicates a function that operates on packed 16-bit signed integer values. Packed 16-bit signed 
integers correspond to an array of short with 8, 16 or 32 elements. Values of this type can be created from 
individual elements using _mm_set_epi16, _mm256_set_epi16, or _mm512_set_epi16 functions. 


¢ =_epi32, which indicates a function that operates on packed 32-bit signed integer values. Packed 32-bit signed 
integers correspond to an array of int with 4, 8 or 16 elements. Values of this type can be created from 
individual elements using __mm_set_epi32, _mm256_set_epi32, or _mm512_set_epi32 functions. 


¢ _epi64, which indicates a function that operates on packed 64-bit signed integer values. Packed 64-bit signed 
integers correspond to an array of long long (or /ong if it is a 64-bit data type) with 2, 4 or 8 elements. Values 
of this type can be created from individual elements using _mm_set_epi32, _mm256_set_epi32, or 
_mm512_set_epi32 functions. 


¢ =_epu8, which indicates a function that operates on packed 8-bit unsigned integer values. Packed 8-bit unsigned 
integers correspond to an array of unsigned char with 16, 32 or 64 elements. 
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¢ _epuié, which indicates a function that operates on packed 16-bit unsigned integer values. Packed 16-bit 
unsigned integers correspond to an array of unsigned short with 8, 16 or 32 elements. 


® _epu32, which indicates a function that operates on packed 32-bit unsigned integer values. Packed 32-bit 
unsigned integers correspond to an array of unsigned with 4, 8 or 16 elements. 


° _epué4, which indicates a function that operates on packed 64-bit unsigned integer values. Packed 64-bit 
unsigned integers correspond to an array of unsigned long long (or unsigned Iong if it is a 64-bit data type) with 
2, 4 or 8 elements. 


¢ _si128, which indicates a function that operates on a single 128-bit value of type __m128i. 
¢ _si256, which indicates a function that operates on a single a 256-bit value of type __m256i. 
¢ _si512, which indicates a function that operates on a single a 512-bit value of type __m512i. 


Values of any packed integer type can be loaded from an array using the __mm_loadu_si128, 
_mm256_loadu_si256, or_mm512_loadu_si512 functions, and they can be stored in an array using 
_mm_storeu_si128, _mm256_storeu_si256, or _mm512_storeu_si512. 


These functions and data types are used with the SSE, AVX, and AVX-512 instruction set extension families. In 
addition there are similar functions that correspond to MMX instructions. These are less frequently used because 
they require additional state management, and only operate on 64-bit packed integer values. 


The declarations of Intel C/C++ compiler intrinsic functions may reference some non-standard data types, such as 
__int64. The C Standard header stdint.h defines similar platform-independent types, and the documentation for 
that header gives characteristics that apply to corresponding non-standard types according to the following table. 


Table 3-3. Standard and Non-standard Data Types 


Non-standard Type Standard Type (from stdint.h) 
__int64 int64_t 

unsigned __int64 uint64_t 

__int32 int32_t 

unsigned __int32 uint32_t 

__int16 int16_t 

unsigned __int16 uint16_t 


For a more detailed description of each intrinsic function and additional information related to its usage, refer to the 
online Intel Intrinsics Guide, https://software.intel.com/sites/landingpage/IntrinsicsGuide. 


3.1.1.11 Flags Affected Section 


The “Flags Affected” section lists the flags in the EFLAGS register that are affected by the instruction. When a flag 
is cleared, it is equal to 0; when it is set, it is equal to 1. The arithmetic and logical instructions usually assign values 
to the status flags in a uniform manner (see Appendix A, “EFLAGS Cross-Reference,” in the Inte/® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 1). Non-conventional assignments are described in the “Oper- 
ation” section. The values of flags listed as undefined may be changed by the instruction in an indeterminate 
manner. Flags that are not listed are unchanged by the instruction. 


3.1.1.12 FPU Flags Affected Section 


The floating-point instructions have an “FPU Flags Affected” section that describes how each instruction can affect 
the four condition code flags of the FPU status word. 


3.1.1.13 Protected Mode Exceptions Section 


The “Protected Mode Exceptions” section lists the exceptions that can occur when the instruction is executed in 
protected mode and the reasons for the exceptions. Each exception is given a mnemonic that consists of a pound 
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sign (#) followed by two letters and an optional error code in parentheses. For example, #GP(0) denotes a general 
protection exception with an error code of 0. Table 3-4 associates each two-letter mnemonic with the corre- 

sponding exception vector and name. See Chapter 6, “Procedure Calls, Interrupts, and Exceptions,” in the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for a detailed description of the exceptions. 


Application programmers should consult the documentation provided with their operating systems to determine 


the actions taken when exceptions occur. 


Table 3-4. Intel 64 and IA-32 General Exceptions 


Vector Name Source Protected | Real Virtual 
Mode Address | 8086 
Mode Mode 
0 #DE—Divide Error DIV and IDIV instructions. Yes Yes Yes 
1 #DB—Debug Any code or data reference. Yes Yes Yes 
3 #BP—Breakpoint INT3 instruction. Yes Yes Yes 
4 #0F—Overflow INTO instruction. Yes Yes Yes 
5 #BR—BOUND Range Exceeded BOUND instruction. Yes Yes Yes 
6 #UD—Invalid Opcode (Undefined UD instruction or reserved opcode. Yes Yes Yes 
Opcode) 
7 #NM—Device Not Available (No Floating-point or WAIT/FWAIT instruction. Yes Yes Yes 
Math Coprocessor) 
8 #DF—Double Fault Any instruction that can generate an Yes Yes Yes 
exception, an NMI, or an INTR. 
10 #TS—lInvalid TSS Task switch or TSS access. Yes Reserved Yes 
11 #NP—Segment Not Present Loading segment registers or accessing system Yes Reserved Yes 
segments. 
12 #SS—Stack Segment Fault Stack operations and SS register loads. Yes Yes Yes 
13 #GP—General Protection? Any memory reference and other protection Yes Yes Yes 
checks. 
14 #PF—Page Fault Any memory reference. Yes Reserved Yes 
16 #MF—Floating-Point Error (Math Floating-point or WAIT/FWAIT instruction. Yes Yes Yes 
Fault) 
17 #AC—Alignment Check Any data reference in memory. Yes Reserved Yes 
18 #MC—Machine Check Model dependent machine check errors. Yes Yes Yes 
19 #XM—SIMD Floating-Point SSE/SSE2/SSE3 floating-point instructions. Yes Yes Yes 
Numeric Error 
NOTES: 


1. Apply to protected mode, compatibility mode, and 64-bit mode. 
2. In the real-address mode, vector 13 is the segment overrun exception. 


3.1.1.14 Real-Address Mode Exceptions Section 


The “Real-Address Mode Exceptions” section lists the exceptions that can occur when the instruction is executed in 
real-address mode (see Table 3-4). 


3.1.1.15 Virtual-8086 Mode Exceptions Section 


The “Virtual-8086 Mode Exceptions” section lists the exceptions that can occur when the instruction is executed in 
virtual-8086 mode (see Table 3-4). 
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3.1.1.16 Floating-Point Exceptions Section 


The “Floating-Point Exceptions” section lists exceptions that can occur when an x87 FPU floating-point instruction 
is executed. All of these exception conditions result in a floating-point error exception (#MF, exception 16) being 
generated. Table 3-5 associates a one- or two-letter mnemonic with the corresponding exception name. See 
“Floating-Point Exception Conditions” in Chapter 8 of the Intel® 64 and IA-32 Architectures Software Developer's Manual, 
Volume 1, for a detailed description of these exceptions. 


Table 3-5. x87 FPU Floating-Point Exceptions 


Mnemonic Name Source 
Floating-point invalid operation: 
#IS - Stack overflow or underflow - x87 FPU stack overflow or underflow 
ia - Invalid arithmetic operation - Invalid FPU arithmetic operation 
#Z Floating-point divide-by-zero Divide-by-zero 
#D Floating-point denormal operand Source operand that is a denormal number 
#0 Floating-point numeric overflow Overflow in result 
#U Floating-point numeric underflow Underflow in result 
#P Floating-point inexact result (precision) Inexact result (precision) 


3.1.1.17 SIMD Floating-Point Exceptions Section 


The “SIMD Floating-Point Exceptions” section lists exceptions that can occur when an SSE/SSE2/SSE3 floating- 
point instruction is executed. All of these exception conditions result in a SIMD floating-point error exception (#XM, 
exception 19) being generated. Table 3-6 associates a one-letter mnemonic with the corresponding exception 
name. For a detailed description of these exceptions, refer to "SSE and SSE2 Exceptions”, in Chapter 11 of the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1. 


Table 3-6. SIMD Floating-Point Exceptions 


Mnemonic Name Source 
#I Floating-point invalid operation Invalid arithmetic operation or source operand 
#Z Floating-point divide-by-zero Divide-by-zero 
#D Floating-point denormal operand Source operand that is a denormal number 
#O Floating-point numeric overflow Overflow in result 
#U Floating-point numeric underflow Underflow in result 
#P Floating-point inexact result Inexact result (precision) 


3.1.1.18 Compatibility Mode Exceptions Section 


This section lists exceptions that occur within compatibility mode. 


3.1.1.19 64-Bit Mode Exceptions Section 


This section lists exceptions that occur within 64-bit mode. 
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3.2. _ INSTRUCTIONS (A-L) 


The remainder of this chapter provides descriptions of Intel 64 and IA-32 instructions (A-L). See also: Chapter 4, 
“Instruction Set Reference, M-U,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 


2B, and Chapter 5, “Instruction Set Reference, V-Z,” in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2C. 
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AAA—ASCII Adjust After Addition 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
37 AAA ZO | Invalid Valid ASCII adjust AL after addition. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts the sum of two unpacked BCD values to create an unpacked BCD result. The AL register is the implied 
source and destination operand for this instruction. The AAA instruction is only useful when it follows an ADD 
instruction that adds (binary addition) two unpacked BCD values and stores a byte result in the AL register. The 
AAA instruction then adjusts the contents of the AL register to contain the correct 1-digit unpacked BCD result. 


If the addition produces a decimal carry, the AH register increments by 1, and the CF and AF flags are set. If there 
was no decimal carry, the CF and AF flags are cleared and the AH register is unchanged. In either case, bits 4 
through 7 of the AL register are set to 0. 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 
IF 64-Bit Mode 
THEN 
#UD; 
ELSE 
IF ((AL AND OFH) > 9) or (AF = 1) 
THEN 
AX := AX + 106H; 
AF := 1; 
CF := 1; 
ELSE 
AF := 0; 
CF := 0; 
Fl; 
AL:= AL AND OFH; 
Fl; 
Flags Affected 


The AF and CF flags are set to 1 if the adjustment results in a decimal carry; otherwise they are set to 0. The OF, 
SF, ZF, and PF flags are undefined. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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AAD—ASCII Adjust AX Before Division 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
DS OA AAD ZO | Invalid Valid ASCII adjust AX before division. 
D5 ib AAD imm8s ZO | Invalid Valid Adjust AX before division to number base 
imme. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts two unpacked BCD digits (the least-significant digit in the AL register and the most-significant digit in the 
AH register) so that a division operation performed on the result will yield a correct unpacked BCD value. The AAD 
instruction is only useful when it precedes a DIV instruction that divides (binary division) the adjusted value in the 
AX register by an unpacked BCD value. 


The AAD instruction sets the value in the AL register to (AL + (10 * AH)), and then clears the AH register to OOH. 
The value in the AX register is then equal to the binary equivalent of the original unpacked two-digit (base 10) 
number in registers AH and AL. 


The generalized version of this instruction allows adjustment of two unpacked digits of any number base (see the 
“Operation” section below), by setting the imm8 byte to the selected number base (for example, 08H for octal, OAH 
for decimal, or OCH for base 12 numbers). The AAD mnemonic is interpreted by all assemblers to mean adjust 
ASCII (base 10) values. To adjust values in another number base, the instruction must be hand coded in machine 
code (D5 immé8). 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 
IF 64-Bit Mode 
THEN 
#UD; 
ELSE 
tempAL := AL; 
tempAH := AH; 


AL := (tempAL + (tempAH * imm8)) AND FFH; 
(* imm@ is set to OAH for the AAD mnemonic.*) 
AH := 0; 

FI; 


The immediate value (imm8) is taken from the second byte of the instruction. 


Flags Affected 


The SF, ZF, and PF flags are set according to the resulting binary value in the AL register; the OF, AF, and CF flags 
are undefined. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as protected mode. 


Compatibility Mode Exceptions 
Same exceptions as protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 


AAD—ASCII Adjust AX Before Division Vol.2A 3-21 


INSTRUCTION SET REFERENCE, A-L 


AAM—ASCII Adjust AX After Multiply 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
D4 0A AAM ZO | Invalid Valid ASCII adjust AX after multiply. 
D4 ib AAM imm8s ZO | Invalid Valid Adjust AX after multiply to number base 
immé. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts the result of the multiplication of two unpacked BCD values to create a pair of unpacked (base 10) BCD 
values. The AX register is the implied source and destination operand for this instruction. The AAM instruction is 
only useful when it follows an MUL instruction that multiplies (binary multiplication) two unpacked BCD values and 
stores a word result in the AX register. The AAM instruction then adjusts the contents of the AX register to contain 
the correct 2-digit unpacked (base 10) BCD result. 


The generalized version of this instruction allows adjustment of the contents of the AX to create two unpacked 
digits of any number base (see the “Operation” section below). Here, the imm8 byte is set to the selected number 
base (for example, O8H for octal, OAH for decimal, or OCH for base 12 numbers). The AAM mnemonic is interpreted 
by all assemblers to mean adjust to ASCII (base 10) values. To adjust to values in another number base, the 
instruction must be hand coded in machine code (D4 imm8). 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 


IF 64-Bit Mode 
THEN 
#UD; 
ELSE 
tempAL := AL; 
AH := tempAL / imm8; (* imm@ is set to OAH for the AAM mnemonic *) 
AL := tempAL MOD immé; 
FI; 


The immediate value (imm8) is taken from the second byte of the instruction. 


Flags Affected 
The SF, ZF, and PF flags are set according to the resulting binary value in the AL register. The OF, AF, and CF flags 
are undefined. 


Protected Mode Exceptions 
#DE If an immediate value of 0 is used. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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AAS—ASCII Adjust AL After Subtraction 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
3F AAS ZO ‘| Invalid Valid ASCII adjust AL after subtraction. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts the result of the subtraction of two unpacked BCD values to create a unpacked BCD result. The AL register 
is the implied source and destination operand for this instruction. The AAS instruction is only useful when it follows 
a SUB instruction that subtracts (binary subtraction) one unpacked BCD value from another and stores a byte 
result in the AL register. The AAA instruction then adjusts the contents of the AL register to contain the correct 1- 
digit unpacked BCD result. 


If the subtraction produced a decimal carry, the AH register decrements by 1, and the CF and AF flags are set. If no 
decimal carry occurred, the CF and AF flags are cleared, and the AH register is unchanged. In either case, the AL 
register is left with its top four bits set to 0. 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 
IF 64-bit mode 
THEN 
#UD; 
ELSE 
IF ((AL AND OFH) > 9) or (AF = 1) 
THEN 
AX := AX -6; 
AH:= AH - 1; 
AF := 1; 
CF := 1; 
AL := AL AND OFH; 
ELSE 
CF := 0; 
AF := 0; 
AL := AL AND OFH; 
Fl; 
Fl; 
Flags Affected 


The AF and CF flags are set to 1 if there is a decimal borrow; otherwise, they are cleared to 0. The OF, SF, ZF, and 
PF flags are undefined. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as protected mode. 


Compatibility Mode Exceptions 
Same exceptions as protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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ADC—Add with Carry 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 

14 ib ADC AL, imm8 | Valid Valid Add with carry imm8 to AL. 

15 iw ADC AX, imm16 | Valid Valid Add with carry imm76 to AX. 

15 id ADC EAX, imm32 | Valid Valid Add with carry imm32 to EAX. 

REX.W + 15 id ADC RAX, imm32 | Valid N.E. Add with carry imm32 sign extended to 64- 
bits to RAX. 

80/2 ib ADC r/m8, imm8 MI Valid Valid Add with carry imm8 to r/m8. 

REX + 80/2 ib ADC r/m8 , imm8 MI Valid N.E. Add with carry imm8 to r/m8. 

81/2 iw ADC r/m16, imm16 MI Valid Valid Add with carry imm16 to r/m16. 

81 /2 id ADC r/m32, imm32 MI | Valid Valid Add with CF imm32 to r/m32. 

REX.W + 81 /2 id ADC r/m64, imm32 MI Valid N.E. Add with CF imm32 sign extended to 64-bits 
to r/m64. 

83 /2 ib ADC r/m16, imm8& MI Valid Valid Add with CF sign-extended imm8 to r/m16. 

83 /2 ib ADC r/m32, imm8 MI Valid Valid Add with CF sign-extended imm8 into r/m32. 

REX.W + 83 /2 ib ADC r/m64, imm8& MI Valid N.E. Add with CF sign-extended immé@ into r/m64. 

10/r ADC r/m8, r8 MR | Valid Valid Add with carry byte register to r/m8. 

REX + 10 /r ADC r/m8 , ro MR | Valid N.E. Add with carry byte register to r/m64. 

11 /r ADC r/m16, r16 MR | Valid Valid Add with carry r76 to r/m16. 

11/r ADC r/m32, r32 MR | Valid Valid Add with CF r32 to r/m32. 

REX.W + 11 /r ADC r/m64, r64 MR | Valid N.E. Add with CF r64 to r/m64. 

12/r ADC r8, r/m8 RM _ | Valid Valid Add with carry r/m8 to byte register. 

REX + 12/r ADC 8, r/m8- RM _ | Valid N.E. Add with carry r/m64 to byte register. 

13/r ADC r16, r/m16 RM _ | Valid Valid Add with carry r/m16 to r76. 

13/r ADC r32, r/m32 RM _ | Valid Valid Add with CF r/m32 to r32. 

REX.W + 13 /r ADC r64, r/m64 RM _ | Valid N.E. Add with CF r/m64 to r64. 

NOTES: 


*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
Description 


Adds the destination operand (first operand), the source operand (second operand), and the carry (CF) flag and 

stores the result in the destination operand. The destination operand can be a register or a memory location; the 
source operand can be an immediate, a register, or a memory location. (However, two memory operands cannot be 
used in one instruction.) The state of the CF flag represents a carry from a previous addition. When an immediate 
value is used as an operand, it is sign-extended to the length of the destination operand format. 
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The ADC instruction does not distinguish between signed or unsigned operands. Instead, the processor evaluates 
the result for both data types and sets the OF and CF flags to indicate a carry in the signed or unsigned result, 
respectively. The SF flag indicates the sign of the signed result. 


The ADC instruction is usually executed as part of a multibyte or multiword addition in which an ADD instruction is 
followed by an ADC instruction. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


DEST := DEST + SRC + CF; 


Intel C/C++ Compiler Intrinsic Equivalent 


ADC: extern unsigned char _addcarry_u8(unsigned char c_in, unsigned char src1, unsigned char src2, unsigned char *sum_out); 
ADC: extern unsigned char _addcarry_u16(unsigned char c_in, unsigned short src1, unsigned short src2, unsigned short 
*sum_out); 

ADC: extern unsigned char _addcarry_u32(unsigned char c_in, unsigned int src1, unsigned char int, unsigned int *sum_out); 
ADC: extern unsigned char _addcarry_u64(unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64 
*sum_out); 

Flags Affected 


The OF, SF, ZF, AF, CF, and PF flags are set according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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ADCX — Unsigned Integer Addition of Two Operands with Carry Flag 


Opcode/ Op/ | 64/32bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
66 OF 38 F6 /r RM | V/V ADX Unsigned addition of r32 with CF, r/m32 to r32, writes CF. 
ADCX r32, r/m32 
66 REX.w OF 38 F6 /r RM | V/NE ADX Unsigned addition of r64 with CF, r/m64 to r64, writes CF. 
ADCX r64, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Performs an unsigned addition of the destination operand (first operand), the source operand (second operand) 
and the carry-flag (CF) and stores the result in the destination operand. The destination operand is a general- 
purpose register, whereas the source operand can be a general-purpose register or memory location. The state of 
CF can represent a carry from a previous addition. The instruction sets the CF flag with the carry generated by the 
unsigned addition of the operands. 


The ADCX instruction is executed in the context of multi-precision addition, where we add a series of operands with 
a carry-chain. At the beginning of a chain of additions, we need to make sure the CF is in a desired initial state. 
Often, this initial state needs to be 0, which can be achieved with an instruction to zero the CF (e.g. XOR). 


This instruction is supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 64- 
bit mode. 


In 64-bit mode, the default operation size is 32 bits. Using a REX Prefix in the form of REX.R permits access to addi- 
tional registers (R8-15). Using REX Prefix in the form of REX.W promotes operation to 64 bits. 


ADCX executes normally either inside or outside a transaction region. 


Note: ADCX defines the OF flag differently than the ADD/ADC instructions as defined in Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 2A. 


Operation 
IF OperandSize is 64-bit 
THEN CF:DEST[63:0] := DEST[63:0] + SRC[63:0] + CF; 
ELSE CF:DEST[31:0] := DEST[31:0] + SRC[31:0] + CF; 
Fl; 


Flags Affected 
CF is updated based on result. OF, SF, ZF, AF and PF flags are unmodified. 


Intel C/C++ Compiler Intrinsic Equivalent 
unsigned char _addcarryx_u32 (unsigned char c_in, unsigned int src1, unsigned int src2, unsigned int *sum_out); 
unsigned char _addcarryx_u64 (unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64 *sum_out); 


SIMD Floating-Point Exceptions 
None 
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Protected Mode Exceptions 


#UD 
#SS(0) 


#GP(0) 


#PF(fault-code) 
#AC(0) 


If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 

For an illegal address in the SS segment. 

For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 


If the DS, ES, FS, or GS register is used to access memory and it contains a null segment 
selector. 


For a page fault. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


Real-Address Mode Exceptions 


#UD 


#SS(0) 
#GP(0) 


If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 

For an illegal address in the SS segment. 

If any part of the operand lies outside the effective address space from 0 to FFFFH. 


Virtual-8086 Mode Exceptions 


#UD 


#SS(0) 
#GP(0) 
#PF(fault-code) 
#AC(0) 


If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 

For an illegal address in the SS segment. 

If any part of the operand lies outside the effective address space from 0 to FFFFH. 
For a page fault. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#UD 


#SS(0) 
#GP(0) 
#PF(fault-code) 
#AC(0) 
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If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 

If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

For a page fault. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
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ADD—Add 
Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
04 ib ADD AL, imm8 | Valid Valid Add imm8 to AL. 
05 iw ADD AX, imm16 | Valid Valid Add imm16 to AX. 
05 id ADD EAX, imm32 | Valid Valid Add imm32 to EAX. 
REX.W + 05 id ADD RAX, imm32 | Valid N.E. Add imm32 sign-extended to 64-bits to RAX. 
80 /O ib ADD r/m8, imm8 MI | Valid Valid Add imm8 to r/m8. 
REX + 80 /O ib ADD r/m8 , imm8 MI Valid N.E. Add sign-extended imm8 to r/m8. 
81 /0 iw ADD r/m16, imm16 MI | Valid Valid Add imm16 to r/m16. 
81 /O id ADD r/m32, imm32 MI | Valid Valid Add imm32 to r/m32. 
REX.W + 81 /0 id ADD r/m64, imm32 MI Valid N.E. Add imm32 sign-extended to 64-bits to 
r/m64. 
83 /0 ib ADD r/m16, imm8 MI Valid Valid Add sign-extended imm8 to r/m16. 
83 /0 ib ADD r/m32, imm8& MI Valid Valid Add sign-extended imm8 to r/m32. 
REX.W + 83 /O ib ADD r/m64, imm8 MI Valid N.E. Add sign-extended imm8 to r/m64. 
00 /r ADD r/m8, r8 MR | Valid Valid Add r8 to r/m8. 
REX + 00 /r ADD r/m8, ro MR | Valid N.E. Add r8 to r/m8. 
01 /r ADD r/m16, r16 MR | Valid Valid Add r716 to r/m16. 
01 /r ADD r/m32, r32 MR | Valid Valid Add r32 to r/m32. 
REX.W + 01 /r ADD r/m64, r64 MR | Valid N.E. Add r64 to r/m64, 
02 /r ADD r8, r/m8 RM _ | Valid Valid Add r/m8 to r8. 
REX + 02 /r ADD r8, r/m& RM _ | Valid N.E. Add r/m8 to r8. 
03 /r ADD r16, r/m16 RM | Valid Valid Add r/m16 to r16. 
03 /r ADD r32, r/m32 RM | Valid Valid Add r/m32 to r32. 
REX.W + 03 /r ADD r64, r/m64 RM _ | Valid N.E. Add r/m64 to r64, 
NOTES: 


*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
Description 


Adds the destination operand (first operand) and the source operand (second operand) and then stores the result 
in the destination operand. The destination operand can be a register or a memory location; the source operand 
can be an immediate, a register, or a memory location. (However, two memory operands cannot be used in one 
instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination 
operand format. 


The ADD instruction performs integer addition. It evaluates the result for both signed and unsigned integer oper- 
ands and sets the OF and CF flags to indicate a carry (overflow) in the signed or unsigned result, respectively. The 
SF flag indicates the sign of the signed result. 
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This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


DEST := DEST + SRC; 


Flags Affected 
The OF, SF, ZF, AF, CF, and PF flags are set according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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ADDPD—Add Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
66 OF 58 /r A VV SSE2 Add packed double-precision floating-point values from 
ADDPD xmm1, xmm2/m128 xmm2/mem to xmm1 and store result in xmm1. 
VEX.128.66.0F.WIG 58 /r B VV AVX Add packed double-precision floating-point values from 
VADDPD xmm1,xmm2, xmm3/mem to xmm2 and store result in xmm1. 
xmm3/m128 
VEX.256.66.0F.WIG 58 /r B VIV AVX Add packed double-precision floating-point values from 
VADDPD ymm1, ymm2, ymm3/mem to ymm2 and store result in ymm1. 
ymm3/m256 
EVEX.128.66.0F.W1 58 /r C VIV AVX512VL | Add packed double-precision floating-point values from 
VADDPD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst to xmm2 and store result in xmm1 
xmm3/m128/m64bcst with writemask k1. 
EVEX.256.66.0F.W1 58 /r C VIV AVX512VL | Add packed double-precision floating-point values from 
VADDPD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst to ymm2z and store result in ymm1 
ymm3/m256/m64bcst with writemask k1. 
EVEX.512.66.0F.W1 58 /r C VIV AVX512F Add packed double-precision floating-point values from 
VADDPD zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst to zmm2 and store result in zmm1 
zmm3/m512/m64bcst{er} with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds two, four or eight packed double-precision floating-point values from the first source operand to the second 
source operand, and stores the packed double-precision floating-point result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 

VEX.128 encoded version: the first source operand is a XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VADDPD (EVEX encoded versions) when src2 operand is a vector register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC1[i+63:i] + SRC2[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VADDPD (EVEX encoded versions) when src2 operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := SRC1[i+63:i] + SRC2[63:0] 
ELSE 
DEST[i+63:i] = SRC1[i+63:i] + SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VADDPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] + SRC2[63:0] 
DEST[127:64] := SRC1[127:64] + SRC2[127:64] 
DEST[191:128] := SRC1[191:128] + SRC2[191:128] 
DEST[255:192] := SRC1[255:192] + SRC2[255:192] 
DEST[MAXVL-1:256] := 0 
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VADDPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] + SRC2[63:0] 
DEST[127:64] := SRC1[127:64] + SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


ADDPD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] + SRC[63:0] 
DEST[127:64] := DEST[127:64] + SRC[127:64] 
DEST[MAXVL-1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VADDPD __m512d_mm512_add_pd (__m512d a,__m512d b); 

VADDPD __m512d_mm512_mask_add_pd (__m512ds,__ mmask8 k,__m512da,__m512d b); 
VADDPD __m512d_mm512_maskz_add_pd (__mmask8 k,__m512da,__m512db); 

VADDPD __m256d _mm256_mask_add_pd (__m256ds,__ mmask8 k,__m256d a,__ m256d b); 
VADDPD __m256d __mm256_maskz_add_pd (__mmask8 k,___m256d a,__m256d b); 

VADDPD __m128d_mm_mask_add_pd (__m128ds,__ mmask8 k,__m128d a,__m128d b); 
VADDPD __m128d __mm_maskz_add_pd (__mmask8 k,___m128d a,__m128d b); 


VADDPD __m512d_mm512_add_round_pd (__m512d a,__m512db, int); 
VADDPD __m512d_mm512_mask_add_round_pd (__m512ds,__mmask8k,__m512da,__m512d, int); 
VADDPD __m512d_mm512_maskz_add_round_pd (__mmask8 k,__m512da,__m512db, int); 


ADDPD __m256d __mm256_add_pd (__m256d a, __m256d b),; 
ADDPD __m128d __mm_add_pd (__m128d a, __m128d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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ADDPS—Add Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
NP OF 58 /r A VV SSE Add packed single-precision floating-point values from 
ADDPS xmm1, xmm2/m128 xmm2/m128 to xmm1 and store result in xmm1. 
VEX.128.0F.WIG 58 /r B VV AVX Add packed single-precision floating-point values from 
VADDPS xmm1,xmm2, xmm3/m128 xmm3/m128 to xmm2 and store result in xmm1. 
VEX.256.0F.WIG 58 /r B VIV AVX Add packed single-precision floating-point values from 
VADDPS ymm1, ymm2, ymm3/m256 ymm3/m256 to ymm2 and store result in ymm1. 
EVEX.128.0F.WO 58 /r C VV AVX512VL | Add packed single-precision floating-point values from 
VADDPS xmm1 {k1}{z}, xmme2, AVX512F xmm3/m128/m32bcst to xmm2 and store result in 
xmm3/m128/m32bcst xmm1 with writemask k1. 
EVEX.256.0F.WO 58 /r C VIV AVX512VL | Add packed single-precision floating-point values from 
VADDPS ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst to ymm2 and store result in 
ymm3/m256/m32bcst ymm1 with writemask k1. 
EVEX.512.0F.WO 58 /r C VIV AVX512F Add packed single-precision floating-point values from 
VADDPS zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst to zmm2 and store result in 
zmm3/m512/m32bcst {er} zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds four, eight or sixteen packed single-precision floating-point values from the first source operand with the 
second source operand, and stores the packed single-precision floating-point result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: the first source operand is a XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VADDPS (EVEX encoded versions) when src2 operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC1[i+31:i] + SRC2[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


VADDPS (EVEX encoded versions) when src2 operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] = SRC1[i+31:i] + SRC2[31:0] 
ELSE 
DEST[i+31:i] = SRC1[i+31:i] + SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VADDPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] + SRC2[31:0] 
DEST[63:32] := SRC1[63:32] + SRC2[63:32] 
DEST[95:64] := SRC1[95:64] + SRC2[95:64] 
DEST[127:96] := SRC1[127:96] + SRC2[1 27:96] 
DEST[159:128] := SRC1[159:128] + SRC2[159:128] 
DEST[191:160]:= SRC1[191:160] + SRC2[191:160] 
DEST[223:192] := SRC1[223:192] + SRC2[223:192] 
DEST[255:224] := SRC1[255:224] + SRC2[255:224]. 
DEST[MAXVL-1:256] := 0 


VADDPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] + SRC2[31:0] 
DEST[63:32] := SRC1[63:32] + SRC2[63:32] 
DEST[95:64] := SRC1[95:64] + SRC2[95:64] 
DEST[127:96] := SRC1[127:96] + SRC2[1 27:96] 
DEST[MAXVL-1:128] := 0 


ADDPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] + SRC2[31:0] 
DEST[63:32] := SRC1[63:32] + SRC2[63:32] 
DEST[95:64] := SRC1[95:64] + SRC2[95:64] 
DEST[127:96] := SRC1[127:96] + SRC2[1 27:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VADDPS __m512_mm512_add_ps (_m512 a,__m512 b); 

VADDPS __m512 _mm512_mask_add_ps (__m512 s,__mmask16 k,__m512a,__m512 b); 
VADDPS __m512 _mm512_maskz_add_ps (__mmask16 k,__m512 a,__m512 b); 

VADDPS __m256 _mm256_mask_add_ps (__m256 s,__ mmask8 k,__m256 a,__m256 b); 
VADDPS __m256 _mm256_maskz_add_ps (__mmask8 k,___m256 a,__m256 b); 

VADDPS __m128 _mm_mask_add_ps (__m128ds,__ mmask8 k,__m128 a,__m128 b); 
VADDPS __m128 __mm_maskz_add_ps (__mmask8 k,___m128a,__m128 b); 

VADDPS __m512 _mm512_add_round_ps (__m512 a,__m512), int); 

VADDPS __m512 __mm512_mask_add_round_ps (_m512s,__mmask16 k,__m512 a,__m512 5, int); 
VADDPS __m512 __mm512_maskz_add_round_ps (__mmask16 k,__m512a,__m512 5, int); 
ADDPS __m256 __mm256_add_ps (__m256 a,__m256 b); 

ADDPS __m128_mm_add_ps (__m128 a,_m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, A-L 


ADDSD—Add Scalar Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
F2 OF 58 /r A VIV SSE2 Add the low double-precision floating-point value from 
ADDSD xmm1, xmm2/m64 xmm2/mem to xmm1 and store the result in xmm1. 
VEX.LIG.F2.0F.WIG 58 /r B VIV AVX Add the low double-precision floating-point value from 
VADDSD xmm1, xmm2, xmm3/mem to xmm2 and store the result in xmm1. 
xmm3/m64 
EVEX.LLIG.F2.0F.W1 58 /r C VIV AVX512F Add the low double-precision floating-point value from 
VADDSD xmm1 {k1}{z}, xmm3/m64 to xmme2 and store the result in xmm1 with 
xmm2, xmm3/m64{er} writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
ie Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds the low double-precision floating-point values from the second source operand and the first source operand 
and stores the double-precision floating-point result in the destination operand. 


The second source operand can be an XMM register or a 64-bit memory location. The first source and destination 
operands are XMM registers. 

128-bit Legacy SSE version: The first source and destination operands are the same. Bits (MAXVL-1:64) of the 
corresponding destination register remain unchanged. 


EVEX and VEX.128 encoded version: The first source operand is encoded by EVEX.vvvv/VEX.vvvv. Bits (127:64) of 
the XMM register destination are copied from corresponding bits in the first source operand. Bits (MAXVL-1:128) of 
the destination register are zeroed. 


EVEX version: The low quadword element of the destination is updated according to the writemask. 


Software should ensure VADDSD is encoded with VEX.L=0. Encoding VADDSD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VADDSD (EVEX encoded version) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := SRC1[63:0] + SRC2[63:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VADDSD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] + SRC2[63:0] 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


ADDSD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] + SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VADDSD __m128d_mm_mask_add_sd (__m128ds,__ mmask8 k,__m128d a,__m128d b); 

VADDSD __m128d_mm_maskz_add_sd (__mmask8 k,___m128d a,__m128d b); 

VADDSD __m128d_mm_add_round_sd (__m128d a, _m128d, int); 

VADDSD __m128d_mm_mask_add_round_sd (__m128ds,___ mmask8 k,__m128da,__m128d, int); 
VADDSD __m128d _mm_maskz_add_round_sd (__mmask8 k,___m128d a,__m128d b, int); 

ADDSD __m128d __mm_add_sd (__m128d a, __m128d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, A-L 


ADDSS—Add Scalar Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F3 OF 58 /r A VIV SSE Add the low single-precision floating-point value from 
ADDSS xmm1, xmm2/m32 xmm2/mem to xmm1 and store the result in xmm1. 
VEX.LIG.F3.0F.WIG 58 /r B VIV AVX Add the low single-precision floating-point value from 
VADDSS xmm1,xmme2, xmm3/mem to xmm2 and store the result in xmm1. 
xmm3/m32 
EVEX.LLIG.F3.0F.WO 58 /r C VIV AVX512F | Add the low single-precision floating-point value from 
VADDSS xmm1{k1}{z}, xmm2, xmm3/m32 to xmm2 and store the result in xmm1with 
xmm3/m32{er} writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds the low single-precision floating-point values from the second source operand and the first source operand, 
and stores the double-precision floating-point result in the destination operand. 


The second source operand can be an XMM register or a 64-bit memory location. The first source and destination 
operands are XMM registers. 


128-bit Legacy SSE version: The first source and destination operands are the same. Bits (MAXVL-1:32) of the 
corresponding the destination register remain unchanged. 


EVEX and VEX.128 encoded version: The first source operand is encoded by EVEX.vvvv/VEX.vvvv. Bits (127:32) of 
the XMM register destination are copied from corresponding bits in the first source operand. Bits (MAXVL-1:128) of 
the destination register are zeroed. 


EVEX version: The low doubleword element of the destination is updated according to the writemask. 


Software should ensure VADDSS is encoded with VEX.L=0. Encoding VADDSS with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


VADDSS (EVEX encoded versions) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := SRC1[31:0] + SRC2[31:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VADDSS DEST, SRC1, SRC2 (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] + SRC2[31:0] 

DEST[127:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


ADDSS DEST, SRC (128-bit Legacy SSE version) 
DEST[31:0] := DEST[31:0] + SRC[31:0] 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VADDSS __m128_mm_mask_add_ss (__m128s,__ mmask8 k,__m128a,__m128 b); 

VADDSS __m128_mm_maskz_add_ss (__mmask8 k,__m128a,__m128 b); 

VADDSS __m128_mm_add_round_ss (__m128 a,__m128 5, int); 

VADDSS __m128 __mm_mask_add_round_ss (__m128s,__mmask8 k,__m128 a,__m128 b, int); 
VADDSS __m128_mm_maskz_add_round_ss (__mmask8 k,___m128 a,__m128, int); 

ADDSS __m128 _mm_add_ss (__m128 a,__m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 


3-42 Vol. 2A ADDSS—Add Scalar Single-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, A-L 


ADDSUBPD—Packed Double-FP Add/Subtract 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF DO /r RM | V/V SSE3 Add/subtract double-precision floating-point 
ADDSUBPD xmm1, xmm2/m128 values from xmm2/m128 to xmm1. 
VEX.128.66.0F.WIG DO /r RVM | V/V AVX Add/subtract packed double-precision 
VADDSUBPD xmm1, xmm2, xmm3/m128 floating-point values from xmm3/mem to 
xmm_2 and stores result in xmm1. 
VEX.256.66.0F.WIG DO /r RVM | V/V AVX Add / subtract packed double-precision 
VADDSUBPD ymm1, ymm2, ymm3/m256 floating-point values from ymm3/mem to 
ymm_2 and stores result in ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds odd-numbered double-precision floating-point values of the first source operand (second operand) with the 
corresponding double-precision floating-point values from the second source operand (third operand); stores the 
result in the odd-numbered values of the destination operand (first operand). Subtracts the even-numbered 
double-precision floating-point values from the second source operand from the corresponding double-precision 
floating values in the first source operand; stores the result into the even-numbered values of the destination 
operand. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. See Figure 3-3. 


VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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ADDSUBPD xmm_1, xmm2/m128 


[127:64] [63:0] xmm2/m128 


! ! 


xmm1[127:64] + xmm2/m128[127:64] xmm1[63:0] - xmm2/m128[63:0] 


RESULT: 
xmm1 


[127:64] [63:0] 


Figure 3-3. ADDSUBPD—Packed Double-FP Add/Subtract 


Operation 


ADDSUBPD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] - SRC[63:0] 
DEST[127:64] := DEST[127:64] + SRC[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


VADDSUBPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC2[63:0] 
DEST[127:64] := SRC1[127:64] + SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


VADDSUBPD (VEX.256 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC2[63:0] 
DEST[127:64] := SRC1[127:64] + SRC2[127:64] 
DEST[191:128] := SRC1[191:1 28] - SRC2[191:128] 
DEST[255:192] := SRC1[255:192] + SRC2[255:192] 


Intel C/C++ Compiler Intrinsic Equivalent 


ADDSUBPD: m128d_mm_addsub_pd(__m128d a,__m128d b) 
VADDSUBPD: m256d _mm256_addsub_pd (__m256d a, ___m256d b) 
Exceptions 


When the source operand is a memory operand, it must be aligned on a 16-byte boundary or a general-protection 
exception (#GP) will be generated. 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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ADDSUBPS—Packed Single-FP Add/Subtract 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
F2 OF DO /r RM |V/V SSE3 Add/subtract single-precision floating-point 
ADDSUBPS xmm1, xmm2/m128 values from xmm2/m128 to xmm1. 
VEX.128.F2.0F.WIG DO /r RVM | V/V AVX Add/subtract single-precision floating-point 


values from xmm3/mem to xmm2 and stores 


VADDSUBPS xmm1, xmm2, xmm3/m128 
result in xmm1. 


VEX.256.F2.0F.WIG DO /r RVM | V/V AVX 
VADDSUBPS ymm1, ymm2, ymm3/m256 


Add / subtract single-precision floating-point 
values from ymm3/mem to ymm_2 and stores 
result in ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds odd-numbered single-precision floating-point values of the first source operand (second operand) with the 
corresponding single-precision floating-point values from the second source operand (third operand); stores the 
result in the odd-numbered values of the destination operand (first operand). Subtracts the even-numbered 
single-precision floating-point values from the second source operand from the corresponding single-precision 
floating values in the first source operand; stores the result into the even-numbered values of the destination 
operand. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. See Figure 3-4. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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Operation 


ADDSUBPS xm 


m1, xmm2/m128 


[127:96] 


[95:64] 


[63:32] 


f 


J 


J 


| 


xmm1[127:96] + 
xmm2/m128[127:96] 


xmm1[95:64] - xmm2/ 
m128[95:64] 


xmm1 [63:32] + 
xmm2/m128[63:32] 


xmm1[31:0] - 
xmm2/m128[31:0] 


RESULT: 
xmm1 


[127:96] 


[95:64] 


[63:32] 


[31:0] 


OM15992 


Figure 3-4. ADDSUBPS—Packed Single-FP Add/Subtract 


ADDSUBPS (128-bit Legacy SSE version) 
DEST[31:0] := DEST[31:0] - SRC[31:0] 


DEST[63:32] = DEST[63:32] + SRC[63:32] 
DEST[95:64] := DEST[95:64] - SRC[95:64] 


DEST[127:96] := DEST[127:96] + SRC[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


VADDSUBPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[63:32] := SRC1[63:32] + SRC2[63:32] 
DEST[95:64] := SRC1[95:64] - SRC2[95:64] 
DEST[127:96] := SRC1[127:96] + SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


VADDSUBPS (VEX.256 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[63:32] := SRC1[63:32] + SRC2[63:32] 
DEST[95:64] := SRC1[95:64] - SRC2[95:64] 
DEST[127:96] := SRC1[127:96] + SRC2[127:96] 
DEST[159:128] := SRC1[159:1 28] - SRC2[159:128] 
DEST[191:160] := SRC1[191:160] + SRC2[191:160] 
DEST[223:192] := SRC1[223:192] - SRC2[223:192] 
DEST[255:224] := SRC1[255:224] + SRC2[255:224]. 


Intel C/C++ Compiler Intrinsic Equivalent 


ADDSUBPS: 
VADDSUBPS: 


Exceptions 


m128 _mm_addsub_ps( 


m128 a,__m128 b) 
m256 __mm256_addsub_ps (__m256 a, 


m256 b) 


When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general- 
protection exception (#GP) will be generated. 
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INSTRUCTION SET REFERENCE, A-L 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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ADOX — Unsigned Integer Addition of Two Operands with Overflow Flag 


Opcode/ Op/ | 64/32bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
F3 OF 38 F6 /r RM | V/V ADX Unsigned addition of r32 with OF, r/m32 to r32, writes OF. 
ADOX 32, r/m32 
F3 REX.w OF 38 F6 /r RM | V/NE ADX Unsigned addition of r64 with OF, r/m64 to r64, writes OF. 
ADOX r64, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Performs an unsigned addition of the destination operand (first operand), the source operand (second operand) 
and the overflow-flag (OF) and stores the result in the destination operand. The destination operand is a general- 
purpose register, whereas the source operand can be a general-purpose register or memory location. The state of 
OF represents a carry from a previous addition. The instruction sets the OF flag with the carry generated by the 
unsigned addition of the operands. 


The ADOX instruction is executed in the context of multi-precision addition, where we add a series of operands with 
a carry-chain. At the beginning of a chain of additions, we execute an instruction to zero the OF (e.g. XOR). 


This instruction is supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 64-bit 
mode. 


In 64-bit mode, the default operation size is 32 bits. Using a REX Prefix in the form of REX.R permits access to addi- 
tional registers (R8-15). Using REX Prefix in the form of REX.W promotes operation to 64-bits. 


ADOX executes normally either inside or outside a transaction region. 


Note: ADOX defines the CF and OF flags differently than the ADD/ADC instructions as defined in Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 2A. 


Operation 
IF OperandSize is 64-bit 
THEN OF:DEST[63:0] := DEST[63:0] + SRC[63:0] + OF; 
ELSE OF:DEST[31:0] := DEST[31:0] + SRC[31:0] + OF; 
Fl; 


Flags Affected 
OF is updated based on result. CF, SF, ZF, AF and PF flags are unmodified. 


Intel C/C++ Compiler Intrinsic Equivalent 
unsigned char _addcarryx_u32 (unsigned char c_in, unsigned int src1, unsigned int src2, unsigned int *sum_out); 
unsigned char _addcarryx_u64 (unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64 *sum_out); 


SIMD Floating-Point Exceptions 
None 
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Protected Mode Exceptions 


#UD If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 

#SS(0) For an illegal address in the SS segment. 

#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null segment 
selector. 

#PF(fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 
#SS(0) For an illegal address in the SS segment. 
#GP(0) If any part of the operand lies outside the effective address space from 0 to FFFFH. 


Virtual-8086 Mode Exceptions 


#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 
#SS(0) For an illegal address in the SS segment. 
#GP(0) If any part of the operand lies outside the effective address space from 0 to FFFFH. 
#PF(fault-code) For a page fault. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0. 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
#PF(fault-code) For a page fault. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 
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AESDEC—Perform One Round of an AES Decryption Flow 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 38 DE /r A VIN AES Perform one round of an AES decryption flow, using 


AESDEC xmm1, xmm2/m128 the Equivalent Inverse Cipher, using one 128-bit data 
(state) from xmm1 with one 128-bit round key from 


xmm2/m128. 


VEX.128.66.0F38.WIG DE /r B VIN AES Perform one round of an AES decryption flow, using 

VAESDEC xmm1, xmm2, xmm3/m128 AVX the Equivalent Inverse Cipher, using one 128-bit data 
(state) from xmm2 with one 128-bit round key from 
xmm3/m1 28; store the result in xmm1. 

VEX.256.66.0F38.WIG DE /r B VN VAES Perform one round of an AES decryption flow, using 


VAESDEC ymm1, ymm2, ymm3/m256 the Equivalent Inverse Cipher, using two 128-bit data 
(state) from ymm2 with two 128-bit round keys from 


ymm3/m256; store the result in ymm1. 


EVEX.128.66.0F38.WIG DE /r C VIN VAES Perform one round of an AES decryption flow, using 
VAESDEC xmm1, xmm2, xmm3/m128 AVX512VL | the Equivalent Inverse Cipher, using one 128-bit data 
(state) from xmm2 with one 128-bit round key from 
xmm3/m128; store the result in xmm1. 


EVEX.256.66.0F38.WIG DE /r Cc VIN VAES Perform one round of an AES decryption flow, using 
VAESDEC ymm1, ymm2, ymm3/m256 AVX512VL | the Equivalent Inverse Cipher, using two 128-bit data 
(state) from ymm2 with two 128-bit round keys from 
ymm3/m256; store the result in ymm1. 


EVEX.512.66.0F38.WIG DE /r C VIV VAES 
VAESDEC zmm1, zmm2, zmm3/m512 AVX512F 


Perform one round of an AES decryption flow, using 
the Equivalent Inverse Cipher, using four 1 28-bit data 
(state) from zmm2 with four 128-bit round keys from 
zmm3/m512; store the result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs a single round of the AES decryption flow using the Equivalent Inverse Cipher, using 
one/two/four (depending on vector length) 128-bit data (state) from the first source operand with one/two/four 
(depending on vector length) round key(s) from the second source operand, and stores the result in the destination 
operand. 


Use the AESDEC instruction for all but the last decryption round. For the last decryption round, use the AESDE- 
CLAST instruction. 


VEX and EVEX encoded versions of the instruction allow 3-operand (non-destructive) operation. The legacy 
encoded versions of the instruction require that the first source operand and the destination operand are the same 
and must be an XMM register. 


The EVEX encoded form of this instruction does not support memory fault suppression. 
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Operation 


AESDEC 

STATE := SRC1; 

RoundKey := SRC2; 

STATE := InvShiftRows( STATE ); 
STATE := InvSubBytes( STATE ); 
STATE := InvMixColumns( STATE ); 
DEST[127:0] := STATE XOR RoundKey; 
DEST[MAXVL-1:128] (Unmodified) 


VAESDEC (128b and 256b VEX encoded versions) 
(KL,VL) = (1,128), (2,256) 
FOR i = 0 to KL-1: 

STATE := SRC1.xmm[i] 

RoundKey := SRC2.xmm{[i] 

STATE := InvShiftRows( STATE ) 

STATE := InvSubBytes( STATE ) 

STATE := InvMixColumns( STATE ) 

DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


VAESDEC (EVEX encoded version) 
(KL,VL) = (1,128), (2,256), (4,512) 
FOR i = 0 to KL-1: 
STATE := SRC1.xmm[i] 
RoundKey := SRC2.xmm[i] 
STATE := InvShiftRows( STATE ) 
STATE := InvSubBytes( STATE ) 
STATE := InvMixColumns( STATE ) 
DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] :=0 


Intel C/C++ Compiler Intrinsic Equivalent 


m256i); 


(V)AESDEC m128i __mm_aesdec (__m128i, __m128i) 
VAESDEC m256i__mm256_aesdec_epil 28(__m256i, 
VAESDEC m512i_mm512_aesdec_epil 28(__m512i, 


m512i); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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AESDEC1 28KL—Perform Ten Rounds of AES Decryption Flow with Key Locker Using 128-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 DD |(11):rrr:bbb A VIN AESKLE Decrypt xmm using 128-bit AES key indicated by han- 
AESDEC1 28KL xmm, m384 dle at m384 and store result in xmm. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


The AESDEC128KL! instruction performs 10 rounds of AES to decrypt the first operand using the 128-bit key indi- 
cated by the handle from the second operand. It stores the result in the first operand if the operation succeeds 
(e.g., does not run into a handle violation failure). 


Operation 


AESDEC128KL 
Handle := UnalignedLoad of 384 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = (HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [2] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES1 28); 
IF (Illegal Handle) { 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate384 (Handle[383:0], IwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 
DEST := AES128Decrypt (DEST, UnwrappedKey) ; 
RFLAGS.ZF := 0; 
FI; 
FI; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESDEC128KL —_ unsigned char __mm_aesdec1 28kl_u8(__m128i* odata, __m128i idata, const void* h); 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
#PF If a page fault occurs. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
If a memory address referencing the SS segment is in a non-canonical form. 
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AESDEC256KL—Perform 14 Rounds of AES Decryption Flow with Key Locker Using 256-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 DF !(11):rrr:bbb A VIN AESKLE Decrypt xmm using 256-bit AES key indicated by han- 
AESDEC256KL xmm, m512 dle at m512 and store result in xmm. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


The AESDEC256KL! instruction performs 14 rounds of AES to decrypt the first operand using the 256-bit key indi- 
cated by the handle from the second operand. It stores the result in the first operand if the operation succeeds 
(e.g., does not run into a handle violation failure). 


Operation 


AESDEC256KL 
Handle := UnalignedLoad of 512 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = (HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [2] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES256); 
IF (Illegal Handle) 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate5 12 (Handle[51 1:0], IwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 
DEST := AES256Decrypt (DEST, UnwrappedKey) ; 
RFLAGS.ZF := 0; 
FI; 
FI; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESDEC256KL unsigned char __mm_aesdec256kl_u8(__m128i* odata, __m128i idata, const void* h); 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
#PF If a page fault occurs. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
If a memory address referencing the SS segment is in a non-canonical form. 
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AESDECLAST—Perform Last Round of an AES Decryption Flow 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 38 DF /r A VV AES Perform the last round of an AES decryption flow, 
AESDECLAST xmm1, xmm2/m128 using the Equivalent Inverse Cipher, using one 128-bit 
data (state) from xmm1 with one 128-bit round key 
from xmm2/m128. 
VEX.128.66.0F38.WIG DF /r B VV AES Perform the last round of an AES decryption flow, 
VAESDECLAST xmm1, xmm2, xmm3/m128 AVX using the Equivalent Inverse Cipher, using one 128-bit 
data (state) from xmm2 with one 128-bit round key 
from xmm3/m1 28; store the result in xmm1. 
VEX.256.66.0F38.WIG DF /r B VN VAES Perform the last round of an AES decryption flow, 
VAESDECLAST ymm1, ymm2, ymm3/m256 using the Equivalent Inverse Cipher, using two 128- 
bit data (state) from ymm2 with two 128-bit round 
keys from ymm3/m256; store the result in ymm1. 
EVEX.128.66.0F38.WIG DF /r C VIN VAES Perform the last round of an AES decryption flow, 
VAESDECLAST xmm1, xmm2, xmm3/m128 AVX512VL | using the Equivalent Inverse Cipher, using one 128-bit 
data (state) from xmm2 with one 128-bit round key 
from xmm3/m1 28; store the result in xmm1. 
EVEX.256.66.0F38.WIG DF /r C VIN VAES Perform the last round of an AES decryption flow, 
VAESDECLAST ymm1, ymm2, ymm3/m256 AVX512VL | using the Equivalent Inverse Cipher, using two 128- 
bit data (state) from ymm2 with two 128-bit round 
keys from ymm3/m256; store the result in ymm1. 
EVEX.512.66.0F38.WIG DF /r C VIN VAES Perform the last round of an AES decryption flow, 
VAESDECLAST zmm1, zmm2, zmm3/m512 AVX512F | using the Equivalent Inverse Cipher, using four1 28-bit 
data (state) from zmme with four 128-bit round keys 
from zmm3/m512; store the result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs the last round of the AES decryption flow using the Equivalent Inverse Cipher, using 
one/two/four (depending on vector length) 128-bit data (state) from the first source operand with one/two/four 
(depending on vector length) round key(s) from the second source operand, and stores the result in the destination 


operand. 


VEX and EVEX encoded versions of the instruction allow 3-operand (non-destructive) operation. The legacy 
encoded versions of the instruction require that the first source operand and the destination operand are the same 
and must be an XMM register. 


The EVEX encoded form of this instruction does not support memory fault suppression. 
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AESDECLAST—Perform Last Round of an AES Decryption Flow 


Operation 


AESDECLAST 

STATE := SRC1; 

RoundKey := SRC2; 

STATE := InvShiftRows( STATE ); 
STATE := InvSubBytes( STATE ); 
DEST[127:0] := STATE XOR RoundKey; 
DEST[MAXVL-1:128] (Unmodified) 


VAESDECLAST (128b and 256b VEX encoded versions) 
(KL,VL) = (1,128), (2,256) 
FOR i = 0 to KL-1: 

STATE := SRC1.xmm[i] 

RoundKey := SRC2.xmm[i] 

STATE := InvShiftRows( STATE ) 

STATE := InvSubBytes( STATE ) 

DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


VAESDECLAST (EVEX encoded version) 
(KL,VL) = (1,128), (2,256), (4,512) 
FOR i = 0 to KL-1: 
STATE := SRC1.xmm[i] 
RoundKey := SRC2.xmm[i] 
STATE := InvShiftRows( STATE ) 
STATE := InvSubBytes( STATE ) 
DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)AESDECLAST __m128i_mm_aesdeclast (__m128i,__m128i) 
VAESDECLAST m256i_mm256_aesdeclast_epil 28(__m256i, 


m256i); 


VAESDECLAST m512i_mm512_aesdeclast_epi1 28(__m512i, 


m512i); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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AESDECWIDE128KL—Perform Ten Rounds of AES Decryption Flow with Key Locker on 8 Blocks 
Using 128-Bit Key 


Opcode/ Op/ |64/32-bit | CPUID Feature | Description 

Instruction En |Mode Flag 

F3 OF 38 D8 \(11):001:bbb A VN AESKLEWIDE_KL | Decrypt XMMO-7 using 128-bit AES key indicated 

AESDECWIDE1 28KL m384, <XMMO-7> by handle at m384 and store each resultant block 
back to its corresponding register. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operands 2 - 9 
A NA ModRM:r/m (r) Implicit XMMO-7 (r, w) 
Description 


The AESDECWIDE128KL! instruction performs ten rounds of AES to decrypt each of the eight blocks in XMMO-7 
using the 128-bit key indicated by the handle from the second operand. It replaces each input block in XMMO-7 with 
its corresponding decrypted block if the operation succeeds (e.g., does not run into a handle violation failure). 


Operation 


AESDECWIDE128KL 
Handle := UnalignedLoad of 384 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = (HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [2] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES1 28); 
IF (Illegal Handle) 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate384 (Handle[383:0], IwKey); 
IF Authentic == 0 { 
THEN RFLAGS.ZF := 1; 
ELSE 
XMMO := AES128Decrypt 
XMM1 := AES128Decrypt 
XMM2 := AES128Decrypt 
XMM3 := AES128Decrypt 
XMM4 := AES128Decrypt 
XMM5 := AES128Decrypt 
XMM6 := AES128Decrypt 
XMM7 := AES128Decrypt 
RFLAGS.ZF := 0; 


, 


XMMO, UnwrappedKey) 
XMM1, UnwrappedKey) 
XMM2, UnwrappedKey) ; 
XMM3, UnwrappedKey) ; 
) 
) 
) 
) 


, 


XMM4, UnwrappedKey 
XMM5, UnwrappedKey 
XMMB6, UnwrappedKey 
XMM7, UnwrappedKey 


, 


, 


, 


aS peed cS «Soren cen es ps es 


, 


Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Intel C/C++ Compiler Intrinsic Equivalent 


AESDECWIDE1 28KL unsigned char _mm_aesdecwide1 28k|_u8(__m128i odata[8], const __m128i idata[8], const void* h); 


Exceptions (All Operating Modes) 


#UD If the LOCK prefix is used. 
If CPUID.07H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 


If CR4.OSFXSR = 0. 
If CPUID.19H:EBX.WIDE_KL [bit 2] = 0. 


#NM If CRO.TS = 1. 

#PF If a page fault occurs. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 


If a memory address referencing the SS segment is in a non-canonical form. 
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AESDECWIDE256KL—Perform 14 Rounds of AES Decryption Flow with Key Locker on 8 Blocks 
Using 256-Bit Key 


Opcode/ Op/ |64/32-bit | CPUID Feature | Description 

Instruction En |Mode Flag 

F3 OF 38 D8 \(11):011:bbb A VN AESKLEWIDE_KL | Decrypt XMMO-7 using 256-bit AES key indicated 

AESDECWIDE256KL m512, <XMMO-7> by handle at m512 and store each resultant block 
back to its corresponding register. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operands 2 - 9 
A NA ModRM:r/m (r) Implicit XMMO-7 (r, w) 
Description 


The AESDECWIDE256KL! instruction performs 14 rounds of AES to decrypt each of the eight blocks in XMMO-7 
using the 256-bit key indicated by the handle from the second operand. It replaces each input block in XMMO-7 with 
its corresponding decrypted block if the operation succeeds (e.g., does not run into a handle violation failure). 


Operation 


AESDECWIDE256KL 

Handle := UnalignedLoad of 512 bit (SRC); // Load is not guaranteed to be atomic. 

Illegal Handle = (HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [2] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES256); 

IF (Illegal Handle) { 

THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate5 12 (Handle[51 1:0], lwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 

XMMO := AES256Decrypt 
XMM1 := AES256Decrypt 
XMM2 := AES256Decrypt 
XMM3 := AES256Decrypt 
XMM4 := AES256Decrypt 
XMM5 := AES256Decrypt 
XMM6 := AES256Decrypt 
XMM7 := AES256Decrypt 
RFLAGS.ZF := 0; 


, 


XMMO, UnwrappedKey) 
XMM1, UnwrappedKey) 
XMM2, UnwrappedKey) 
XMM3, UnwrappedKey) ; 
XMM4, UnwrappedKey) ; 
) 
) 
) 


, 


, 


XMM5, UnwrappedKey 
XMMB6, UnwrappedKey 
XMM7, UnwrappedKey 


, 


, 


aS pemene ce < Soaring Syn omens pas pomiae 


, 


Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Intel C/C++ Compiler Intrinsic Equivalent 


AESDECWIDE256KL unsigned char _mm_aesdecwide256kl_u8(__m128i odata[8], const __m128i idata[8], const void* h); 


Exceptions (All Operating Modes) 


#UD If the LOCK prefix is used. 
If CPUID.07H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 


If CR4.OSFXSR = 0. 
If CPUID.19H:EBX.WIDE_KL [bit 2] = 0. 


#NM If CRO.TS = 1. 

#PF If a page fault occurs. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 


If a memory address referencing the SS segment is in a non-canonical form. 
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AESENC—Perform One Round of an AES Encryption Flow 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 38 DC /r A VIN AES Perform one round of an AES encryption flow, using one 
AESENC xmm1, xmm2/m128 128-bit data (state) from xmm1 with one 128-bit round 
key from xmm2/m128. 
VEX.128.66.0F38.WIG DC /r B VV AES Perform one round of an AES encryption flow, using one 
VAESENC xmm1, xmm2, xmm3/m128 AVX 128-bit data (state) from xmme2 with one 128-bit round 
key from the xmm3/m1 28; store the result in xmm1. 
VEX.256.66.0F38.WIG DC /r B VIN VAES Perform one round of an AES encryption flow, using two 
VAESENC ymm1, ymm2, ymm3/m256 128-bit data (state) from ymme with two 128-bit round 
keys from the ymm3/m256; store the result in ymm1. 
EVEX.128.66.0F38.WIG DC /r C VIN VAES Perform one round of an AES encryption flow, using one 
VAESENC xmm1, xmm2, xmm3/m128 AVX512VL_ | 128-bit data (state) from xmm2 with one 128-bit round 
key from the xmm3/m1 28; store the result in xmm1. 
EVEX.256.66.0F38.WIG DC /r C VIN VAES Perform one round of an AES encryption flow, using two 
VAESENC ymm1, ymm2, ymm3/m256 AVX512VL_ | 128-bit data (state) from ymm2 with two 128-bit round 
keys from the ymm3/m256; store the result in ymm1. 
EVEX.512.66.0F38.WIG DC /r C VN VAES Perform one round of an AES encryption flow, using four 
VAESENC zmm1, zmm2, zmm3/m512 AVX512F 128-bit data (state) from zmm2 with four 128-bit round 
keys from the zmm3/m512; store the result in zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs a single round of an AES encryption flow using one/two/four (depending on vector length) 
128-bit data (state) from the first source operand with one/two/four (depending on vector length) round key(s) 
from the second source operand, and stores the result in the destination operand. 

Use the AESENC instruction for all but the last encryption rounds. For the last encryption round, use the AESENC- 
CLAST instruction. 

VEX and EVEX encoded versions of the instruction allow 3-operand (non-destructive) operation. The legacy 
encoded versions of the instruction require that the first source operand and the destination operand are the same 
and must be an XMM register. 


The EVEX encoded form of this instruction does not support memory fault suppression. 


Operation 

AESENC 

STATE := SRC1; 

RoundKey := SRC2; 

STATE := ShiftRows( STATE ); 

STATE := SubBytes( STATE ); 

STATE := MixColumns( STATE ); 
DEST[127:0] := STATE XOR RoundKey; 
DEST[MAXVL-1:128] (Unmodified) 
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VAESENC (128b and 256b VEX encoded versions) 
(KL,VL) = (1,128), (2,256) 
FOR | := 0 to KL-1: 

STATE := SRC1.xmm[i] 

RoundKey := SRC2.xmm[i] 

STATE := ShiftRows( STATE ) 

STATE := SubBytes( STATE ) 

STATE := MixColumns( STATE ) 

DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


VAESENC (EVEX encoded version) 
(KL,VL) = (1,128), (2,256), (4,512) 
FOR i := 0 to KL-1: 


STATE := SRC1.xmm{i] // xmm[i] is the i’th xmm word in the SIMD register 


RoundKey := SRC2.xmm[i] 

STATE := ShiftRows( STATE ) 

STATE := SubBytes( STATE ) 

STATE := MixColumns( STATE ) 

DEST.xmmi] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)AESENC: m128i _mm_aesenc (__m128i,___m128i) 
VAESENC __m256i __mm256_aesenc_epil28(__m256i, __ m256i); 
VAESENC __m512i_mm512_aesenc_epil28(__m512i,___m512i); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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AESENC128KL—Perform Ten Rounds of AES Encryption Flow with Key Locker Using 128-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 DC !(11):rrr:bbb A VIN AESKLE Encrypt xmm using 128-bit AES key indicated by han- 
AESENC128KL xmm, m384 dle at m384 and store result in xmm. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


The AESENC128KL! instruction performs ten rounds of AES to encrypt the first operand using the 128-bit key indi- 
cated by the handle from the second operand. It stores the result in the first operand if the operation succeeds 
(e.g., does not run into a handle violation failure). 


Operation 


AESENC128KL 
Handle := UnalignedLoad of 384 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = ( 

HandleReservedBitSet (Handle) || 

(Handle[O] AND (CPL > O)) || 

Handle [1] || 

HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES128 


); 
IF (Illegal Handle) { 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate384 (Handle[383:0], IlwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 
DEST := AES128Encrypt (DEST, UnwrappedKey) ; 
RFLAGS.ZF := 0; 
Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESENC128KL unsigned char __mm_aesenc1 28kl_u8(__m128i* odata, __m128i idata, const void* h); 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
#PF If a page fault occurs. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
If a memory address referencing the SS segment is in a non-canonical form. 
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AESENC256KL—Perform 14 Rounds of AES Encryption Flow with Key Locker Using 256-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 DE !(11):rrr:bbb A VN AESKLE Encrypt xmm using 256-bit AES key indicated by han- 
AESENC256KL xmm, m512 dle at m512 and store result in xmm. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


The AESENC256KL! instruction performs 14 rounds of AES to encrypt the first operand using the 256-bit key indi- 
cated by the handle from the second operand. It stores the result in the first operand if the operation succeeds 
(e.g., does not run into a handle violation failure). 


Operation 


AESENC256KL 
Handle := UnalignedLoad of 512 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = ( 

HandleReservedBitSet (Handle) || 

(Handle[0] AND (CPL > O)) || 

Handle [1] || 

HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES256 


); 
IF (Illegal Handle) 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate5 12 (Handle[51 1:0], IwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 
DEST := AES256Encrypt (DEST, UnwrappedKey) ; 
RFLAGS.ZF := 0; 
FI; 
FI; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESENC256KL unsigned char __mm_aesenc256kl_u8(__m128i* odata, __m128i idata, const void* h); 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
#PF If a page fault occurs. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
If a memory address referencing the SS segment is in a non-canonical form. 
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AESENCLAST—Perform Last Round of an AES Encryption Flow 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 

66 OF 38 DD /r A VIN AES Perform the last round of an AES encryption flow, 

AESENCLAST xmm1, xmm2/m128 using one 128-bit data (state) from xmm1 with one 
128-bit round key from xmm2/m128. 

VEX.128.66.0F38.WIG DD /r B VV AES Perform the last round of an AES encryption flow, 

VAESENCLAST xmm1, xmm2, xmm3/m1 28 AVX using one 128-bit data (state) from xmm2 with one 
128-bit round key from xmm3/m1 28; store the result 
inxmm1. 

VEX.256.66.0F38.WIG DD /r B VV VAES Perform the last round of an AES encryption flow, 

VAESENCLAST ymm1, ymm2, ymm3/m256 using two 128-bit data (state) from ymm2 with two 
128-bit round keys from ymm3/m256; store the 
result in ymm1. 

EVEX.128.66.0F38.WIG DD /r C VIN VAES Perform the last round of an AES encryption flow, 

VAESENCLAST xmm1, xmm2, xmm3/m1 28 AVX512VL | using one 128-bit data (state) from xmm2 with one 
128-bit round key from xmm3/m1 28; store the result 
inxmm1. 

EVEX.256.66.0F38.WIG DD /r C VV VAES Perform the last round of an AES encryption flow, 

VAESENCLAST ymm1, ymm2, ymm3/m256 AVX512VL | using two 128-bit data (state) from ymm2 with two 
128-bit round keys from ymm3/m256; store the 
result in ymm1. 

EVEX.512.66.0F38.WIG DD /r C VV VAES Perform the last round of an AES encryption flow, 

VAESENCLAST zmm1, zmm2, zmm3/m512 AVX512F | using four 128-bit data (state) from zmm2 with four 
128-bit round keys from zmm3/m51 2; store the 
result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand2 Operand3 Operand4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs the last round of an AES encryption flow using one/two/four (depending on vector length) 
128-bit data (state) from the first source operand with one/two/four (depending on vector length) round key(s) 
from the second source operand, and stores the result in the destination operand. 


VEX and EVEX encoded versions of the instruction allows 3-operand (non-destructive) operation. The legacy 
encoded versions of the instruction require that the first source operand and the destination operand are the same 


and must be an XMM register. 


The EVEX encoded form of this instruction does not support memory fault suppression. 
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AESENCLAST—Perform Last Round of an AES Encryption Flow 


Operation 


AESENCLAST 

STATE := SRC1; 

RoundKey := SRC2; 

STATE := ShiftRows( STATE ); 

STATE := SubBytes( STATE ); 
DEST[127:0] := STATE XOR RoundKey; 
DEST[MAXVL-1:128] (Unmodified) 


VAESENCLAST (128b and 256b VEX encoded versions) 
(KL, VL) = (1,128), (2,256) 
FOR I=0 to KL-1: 

STATE := SRC1.xmm[i] 

RoundKey := SRC2.xmm[i] 

STATE := ShiftRows( STATE ) 

STATE := SubBytes( STATE ) 

DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


VAESENCLAST (EVEX encoded version) 
(KL,VL) = (1,128), (2,256), (4,512) 
FOR i = 0 to KL-1: 
STATE := SRC1.xmm[i] 
RoundKey := SRC2.xmm[i] 
STATE := ShiftRows( STATE ) 
STATE := SubBytes( STATE ) 
DEST.xmm[i] := STATE XOR RoundKey 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)AESENCLAST __m128i_mm_aesenclast (__m128i,__m128i) 
VAESENCLAST m256i__mm256_aesenclast_epil 28(__m256i, 


m256i); 


VAESENCLAST m512i_mm512_aesenclast_epi128(__m512i, 


m512i); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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AESENCWIDE1 28KL—Perform Ten Rounds of AES Encryption Flow with Key Locker on 8 Blocks 
Using 128-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Feature Description 

Instruction En |Mode Flag 

F3 OF 38 D8 \(11):000:bbb A VN AESKLE WIDE_KL | Encrypt XMMO-7 using 128-bit AES key indicated 

AESENCWIDE128KL m384, <XMMO-7> by handle at m384 and store each resultant block 
back to its corresponding register. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operands 2 - 9 
A NA ModRM:r/m (r) Implicit XMMO-7 (r, w) 
Description 


The AESENCWIDE128KL! instruction performs ten rounds of AES to encrypt each of the eight blocks in XMMO-7 
using the 128-bit key indicated by the handle from the second operand. It replaces each input block in XMMO-7 with 
its corresponding encrypted block if the operation succeeds (e.g., does not run into a handle violation failure). 


Operation 


AESENCWIDE128KL 
Handle := UnalignedLoad of 384 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = ( 
HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [1] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES128 
); 
IF (Illegal Handle 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate384 (Handle[383:0], IwKey); 
IF Authentic == 
THEN RFLAGS.ZF := 1; 
ELSE 
XMMO := AES128Encrypt (XMMO, UnwrappedKey) ; 
XMM1 := AES128Encrypt (XMM1, UnwrappedKey 
XMM2 := AES128Encrypt 
XMM3 := AES128Encrypt 
XMM4 := AES128Encrypt 
XMM5 := AES128Encrypt 
XMM6 := AES128Encrypt 
XMM7 := AES128Encrypt 
RFLAGS.ZF := 0; 


); 
XMM2, UnwrappedKey) ; 
XMM3, UnwrappedKey) ; 
XMM4, UnwrappedKey) ; 
XMM5, UnwrappedKey) ; 
XMM6, UnwrappedKey) 
) 


XMM7, UnwrappedKey 


, 


, 


gin, gti phan. jambs glean, gua: 


, 


Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESENCWIDE1 28KL unsigned char __mm_aesencwide1 28kl_u8(__m128i odata[8], const __m128i idata[8], const void* h); 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.AESKLE = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
If CPUID.19H:EBX.WIDE_KL [bit 2] = 0. 


#NM If CRO.TS = 1. 

#PF If a page fault occurs. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 


If a memory address referencing the SS segment is in a non-canonical form. 
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AESENCWIDE256KL—Perform 14 Rounds of AES Encryption Flow with Key Locker on 8 Blocks 
Using 256-Bit Key 


Opcode/ Op/ | 64/32-bit | CPUID Feature Description 

Instruction En |Mode Flag 

F3 OF 38 D8 \(11):010:bbb A VN AESKLE WIDE_KL | Encrypt XMMO-7 using 256-bit AES key indicated 

AESENCWIDE256KL m512, <XMMO-7> by handle at m512 and store each resultant block 
back to its corresponding register. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operands 2 - 9 
A NA ModRM:r/m (r) Implicit XMMO-7 (r, w) 
Description 


The AESENCWIDE256KL! instruction performs 14 rounds of AES to encrypt each of the eight blocks in XMMO-7 
using the 256-bit key indicated by the handle from the second operand. It replaces each input block in XMMO-7 with 
its corresponding encrypted block if the operation succeeds (e.g., does not run into a handle violation failure). 


Operation 


AESENCWIDE256KL 
Handle := UnalignedLoad of 512 bit (SRC); // Load is not guaranteed to be atomic. 
Illegal Handle = ( 
HandleReservedBitSet (Handle) || 
(Handle[0] AND (CPL > 0)) || 
Handle [1] || 
HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES256 
); 
IF (Illegal Handle 
THEN RFLAGS.ZF := 1; 
ELSE 
(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate5 12 (Handle[51 1:0], lwKey); 
IF (Authentic == 0) 
THEN RFLAGS.ZF := 1; 
ELSE 
XMMO := AES256Encrypt 
XMM1 := AES256Encrypt 
XMM2 := AES256Encrypt 
XMM3 := AES256Encrypt 
XMM4 := AES256Encrypt 
XMM5 := AES256Encrypt 
XMM6 := AES256Encrypt 
XMM7 := AES256Encrypt 
RFLAGS.ZF := 0; 


, 


XMMO, UnwrappedKey) 
XMM1, UnwrappedKey) 
XMM2, UnwrappedKey) 
XMM3, UnwrappedKey) ; 
XMM4, UnwrappedKey) ; 
) 
) 
) 


, 


, 


XMM5, UnwrappedKey 
XMM6, UnwrappedKey 
XMM7, UnwrappedKey 


, 


, 


gina, gman: gpa gata ima: pata min. gimme 


, 


Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other 
arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


AESENCWIDE256KL unsigned char __mm_aesencwide256kl_u8(__m128i odata[8], const __m128i idata[8], const void* h); 


Exceptions (All Operating Modes) 


#UD If the LOCK prefix is used. 
If CPUID.07H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 


If CR4.OSFXSR = 0. 
If CPUID.19H:EBX.WIDE_KL [bit 2] = 0. 


#NM If CRO.TS = 1. 

#PF If a page fault occurs. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

If the memory address is in a non-canonical form. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 


If a memory address referencing the SS segment is in a non-canonical form. 
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AESIMC—Perform the AES InvMixColumn Transformation 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 38 DB /r RM |V/V AES Perform the InvMixColumn transformation on 
AESIMC xmm1, xmm2/m128 a 128-bit round key from xmm2/m128 and 
store the result in xmm1. 
VEX.128.66.0F38.WIG DB /r RM |V/V Both AES | Perform the InvMixColumn transformation on 
VAESIMC xmm1, xmm2/m128 and a 128-bit round key from xmm2/m128 and 
AVX flags | store the result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand2 Operand3 Operand4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Perform the InvMixColumns transformation on the source operand and store the result in the destination operand. 
The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca- 


tion. 


Note: the AESIMC instruction should be applied to the expanded AES round keys (except for the first and last round 
key) in order to prepare them for decryption using the “Equivalent Inverse Cipher” (defined in FIPS 197). 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain unchanged. 
VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 

AESIMC 

DEST[1 27:0] := InvMixColumns( SRC ); 
DEST[MAXVL-1:128] (Unmodified) 


VAESIMC 
DEST[1 27:0] := InvMixColumns( SRC ); 
DEST[MAXVL-1:128] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)AESIMC: m128i __mm_aesimc (__m128i) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv # 1111B. 
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INSTRUCTION SET REFERENCE, A-L 


Opcode/ Op/ |64/32-bit |CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 3A DF /r ib RMI | V/V AES Assist in AES round key generation using an 8 
AESKEYGENASSIST xmm1, xmm2/m1 28, imm8 bits Round Constant (RCON) specified in the 
immediate byte, operating on 128 bits of data 
specified in xmm2/m1 28 and stores the 
result in xmm1. 
VEX.128.66.0F3A.WIG DF /r ib RMI | V/V Both AES | Assist in AES round key generation using 8 
VAESKEYGENASSIST xmm1, xmm2/m1 28, imm8 and bits Round Constant (RCON) specified in the 
AVX flags | immediate byte, operating on 128 bits of data 


specified in xmm2/m1 28 and stores the 
result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand2 Operand3 Operand4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
Description 


Assist in expanding the AES cipher key, by computing steps towards generating a round key for encryption, using 
128-bit data specified in the source operand and an 8-bit round constant specified as an immediate, store the 


result in the destination operand. 


The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca- 


tion. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain 


unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


AESKEYGENASSIST 

X3[31:0] := SRC [127: 96]; 

X2[31:0] := SRC [95: 64]; 

X1[31:0] := SRC [63: 32]; 

X0[31:0] := SRC [31: 0}; 

RCON[31:0] := ZeroExtend(Imm8[7:0)); 

DEST[31:0] := SubWord(X1); 

DEST[63:32 ] := Rotword( SubWord(X1) ) XOR RCON; 
DEST[95:64] := SubWord(X3); 

DEST[127:96] := Rotword( SubWord(X3) ) XOR RCON; 
DEST[MAXVL-1:128] (Unmodified) 
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VAESKEYGENASSIST 

X3[31:0] := SRC [127: 96]; 

X2[31:0] := SRC [95: 64]; 

X1[31:0] := SRC [63: 32]; 

X0[31:0] := SRC [31: 0}; 

RCON[31:0] := ZeroExtend(Imm8[7:0)); 

DEST[31:0] := SubWord(X1); 

DEST[63:32 ] := RotWord( SubWord(X1) ) XOR RCON; 
DEST[95:64] := SubWord(X3); 

DEST[127:96] := Rotword( SubWord(X3) ) XOR RCON; 
DEST[MAXVL-1:1 28] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)AESKEYGENASSIST: __m128i __mm_aeskeygenassist (__m128i, const int) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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AESKEYGENASSIST—AES Round Key Generation Assist 


INSTRUCTION SET REFERENCE, A-L 


AND—Logical AND 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
24 ib AND AL, imm8 | Valid Valid AL AND imme. 
25 iw AND AX, imm16 | Valid Valid AX AND imm16. 
25 id AND EAX, imm32 | Valid Valid EAX AND imm32. 
REX.W + 25 id AND RAX, imm32 | Valid N.E. RAX AND imm32 sign-extended to 64-bits. 
80 /4 ib AND r/m8, imm8 MI | Valid Valid r/m8 AND immé. 
REX + 80 /4 ib AND r/m8 , imm8 MI | Valid N.E. r/m8 AND immé. 
81 /4 iw AND r/m16, imm16 MI | Valid Valid r/m16 AND imm16. 
81 /4 id AND r/m32, imm32 MI | Valid Valid r/m32 AND imm32. 
REX.W + 81 /4 id AND r/m64, imm32 MI Valid N.E. r/m64 AND imm32 sign extended to 64-bits. 
83 /4 ib AND r/m16, imm8 MI | Valid Valid r/m16 AND imm8 (sign-extended). 
83 /4 ib AND r/m32, imm8 MI | Valid Valid r/m32 AND imm8 (sign-extended). 
REX.W + 83 /4 ib AND r/m64, imm8 MI | Valid N.E. r/m64 AND imm8 (sign-extended). 
20 /r AND r/m8, r8 MR | Valid Valid r/m8 AND r8. 
REX + 20 /r AND r/m8 , r8 MR_ | Valid N.E. r/m64 AND r8 (sign-extended). 
21 /r AND r/m16, r16 MR | Valid Valid r/m16 AND r76. 
21/r AND r/m32, r32 MR | Valid Valid r/m32 AND r32. 
REX.W + 21 /r AND r/m64, r64 MR | Valid N.E. r/m64 AND r32. 
22 /r AND r8, r/m8 RM _ | Valid Valid r8 AND r/m8. 
REX + 22 /r AND r8, r/m8 RM _ | Valid N.E. r/m64 AND r8 (sign-extended). 
23/r AND r16, r/m16 RM _ | Valid Valid r16 AND r/m16. 
23 /r AND r32, r/m32 RM _ | Valid Valid r32 AND r/m32. 
REX.W + 23 /r AND r64, r/m64 RM _ | Valid N.E. r64 AND r/m64. 
NOTES: 


*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
Description 


Performs a bitwise AND operation on the destination (first) and source (Second) operands and stores the result in 
the destination operand location. The source operand can be an immediate, a register, or a memory location; the 
destination operand can be a register or a memory location. (However, two memory operands cannot be used in 
one instruction.) Each bit of the result is set to 1 if both corresponding bits of the first and second operands are 1; 
otherwise, it is set to 0. 


This instruction can be used with a LOCK prefix to allow the it to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 
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Operation 


DEST := DEST AND SRC; 


Flags Affected 


The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is 
undefined. 


Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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ANDN — Logical AND NOT 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode Flag 
VEX.LZ.0F38.W0 Fe /r RVM | V/V BMI1 Bitwise AND of inverted r32b with r/m32, store result in r32a. 
ANDN r32a, r32b, r/m32 
VEX.LZ. OF38.W1 Fe /r RVM | V/NE BMI1 Bitwise AND of inverted r64b with r/m64, store result in r64a. 
ANDN r64a, r64b, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical AND of inverted second operand (the first source operand) with the third operand (the 
second source operand). The result is stored in the first operand (destination operand). 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An 
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 


DEST := (NOT SRC1) bitwiseAND SRC2; 
SF := DEST[OperandSize -1]; 
ZF := (DEST = 0); 


Flags Affected 
SF and ZF are updated based on result. OF and CF flags are cleared. AF and PF flags are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
Auto-generated from high-level language. 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 


ANDN — Logical AND NOT Vol.2A 3-79 


INSTRUCTION SET REFERENCE, A-L 


ANDPD-—Bitwise Logical AND of Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 


66 OF 54 /r A VIV SSE2 Return the bitwise logical AND of packed double- 
ANDPD xmm1, xmm2/m128 precision floating-point values in xmm1 and xmm2/mem. 
VEX.128.66.0F 54 /r B VIV AVX Return the bitwise logical AND of packed double- 
VANDPD xmm1, xmm2, precision floating-point values in xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.66.0F 54 /r B VIV AVX Return the bitwise logical AND of packed double- 
VANDPD ymm1, ymm2, precision floating-point values in ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.66.0F.W1 54 /r C VIV AVX512VL | Return the bitwise logical AND of packed double- 
VANDPD xmm1 {k1}{z}, xmm2, AVX512DQ | precision floating-point values in xmm2 and 
xmm3/m1 28/m64bcst xmm3/m128/m64bcst subject to writemask k1. 
EVEX.256.66.0F.W1 54 /r C VIV AVX512VL | Return the bitwise logical AND of packed double- 
VANDPD ymm1 {k1}{z}, ymm2, AVX512DQ | precision floating-point values in ymm2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst subject to writemask k1. 
EVEX.512.66.0F.W1 54 /r C VIN AVX512DQ | Return the bitwise logical AND of packed double- 
VANDPD zmm1 {k1}{z}, zmm2, precision floating-point values in zmm2 and 
zmm3/m512/m64bcst zmm3/m512/m64bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a bitwise logical AND of the two, four or eight packed double-precision floating-point values from the first 
source operand and the second source operand, and stores the result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 

VANDPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[63:0] 
ELSE 
DEST[i+63:i] = SRC1[i+63:i] BITWISE AND SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] = 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VANDPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64] 
DEST[191:128] := SRC1[191:128] BITWISE AND SRC2[191:128] 
DEST[255:192] := SRC1[255:192] BITWISE AND SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VANDPD (VEX.128 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


ANDPD (128-bit Legacy SSE version) 

DEST[63:0] := DEST[63:0] BITWISE AND SRC[63:0] 
DEST[127:64] := DEST[127:64] BITWISE AND SRC[127:64] 
DEST[MAXVL-1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
VANDPD __m512d_mm512_and_pd (__m512da,__m512d b); 


VANDPD __m512d_mm512_mask_and_pd (__m512ds,__mmask8 k,__m512da, 
VANDPD __m512d_mm512_maskz_and_pd (__mmask8 k,__m512d a,_m512d b); 
VANDPD __m256d_mm256_mask_and_pd (__m256ds,__ mmask8 k,__ m256d a, 
VANDPD __m256d__mm256_maskz_and_pd (__mmask8 k,___ m256d a, __m256d b); 


VANDPD __m128d_mm_mask_and_pd (__m128ds,___mmask8 k,___m128d a, 


VANDPD __m128d _mm_maskz_and_pd (__mmask8 k,___m128d a,__m128d b); 


VANDPD __m256d __mm256_and_pd (__m256d a, __m256d b); 
ANDPD __m128d _mm_and_pd (__m128d a,__m128d b); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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ANDPS—Bitwise Logical AND of Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF 54 /r A VIV SSE Return the bitwise logical AND of packed single-precision 
ANDPS xmm1, xmm2/m128 floating-point values in xmm1 and xmm2/mem. 
VEX.128.0F 54 /r B VIV AVX Return the bitwise logical AND of packed single-precision 
VANDPS xmm1,xmm_2, floating-point values in xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.0F 54 /r B VIV AVX Return the bitwise logical AND of packed single-precision 
VANDPS ymm1, ymm2, floating-point values in ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.0F.WO 54 /r C VV AVX512VL_ | Return the bitwise logical AND of packed single-precision 
VANDPS xmm1 {k1}{z}, xmm2, AVX512DQ_ | floating-point values in xmm2 and xmm3/m128/m32bcst 
xmm3/m128/m32bcst subject to writemask k1. 
EVEX.256.0F.WO 54 /r C VV AVX512VL_ | Return the bitwise logical AND of packed single-precision 
VANDPS ymm1 {k1}{z}, ymm2, AVX512DQ_ | floating-point values in ymm2 and ymm3/m256/m32bcst 
ymm3/m256/m32bcst subject to writemask k1. 
EVEX.512.0F.W0 54 /r C VIN AVX512DQ | Return the bitwise logical AND of packed single-precision 
VANDPS zmm1 {k1}{z}, zmm2, floating-point values in zmm2 and zmm3/m512/m32bcst 
zmm3/m512/m32bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a bitwise logical AND of the four, eight or sixteen packed single-precision floating-point values from the 
first source operand and the second source operand, and stores the result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VANDPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN 


DEST[i+63:i] := SRC1[i+31:i] BITWISE AND SRC2[31:0] 


ELSE 


DEST[i+31:i] = SRC1[i+31:i] BITWISE AND SRC2[i+31:i] 


Fl; 
ELSE 
IF *merging-masking* 
THEN *DEST[i+31:i] remains unchanged* 
ELSE 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0; 


VANDPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96] 
DEST[159:128] := SRC1[159:128] BITWISE AND SRC2[159:1 28] 
DEST[191:160] := SRC1[191:160] BITWISE AND SRC2[191:160] 
DEST[223:192] := SRC1[223:192] BITWISE AND SRC2[223:192] 


DEST[255:224] := SRC1[255:224] BITWISE AND SRC2[255:224]. 


DEST[MAXVL-1:256] := 0; 


VANDPS (VEX.128 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96] 
DEST[MAXVL-1:128] := 0; 


ANDPS (128-bit Legacy SSE version) 

DEST[31:0] := DEST[31:0] BITWISE AND SRC[31:0] 
DEST[63:32] := DEST[63:32] BITWISE AND SRC[63:32] 
DEST[95:64] := DEST[95:64] BITWISE AND SRC[95:64] 
DEST[127:96] := DEST[127:96] BITWISE AND SRC[127:96] 
DEST[MAXVL-1:128] (Unmodified) 
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; zeroing-masking 
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Intel C/C++ Compiler Intrinsic Equivalent 


VANDPS __m512_mm512_and_ps (__m512 a,__m512 b); 

VANDPS __m512_mm512_mask_and_ps (_m512s,__mmask16k,__m512 a, 
VANDPS __m512_mm512_maskz_and_ps (__mmask16 k,__m512 a,__m512 b); 
VANDPS __m256 __mm256_mask_and_ps (_m256s,__ mmask8k,__ m256 a,___m256 b); 
VANDPS __m256 _mm256_maskz_and_ps (__mmask8 k,__ m256 a,__ m256 b); 

VANDPS __m128 _mm_mask_and_ps (_m128s,__mmask8k,__m128 a,__m128b); 
VANDPS __m128 __mm_maskz_and_ps (__mmask8 k,__m128a,__m128 b); 

VANDPS __m256 __mm256_and_ps (__m256 a,___m256 b); 

ANDPS __m128_mm_and_ps (_m128a,__m128 b); 


m512 b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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ANDNPD-—Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
66 OF 55 /r A VIV SSE2 Return the bitwise logical AND NOT of packed double- 
ANDNPD xmm1, xmm2/m128 precision floating-point values in xmm1 and xmm2/mem. 
VEX.128.66.0F 55 /r B VV AVX Return the bitwise logical AND NOT of packed double- 
VANDNPD xmm1, xmm2, precision floating-point values in xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.66.0F 55/r B VIV AVX Return the bitwise logical AND NOT of packed double- 
VANDNPD ymm1, ymm2, precision floating-point values in ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.66.0F.W1 55 /r C VV AVX512VL | Return the bitwise logical AND NOT of packed double- 
VANDNPD xmm1 {k1}{z}, xmm2, AVX512DQ | precision floating-point values in xmm2 and 
xmm3/m1 28/m64bcst xmm3/m128/m64bcst subject to writemask k1. 
EVEX.256.66.0F.W1 55 /r C VV AVX512VL | Return the bitwise logical AND NOT of packed double- 
VANDNPD ymm1 {k1}{z}, ymm2, AVX512DQ | precision floating-point values in ymm2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst subject to writemask k1. 
EVEX.512.66.0F.W1 55 /r C VV AVX512DQ_ | Return the bitwise logical AND NOT of packed double- 
VANDNPD zmm1 {k1}{z}, zmm2, precision floating-point values in zmm2 and 
zmm3/m512/m64bcst zmm3/m512/m64bcst subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical AND NOT of the two, four or eight packed double-precision floating-point values from the 
first source operand and the second source operand, and stores the result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VANDNPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 


THEN 
DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[63:0] 
ELSE 
DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] = 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VANDNPD (VEX.256 encoded version) 

DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0] 
DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64] 
DEST[191:128] := (NOT(SRC1[191:128])) BITWISE AND SRC2[191:128] 
DEST[255:192] := (NOT(SRC1[255:192])) BITWISE AND SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VANDNPD (VEX.128 encoded version) 

DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0] 
DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


ANDNPD (128-bit Legacy SSE version) 

DEST[63:0] := (NOT(DEST[63:0])) BITWISE AND SRC[63:0] 
DEST[127:64] := (NOT(DEST[127:64])) BITWISE AND SRC[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VANDNPD __m512d_mm512_andnot_pd (__m512da,__m512d b); 

VANDNPD __m512d_mm512_mask_andnot_pd (__m512ds,__ mmask8k,__m512da,__m512db); 
VANDNPD __m512d_mm512_maskz_andnot_pd (__mmask8 k,__m512d a,__m512d b); 
VANDNPD __m256d __mm256_mask_andnot_pd (__m256ds,__ mmask8 k,___ m256d a,__ m256d b); 
VANDNPD __m256d __mm256_maskz_andnot_pd (__mmask8 k,___ m256d a, __m256d b); 
VANDNPD __m128d _mm_mask_andnot_pd (__m128ds,__ mmask8 k,__m128d a,__m128d b); 
VANDNPD __m128d _mm_maskz_andnot_pd (__mmask8 k,___m128d a,__m128d b); 

VANDNPD __m256d_mm256_andnot_pd (__m256d a, ___ m256d b); 

ANDNPD __m128d_mm_andnot_pd (__m128d a, __m128d b); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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ANDNPS—Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF 55 /r A VIV SSE Return the bitwise logical AND NOT of packed single-precision 
ANDNPS xmm1, xmm2/m1 28 floating-point values in xmm1 and xmm2/mem. 
VEX.128.0F 55 /r B VIV AVX Return the bitwise logical AND NOT of packed single-precision 
VANDNPS xmm1, xmm2, floating-point values in xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.0F 55 /r B VIV AVX Return the bitwise logical AND NOT of packed single-precision 
VANDNPS ymm1, ymm2, floating-point values in ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.0F.WO 55 /r C VIV AVX512VL | Return the bitwise logical AND of packed single-precision 


VANDNPS xmm1 {k1}{z}, AVX512DQ 


xmm_2, xmm3/m128/m32bcst 


floating-point values in xmm2 and xmm3/m128/m32bcst 
subject to writemask k1. 


EVEX.256.0F.WO 55 /r C VIV AVX512VL_ | Return the bitwise logical AND of packed single-precision 
VANDNPS ymm1 {k1}{2}, AVX512DQ | floating-point values in ymm2 and ymm3/m256/m32bcst 
ymm_2, ymm3/m256/m32bcst subject to writemask k1. 

EVEX.512.0F.W0 55 /r C VIN AVX512DQ | Return the bitwise logical AND of packed single-precision 


VANDNPS zmm1 {k1}{2}, 
zmmc2, zmm3/m512/m32bcst 


floating-point values in zmm2 and zmm3/m512/m32bcst 
subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical AND NOT of the four, eight or sixteen packed single-precision floating-point values from 
the first source operand and the second source operand, and stores the result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VANDNPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+31:i] = (NOT(SRC1[i+31:i])) BITWISE AND SRC2[31:0] 
ELSE 
DEST[i+31:i] = (NOT(SRC1[i+31:i])) BITWISE AND SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] = 0 
Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VANDNPS (VEX.256 encoded version) 

DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0] 
DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32] 
DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64] 
DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96] 
DEST[159:128] := (NOT(SRC1[159:128])) BITWISE AND SRC2[159:128] 
DEST[191:160] := (NOT(SRC1[191:160])) BITWISE AND SRC2[191:160] 
DEST[223:192] := (NOT(SRC1[223:192])) BITWISE AND SRC2[223:192] 
DEST[255:224] := (NOT(SRC1[255:224])) BITWISE AND SRC2[255:224]. 
DEST[MAXVL-1:256] := 0 


VANDNPS (VEX.128 encoded version) 

DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0] 
DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32] 
DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64] 
DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


ANDNPS (128-bit Legacy SSE version) 

DEST[31:0] := (NOT(DEST[31:0])) BITWISE AND SRC[31:0] 
DEST[63:32] := (NOT(DEST[63:32])) BITWISE AND SRC[63:32] 
DEST[95:64] := (NOT(DEST[95:64])) BITWISE AND SRC[95:64] 
DEST[127:96] := (NOT(DEST[127:96])) BITWISE AND SRC[127:96] 
DEST[MAXVL-1:128] (Unmodified) 
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VANDNPS __m512_mm512_andnot_ps (__m512 a,__m512 b); 

VANDNPS __m512_mm512_mask_andnot_ps (_m512s,__mmask16 k,__m512 a, 
VANDNPS __m512 _mm512_maskz_andnot_ps (_mmask16 k,__m512 a,__m512 b); 
VANDNPS __m256 _mm256_mask_andnot_ps (__m256 s,__ mmask8 k,__ m256 a,__m256 b); 
VANDNPS __m256 _mm256_maskz_andnot_ps (__mmask8 k,__m256 a, __m256 b); 
VANDNPS __m128 _mm_mask_andnot_ps (__m128s,__mmask8 k,__m128 a,__m128 b); 
VANDNPS __m128 _mm_maskz_andnot_ps (__mmask8 k,__m128 a,__m128 b); 

VANDNPS __m256 _mm256_andnot_ps (__m256 a, ___m256 b); 

ANDNPS __m128_mm_andnot_ps (__m128 a,__m128b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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ARPL—Adjust RPL Field of Segment Selector 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
63 /r ARPL r/m16, r16 MR |N.E. Valid Adjust RPL of r/m76 to not less than RPL of 
r76. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Compares the RPL fields of two segment selectors. The first operand (the destination operand) contains one 
segment selector and the second operand (source operand) contains the other. (The RPL field is located in bits 0 
and 1 of each operand.) If the RPL field of the destination operand is less than the RPL field of the source operand, 
the ZF flag is set and the RPL field of the destination operand is increased to match that of the source operand. 
Otherwise, the ZF flag is cleared and no change is made to the destination operand. (The destination operand can 
be a word register or a memory location; the source operand must be a word register.) 


The ARPL instruction is provided for use by operating-system procedures (however, it can also be used by applica- 
tions). It is generally used to adjust the RPL of a segment selector that has been passed to the operating system by 
an application program to match the privilege level of the application program. Here the segment selector passed 
to the operating system is placed in the destination operand and segment selector for the application program’s 
code segment is placed in the source operand. (The RPL field in the source operand represents the privilege level 
of the application program.) Execution of the ARPL instruction then ensures that the RPL of the segment selector 
received by the operating system is no lower (does not have a higher privilege) than the privilege level of the appli- 
cation program (the segment selector for the application program’s code segment can be read from the stack 
following a procedure call). 


This instruction executes as described in compatibility mode and legacy mode. It is not encodable in 64-bit mode. 


See “Checking Caller Access Privileges” in Chapter 3, “Protected-Mode Memory Management,” of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information about the use of this instruc- 
tion. 


Operation 
IF 64-BIT MODE 
THEN 
See MOVSXD; 
ELSE 
IF DEST[RPL] < SRC[RPL] 
THEN 
ZF := 1; 
DEST[RPL] := SRC[RPL]; 
ELSE 
ZF := 0; 
Fl; 
Fl; 
Flags Affected 


The ZF flag is set to 1 if the RPL field of the destination operand is less than that of the source operand; otherwise, 
it is set to O. 
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Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The ARPL instruction is not recognized in real-address mode. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#UD The ARPL instruction is not recognized in virtual-8086 mode. 
If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Not applicable. 
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BEXTR — Bit Field Extract 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode | Flag 
VEX.LZ.0F38.W0 F7 /r RMV | V/V BMI1 Contiguous bitwise extract from r/m32 using r32b as control; store 
BEXTR 32a, r/m32, r32b result in r32a. 
VEX.LZ.0F38.W1 F7 /r RMV | V/N.E. | BMI1 Contiguous bitwise extract from r/m64 using r64b as control; store 
BEXTR r64a, r/m64, r64b result in r64a 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMV ModRM:reg (w) ModRM:r/m (r) VEX.vvvv (r) NA 
Description 


Extracts contiguous bits from the first source operand (the second operand) using an index value and length value 
specified in the second source operand (the third operand). Bit 7:0 of the second source operand specifies the 
starting bit position of bit extraction. A START value exceeding the operand size will not extract any bits from the 
second source operand. Bit 15:8 of the second source operand specifies the maximum number of bits (LENGTH) 
beginning at the START position to extract. Only bit positions up to (OperandSize -1) of the first source operand are 
extracted. The extracted bits are written to the destination register, starting from the least significant bit. All higher 
order bits in the destination operand (starting at bit position LENGTH) are zeroed. The destination register is 
cleared if no bits are extracted. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 

START := SRC2[7:0]; 

LEN := SRC2[15:8]; 

TEMP := ZERO_EXTEND_TO_512 (SRC1 ); 

DEST := ZERO_EXTEND(TEMP[START+LEN -1: START]); 
ZF := (DEST = 0); 


Flags Affected 
ZF is updated based on the result. AF, SF, and PF are undefined. All other flags are cleared. 


Intel C/C++ Compiler Intrinsic Equivalent 
BEXTR: unsigned __int32 _bextr_u32(unsigned __int32 src, unsigned __int32 start. unsigned __int32 len); 


BEXTR: unsigned __int64 _bextr_u64(unsigned __int64 src, unsigned __int32 start. unsigned __int32 len); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”; additionally: 
#UD If VEX.W = 1. 
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BLENDPD — Blend Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 3A OD /r ib RMI | V/V SSE4_1 Select packed DP-FP values from xmm17 and 
BLENDPD xmm1, xmm2/m128, imm8 xmm2/m128 from mask specified in imm8 
and store the values into xmm1. 
VEX.128.66.0F3A.WIG OD /r ib RVMI | V/V AVX Select packed double-precision floating-point 
VBLENDPD xmm1, xmm2, xmm3/m128, imm8 Values from xmme2 and xmm3/m128 from 
mask in imm8 and store the values in xmm1. 
VEX.256.66.0F3A.WIG OD /r ib RVMI | V/V AVX Select packed double-precision floating-point 
VBLENDPD ymm1, ymm2, ymm3/m256, imm8 Values from ymm2 and ymm3/m256 from 
mask in imm8 and store the values in ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8s NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8[3:0] 
Description 


Double-precision floating-point values from the second source operand (third operand) are conditionally merged 
with values from the first source operand (second operand) and written to the destination operand (first operand). 
The immediate bits [3:0] determine whether the corresponding double-precision floating-point value in the desti- 
nation is copied from the second source or first source. If a bit in the mask, corresponding to a word, is "1", then 
the double-precision floating-point value in the second source operand is copied, else the value in the first source 
operand is copied. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding YMM register destination are zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Operation 
BLENDPD (128-bit Legacy SSE version) 
IF (IMM8[0] = 0)THEN DEST[63:0] := DEST[63:0] 
ELSE DEST [63:0] := SRC[63:0] FI 
IF (IMM8[1] = 0) THEN DEST[127:64] := DEST[127:64] 
ELSE DEST [127:64] := SRC[127:64] Fl 
DEST[MAXVL-1:1 28] (Unmodified) 


VBLENDPD (VEX.128 encoded version) 
IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST [63:0] := SRC2[63:0] FI 
IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64] 
ELSE DEST [127:64] := SRC2[127:64] FI 
DEST[MAXVL-1:128] := 0 
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VBLENDPD (VEX.256 encoded version) 

IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST [63:0] := SRC2[63:0] FI 

IF (IMM8[1] = 0) THEN DEST[1 27:64] := SRC1[127:64] 
ELSE DEST [127:64] := SRC2[127:64] Fl 

IF (IMM8[2] = 0) THEN DEST[191:1 28] := SRC1[191:128] 
ELSE DEST [191:128] := SRC2[191:128] Fl 

IF (IMM8[3] = 0) THEN DEST[255:192] := SRC1[255:192] 
ELSE DEST [255:192] := SRC2[255:192] Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


BLENDPD: m128d _mm_blend_pd (__m128d v1,__m128d v2, const int mask); 


VBLENDPD: m256d __mm256_blend_pd (__m256d a, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”. 
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BLENDPS — Blend Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En | Mode Feature 
Flag 
66 OF 3A OC /r ib RMI | V/V SSE4_1 Select packed single precision floating-point 
BLENDPS xmm1, xmm2/m128, imm8 values from xmm7 and xmm2/m128 from 
mask specified in imm8 and store the values 
into xmm1. 
VEX.128.66.0F3A.WIG OC /r ib RVMI | V/V AVX Select packed single-precision floating-point 
VBLENDPS xmm1, xmm2, xmm3/m128, imm8 values from xmm2 and xmm3/m128 from 
mask in imm8 and store the values in xmm1. 
VEX.256.66.0F3A.WIG OC /r ib RVMI | V/V AVX Select packed single-precision floating-point 
VBLENDPS ymm1, ymm2, ymm3/m256, imm8 values from ymm2 and ymm3/m256 from 
mask in imm8 and store the values in ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


Packed single-precision floating-point values from the second source operand (third operand) are conditionally 
merged with values from the first source operand (second operand) and written to the destination operand (first 
operand). The immediate bits [7:0] determine whether the corresponding single precision floating-point value in 
the destination is copied from the second source or first source. If a bit in the mask, corresponding to a word, is 
“1”, then the single-precision floating-point value in the second source operand is copied, else the value in the first 
source operand is copied. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: The first source operand an XMM register. The second source operand is an XMM register 
or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of the 
corresponding YMM register destination are zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Operation 

BLENDPS (128-bit Legacy SSE version) 

IF (IMM8[0] = 0) THEN DEST[31:0] :=DEST[31:0] 
ELSE DEST [31:0] := SRC[31:0] Fl 

IF (IMM8[1] = 0) THEN DEST[63:32] := DEST[63:32] 
ELSE DEST [63:32] := SRC[63:32] Fl 

IF (IMM8[2] = 0) THEN DEST[95:64] := DEST[95:64] 
ELSE DEST [95:64] := SRC[95:64] FI 

IF (IMM8[3] = 0) THEN DEST[127:96] := DEST[127:96] 
ELSE DEST [127:96] := SRC[127:96] Fl 

DEST[MAXVL-1:1 28] (Unmodified) 
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VBLENDPS (VEX.128 encoded version) 

IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0] 
ELSE DEST [31:0] := SRC2[31:0] Fl 

IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32] 
ELSE DEST [63:32] := SRC2[63:32] Fl 

IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64] 
ELSE DEST [95:64] := SRC2[95:64] FI 

IF (IMM8[3] = 0) THEN DEST[1 27:96] := SRC1[127:96] 
ELSE DEST [127:96] := SRC2[127:96] Fl 

DEST[MAXVL-1:128] := 0 


VBLENDPS (VEX.256 encoded version) 

IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0] 
ELSE DEST [31:0] := SRC2[31:0] Fl 

IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32] 
ELSE DEST [63:32] := SRC2[63:32] Fl 

IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64] 
ELSE DEST [95:64] := SRC2[95:64] FI 

IF (IMM8[3] = 0) THEN DEST[127:96] := SRC1[127:96] 
ELSE DEST [127:96] := SRC2[127:96] FI 

IF (IMM8[4] = 0) THEN DEST[159:1 28] := SRC1[159:128] 
ELSE DEST [159:128] := SRC2[159:1 28] Fl 

IF (IMM8[5] = 0) THEN DEST[191:160] := SRC1[191:160] 
ELSE DEST [191:160] := SRC2[191:160] FI 

IF (IMM8[6] = 0) THEN DEST[223:1 92] := SRC1[223:192] 
ELSE DEST [223:192] := SRC2[223:192] Fl 

IF (IMM8[7] = 0) THEN DEST[255:224] := SRC1[255:224] 
ELSE DEST [255:224] := SRC2[255:224] Fl. 


Intel C/C++ Compiler Intrinsic Equivalent 


BLENDPS: m128 _mm_blend_ps (__m128 v1,_m128 v2, const int mask); 


VBLENDPS: m256 __mm256_blend_ps (__m256 a,__m256 b, const int mask); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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BLENDVPD — Variable Blend Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En Mode Feature 

Flag 
66 OF 38 15 /r RMO | V/V SSE4_1 Select packed DP FP values from xmm17 and 
BLENDVPD xmm1, xmm2/m128 , <XMMO> xmme from mask specified in XMMO and 

store the values in xmm7. 

VEX.128.66.0F3A.WO 4B /r /is4 RVMR | V/V AVX Conditionally copy double-precision floating- 
VBLENDVPD xmm1, xmm2, xmm3/m128, xmm4 point values from xmm2 or xmm3/m128 to 


xmm1, based on mask bits in the mask 
operand, xmm4. 
VEX.256.66.0F3A.WO 4B /r /is4 RVMR | V/V AVX Conditionally copy double-precision floating- 


VBLENDVPD ymm1, ymm2, ymm3/m256, ymm4 point values from ymm2 or ymm3/m256 to 
ymm1, based on mask bits in the mask 


operand, ymm4. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 

RMO ModRM:reg (r, w) ModRM:r/m (r) implicit XMMO NA 

RVMR ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8[7:4] 
Description 


Conditionally copy each quadword data element of double-precision floating-point value from the second source 
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits 
are the most significant bit in each quadword element of the mask register. 


Each quadword element of the destination operand is copied from: 
¢ the corresponding quadword element in the second source operand, if a mask bit is “1”; or 
¢ the corresponding quadword element in the first source operand, if a mask bit is “O” 


The register assignment of the implicit mask operand for BLENDVPD is defined to be the architectural register 
XMMO. 


128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128) 
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined 
to be the architectural register XMMO. An attempt to execute BLENDVPD with a VEX prefix will cause #UD. 


VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second 
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. 
VEX.W must be 0, otherwise, the instruction will #UD. 


VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source 
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. VEX.W must be 0, otherwise, the instruction will #UD. 


VBLENDVPD permits the mask to be any XMM or YMM register. In contrast, BLENDVPD treats XMMO implicitly as the 
mask and do not support non-destructive destination operation. 
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Operation 


BLENDVPD (128-bit Legacy SSE version) 
MASK := XMMO 
IF (MASK[63] = 0) THEN DEST[63:0] := DEST[63:0] 
ELSE DEST [63:0] := SRC[63:0] FI 
IF (MASK[127] = 0) THEN DEST[127:64] := DEST[127:64] 
ELSE DEST [127:64] := SRC[127:64] Fl 
DEST[MAXVL-1:128] (Unmodified) 


VBLENDVPD (VEX.128 encoded version) 
MASK := SRC3 
IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST [63:0] := SRC2[63:0] FI 
IF (MASK[127] = 0) THEN DEST[1 27:64] := SRC1[127:64] 
ELSE DEST [127:64] := SRC2[127:64] Fl 
DEST[MAXVL-1:128] := 0 


VBLENDVPD (VEX.256 encoded version) 

MASK := SRC3 

IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST [63:0] := SRC2[63:0] FI 

IF (MASK[127] = 0) THEN DEST[1 27:64] := SRC1[127:64] 
ELSE DEST [127:64] := SRC2[127:64] Fl 

IF (MASK[191] = 0) THEN DEST[191:128] := SRC1[191:128] 
ELSE DEST [191:128] := SRC2[191:128] Fl 

IF (MASK[255] = 0) THEN DEST[255:192] := SRC1[255:192] 
ELSE DEST [255:192] := SRC2[255:192] Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


BLENDVPD: m128d_mm_blendv_pd(__m128d v1,__m128d v2, 


VBLENDVPD: m128 _mm_blendv_pd (__m128d a, 


VBLENDVPD: m256 __mm256_blendv_pd (__m256d a, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


m256d b, 


m1 28d v3); 


m128d b,__m128d mask); 


m256d mask); 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD If VEX.W = 1. 
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BLENDVPS — Variable Blend Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En Mode Feature 
Flag 

66 OF 38 14 /r RMO | V/V SSE4_1_ | Select packed single precision floating-point 

BLENDVPS xmm1, xmm2/m128, <XMMO> values from xmm7 and xmm2/m128 from 
mask specified in XMMO and store the values 
into xmm1. 

VEX.128.66.0F3A.WO 4A /r /is4 RVMR | V/V AVX Conditionally copy single-precision floating- 

VBLENDVPS xmm1, xmm2, xmm3/m128, xmm4 point values from xmm2 or xmm3/m128 to 
xmm1, based on mask bits in the specified 
mask operand, xmm4. 

VEX.256.66.0F3A.WO 4A /r /is4 RVMR | V/V AVX Conditionally copy single-precision floating- 

VBLENDVPS ymm1, ymm2, ymm3/m256, ymm4 point values from ymm2 or ymm3/m256 to 
ymm1, based on mask bits in the specified 
mask register, ymm4. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 

RMO ModRM:reg (r, w) ModRM:r/m (r) implicit XMMO NA 

RVMR ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8[7:4] 
Description 


Conditionally copy each dword data element of single-precision floating-point value from the second source 
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits 
are the most significant bit in each dword element of the mask register. 


Each quadword element of the destination operand is copied from: 
¢ the corresponding dword element in the second source operand, if a mask bit is “1”; or 
¢ the corresponding dword element in the first source operand, if a mask bit is “O” 


The register assignment of the implicit mask operand for BLENDVPS is defined to be the architectural register 
XMMO. 


128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128) 
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined 
to be the architectural register XMMO. An attempt to execute BLENDVPS with a VEX prefix will cause #UD. 


VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second 
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. 
VEX.W must be 0, otherwise, the instruction will #UD. 


VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source 
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. VEX.W must be 0, otherwise, the instruction will #UD. 


VBLENDVPS permits the mask to be any XMM or YMM register. In contrast, BLENDVPS treats XMMO implicitly as the 
mask and do not support non-destructive destination operation. 
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Operation 


BLENDVPS (128-bit Legacy SSE version) 

MASK := XMMO 

IF (MASK[31] = 0) THEN DEST[31:0] := DEST[31:0] 
ELSE DEST [31:0] := SRC[31:0] Fl 

IF (MASK[63] = 0) THEN DEST[63:32] := DEST[63:32] 
ELSE DEST [63:32] := SRC[63:32] FI 

IF (MASK[95] = 0) THEN DEST[95:64] := DEST[95:64] 
ELSE DEST [95:64] := SRC[95:64] FI 

IF (MASK[127] = 0) THEN DEST[1 27:96] := DEST[127:96] 
ELSE DEST [127:96] := SRC[127:96] Fl 

DEST[MAXVL-1:128] (Unmodified) 


VBLENDVPS (VEX.128 encoded version) 

MASK := SRC3 

IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0] 
ELSE DEST [31:0] := SRC2[31:0] FI 

IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32] 
ELSE DEST [63:32] := SRC2[63:32] Fl 

IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64] 
ELSE DEST [95:64] := SRC2[95:64] Fl 

IF (MASK[127] = 0) THEN DEST[1 27:96] := SRC1[127:96] 
ELSE DEST [127:96] := SRC2[127:96] FI 

DEST[MAXVL-1:128] := 0 


VBLENDVPS (VEX.256 encoded version) 

MASK := SRC3 

IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0] 
ELSE DEST [31:0] := SRC2[31:0] Fl 

IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32] 
ELSE DEST [63:32] := SRC2[63:32] Fl 

IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64] 
ELSE DEST [95:64] := SRC2[95:64] FI 

IF (MASK[127] = 0) THEN DEST[1 27:96] := SRC1[127:96] 
ELSE DEST [127:96] := SRC2[127:96] Fl 

IF (MASK[159] = 0) THEN DEST[159:128] := SRC1[159:128] 
ELSE DEST [159:128] := SRC2[159:128] FI 

IF (MASK[191] = 0) THEN DEST[191:160] := SRC1[191:160] 
ELSE DEST [191:160] := SRC2[191:160] FI 

IF (MASK[223] = 0) THEN DEST[223:192] := SRC1[223:192] 
ELSE DEST [223:192] := SRC2[223:192] FI 

IF (MASK[255] = 0) THEN DEST[255:224] := SRC1[255:224] 
ELSE DEST [255:224] := SRC2[255:224] Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


BLENDVPS: m128 _mm_blendv_ps(__m128 v1,__m128 v2,__m128 v3); 
VBLENDVPS: m128_mm_blendv_ps (__m128 a,__m128b,__m128 mask); 
VBLENDVPS: m256 __mm256_blendv_ps (__m256 a,__m256 b,___m256 mask); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.W = 1. 
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BLSI — Extract Lowest Set Isolated Bit 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode Flag 
VEX.LZ.0F38.W0 F3 /3 VM | VV BMI1 Extract lowest set bit from r/m32 and set that bit in r32. 
BLSI r32, r/m32 
VEX.LZ.0F38.W1 F3 /3 VM | V/N.E. BMI1 Extract lowest set bit from r/m64, and set that bit in r64. 
BLSI r64, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
VM VEX.vvvv (w) ModRM:r/m (r) NA NA 
Description 


Extracts the lowest set bit from the source operand and set the corresponding bit in the destination register. All 
other bits in the destination operand are zeroed. If no bits are set in the source operand, BLSI sets all the bits in the 
destination to 0 and sets ZF and CF. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 
temp := (-SRC) bitwiseAND (SRC); 
SF := temp[OperandSize -1]; 
ZF := (temp = 0); 
IF SRC =0 
CF := 0; 
ELSE 


Fl 
DEST := temp; 


Flags Affected 


ZF and SF are updated based on the result. CF is set if the source is not zero. OF flags are cleared. AF and PF 
flags are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
BLSI: unsigned __int32 _blsi_u32(unsigned __int32 src); 
BLSI: unsigned __int64 _blsi_u64(unsigned __int64 src); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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BLSMSK — Get Mask Up to Lowest Set Bit 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode Flag 
VEX.LZ.0F38.W0 F3 /2 VM | V/V BMI1 Set all lower bits in r32 to “1” starting from bit O to lowest set bit in 
BLSMSK r32, r/m32 r/m32. 
VEX.LZ.0F38.W1 F3 /2 VM | V/N.E. BMI1 Set all lower bits in r64 to “1” starting from bit O to lowest set bit in 
BLSMSK r64, r/m64 r/m64. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
VM VEX.vvvv (w) ModRM:r/m (r) NA NA 
Description 


Sets all the lower bits of the destination operand to “1” up to and including lowest set bit (=1) in the source 
operand. If source operand is zero, BLSMSK sets all bits of the destination operand to 1 and also sets CF to 1. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An 
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 
temp := (SRC-1) XOR (SRC); 
SF := temp[OperandSize -1]; 
ZF := 0; 
IF SRC = 0 

CF := 1; 
ELSE 


Fl 
DEST := temp; 


Flags Affected 


SF is updated based on the result. CF is set if the source if zero. ZF and OF flags are cleared. AF and PF flag are 
undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
BLSMSK: unsigned __int32 _blsmsk_u32(unsigned __int32 src); 
BLSMSK: unsigned __int64 _blsmsk_u64(unsigned __int64 src); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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BLSR — Reset Lowest Set Bit 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode Flag 
VEX.LZ.0F38.W0 F3 /1 VM | VV BMI1 Reset lowest set bit of r/m32, keep all other bits of r/m32 and write 
BLSR 32, r/m32 result to r32. 
VEX.LZ.0F38.W1 F3 /1 VM | V/N.E. BMI1 Reset lowest set bit of r/m64, keep all other bits of r/m64 and write 
BLSR r64, r/m64 result to r64. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
VM VEX.vvvv (w) ModRM:r/m (r) NA NA 
Description 


Copies all bits from the source operand to the destination operand and resets (=0) the bit position in the destina- 
tion operand that corresponds to the lowest set bit of the source operand. If the source operand is zero BLSR sets 
CF. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 
temp := (SRC-1) bitwiseAND ( SRC ); 
SF := temp[OperandSize -1]; 
ZF := (temp = 0); 
IF SRC =0 
CF := 1; 
ELSE 


Fl 
DEST := temp; 


Flags Affected 


ZF and SF flags are updated based on the result. CF is set if the source is zero. OF flag is cleared. AF and PF flags 
are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
BLSR: unsigned __int32 _blsr_u32(unsigned __int32 src); 
BLSR: unsigned __int64 _blsr_u64(unsigned __int64 src); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 


3-106 Vol. 2A BLSR — Reset Lowest Set Bit 


BNDCL—Check Lower Bound 


INSTRUCTION SET REFERENCE, A-L 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 

F3 OF 1A /r RM NE/V MPX Generate a #BR if the address in r/m32 is lower than the lower 
BNDCL bnd, r/m32 bound in bnd.LB. 
F3 OF 1A /r RM V/NE MPX Generate a #BR if the address in r/m64 is lower than the lower 
BNDCL bnd, r/m64 bound in bnd.LB. 

Instruction Operand Encoding 

Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (w) ModRM:r/m (r) NA 
Description 


Compare the address in the second operand with the lower bound in bnd. The second operand can be either a 
register or memory operand. If the address is lower than the lower bound in bnd.LB, it will set BNDSTATUS to 01H 
and signal a #BR exception. 


This instruction does not cause any memory access, and does not read or write any flags. 


Operation 


BNDCL BND, reg 

IF reg < BND.LB Then 
BNDSTATUS := 01H; 
#BR; 

Fl; 


BNDCL BND, mem 

TEMP := LEA(mem); 

IF TEMP < BND.LB Then 
BNDSTATUS := 01H; 
#BR; 

FI; 


Intel C/C++ Compiler Intrinsic Equivalent 
BNDCL void _bnd_chk_ptr_Ibounds(const void *q) 


Flags Affected 
None 


Protected Mode Exceptions 


#BR 
#UD 


If lower bound check fails. 
If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 


If 67H prefix is not used and CS.D=0. 
If 67H prefix is used and CS.D=1. 
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Real-Address Mode Exceptions 

#BR If lower bound check fails. 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


Virtual-8086 Mode Exceptions 

#BR If lower bound check fails. 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
Same exceptions as in protected mode. 
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Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
F2 OF 1A/r RM NE/V MPX Generate a #BR if the address in r/m32 is higher than the upper 
BNDCU bnd, r/m32 bound in bnd.UB (bnb.UB in 1’s complement form). 
F2 OF 1A/r RM V/NE MPX Generate a #BR if the address in r/m64 is higher than the upper 
BNDCU bnd, r/m64 bound in bnd.UB (bnb.UB in 1’s complement form). 
F2 OF 1B/r RM NE/V MPX Generate a #BR if the address in r/m32 is higher than the upper 
BNDCN bnd, r/m32 bound in bnd.UB (bnb.UB not in 1‘s complement form). 
F2 OF 1B/r RM V/NE MPX Generate a #BR if the address in r/m64 is higher than the upper 
BNDCN bnd, r/m64 bound in bnd.UB (bnb.UB not in 1’s complement form). 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (w) ModRM:r/m (r) NA 


Description 


Compare the address in the second operand with the upper bound in bnd. The second operand can be either a 
register or a memory operand. If the address is higher than the upper bound in bnd.UB, it will set BNDSTATUS to 
01H and signal a #BR exception. 


BNDCU perform 1’s complement operation on the upper bound of bnd first before proceeding with address compar- 
ison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1’s 


complement form. 


This instruction does not cause any memory access, and does not read or write any flags. 
Effective address computation of m32/64 has identical behavior to LEA 


Operation 


BNDCU BND, reg 

IF reg > NOT(BND.UB) Then 
BNDSTATUS := 01H; 
#BR; 

Fl; 


BNDCU BND, mem 

TEMP := LEA(mem); 

IF TEMP > NOT(BND.UB) Then 
BNDSTATUS := 01H; 
#BR; 

FI; 


BNDCN BND, reg 

IF reg > BND.UB Then 
BNDSTATUS := 01H; 
#BR; 

Fl; 


BNDCU/BNDCN—Check Upper Bound 


Vol.2A 3-109 


INSTRUCTION SET REFERENCE, A-L 


BNDCN BND, mem 

TEMP := LEA(mem); 

IF TEMP > BND.UB Then 
BNDSTATUS := 01H; 
#BR; 

FI; 


Intel C/C++ Compiler Intrinsic Equivalent 
BNDCU .void _bnd_chk_ptr_ubounds(const void *q) 


Flags Affected 
None 


Protected Mode Exceptions 

#BR If upper bound check fails. 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 67H prefix is not used and CS.D=0. 
If 67H prefix is used and CS.D=1. 


Real-Address Mode Exceptions 

#BR If upper bound check fails. 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


Virtual-8086 Mode Exceptions 

#BR If upper bound check fails. 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
Same exceptions as in protected mode. 
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BNDLDX—Load Extended Bounds Using Address Translation 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support Flag 
NP OF 1A /r RM VIN MPX Load the bounds stored in a bound table entry (BTE) into bnd with 
BNDLDX bnd, mib address translation using the base of mib and conditional on the 
index of mib matching the pointer value in the BTE. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
SIB.base (r): Address of pointer 
RM ModRM:reg (w) ie ahs ° NA 
Description 


BNDLDxX uses the linear address constructed from the base register and displacement of the SIB-addressing form 
of the memory operand (mib) to perform address translation to access a bound table entry and conditionally load 
the bounds in the BTE to the destination. The destination register is updated with the bounds in the BTE, if the 
content of the index register of mib matches the pointer value stored in the BTE. 

If the pointer value comparison fails, the destination is updated with INIT bounds (Ib = 0x0, ub = 0x0) (note: as 
articulated earlier, the upper bound is represented using 1's complement, therefore, the 0x0 value of upper bound 
allows for access to full memory). 

This instruction does not cause memory access to the linear address of mib nor the effective address referenced by 
the base, and does not read or write any flags. 

Segment overrides apply to the linear address computation with the base of mib, and are used during address 
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be 
linear address. There are no segmentation checks performed on the base of mib. 


The base of mib will not be checked for canonical address violation as it does not access memory. 


Any encoding of this instruction that does not specify base or index register will treat those registers as zero 
(constant). The reg-reg form of this instruction will remain a NOP. 


The scale field of the SIB byte has no effect on these instructions and is ignored. 


The bound register may be partially updated on memory faults. The order in which memory operands are loaded is 
implementation specific. 


Operation 


base := mib.SIB.base ? mib.SIB.base + Disp: 0; 
ptr_value := mib.SIB.index ? mib.SIB.index : 0; 


Outside 64-bit mode 
A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 ); 
A_BT[31:0] := LoadFrom(A_BDE ); 
IF A_BT[O] equal O Then 
BNDSTATUS := A_BDE | 02H; 
#BR; 
Fl; 
A_BTE[31:0] := (Zero_extend32(base[1 1:2] « 4) + (A_BT[31:2] « 2); 
Temp_Ib[31:0] := LoadFrom(A_BTE); 
Temp_ub[31:0] := LoadFrom(A_BTE + 4); 
Temp_ptr[31:0] := LoadFrom(A_BTE + 8); 
IF Temp_ptr equal ptr_value Then 
BND.LB := Temp_l|b; 
BND.UB := Temp_ub; 
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ELSE 
BND.LB := 0; 
BND.UB := 0; 
Fl; 


In 64-bit mode 
A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );! 
A_BT[63:0] := LoadFrom(A_BDE); 
IF A_BT[O] equal O Then 
BNDSTATUS := A_BDE | 02H; 
#BR; 
Fl; 
A_BTE[63:0] := (Zero_extend64(base[1 9:3] « 5) + (A_BT[63:3] « 3 ); 
Temp_Ib[63:0] := LoadFrom(A_BTE); 
Temp_ub[63:0] := LoadFrom(A_BTE + 8); 
Temp_ptr[63:0] := LoadFrom(A_BTE + 16); 
IF Temp_ptr equal ptr_value Then 
BND.LB := Temp_lb; 
BND.UB := Temp_ub; 


ELSE 
BND.LB := 0; 
BND.UB := 0; 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 
BNDLDX: Generated by compiler as needed. 


Flags Affected 
None 


Protected Mode Exceptions 
#BR If the bound directory entry is invalid. 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 67H prefix is not used and CS.D=0. 
If 67H prefix is used and CS.D=1. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 
If DS register contains a NULL segment selector. 
#PF(fault code) If a page fault occurs. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 


1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer- 
ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Section 17.3.1 of Intel® 64 and IA-32 Architectures Software Devel- 
oper's Manual, Volume 1. 
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Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 
#PF(fault code) If a page fault occurs. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#BR If the bound directory entry is invalid. 
#UD If ModRM is RIP relative. 

If the LOCK prefix is used. 

If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
#GP(0) If the memory address (A_BDE or A_BTE) is in a non-canonical form. 
#PF(fault code) If a page fault occurs. 
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BNDMK—Make Bounds 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 


BNDMK bnd, m32 


F3 0F 1B/r RM NE/V MPX Make lower and upper bounds from m32 and store them in bnd. 


BNDMK bnd, m64 


F3 OF 1B/r RM V/NE MPX Make lower and upper bounds from m64 and store them in bnd. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (w) ModRM:r/m (r) NA 
Description 


Makes bounds from the second operand and stores the lower and upper bounds in the bound register bnd. The 
second operand must be a memory operand. The content of the base register from the memory operand is stored 
in the lower bound bnd.LB. The 1's complement of the effective address of m32/m64 is stored in the upper bound 


b.UB. Computation of m32/m64 has identical behavior to LEA. 


This instruction does not cause any memory access, and does not read or write any flags. 


If the instruction did not specify base register, the lower bound will be zero. The reg-reg form of this instruction 


retains legacy behavior (NOP). 


The instruction causes an invalid-opcode exception (#UD) if executed in 64-bit mode with RIP-relative addressing. 


Operation 


BND.LB := SRCMEM.base; 
IF 64-bit mode Then 
BND.UB := NOT(LEA.64_bits(SRCMEM)); 
ELSE 
BND.UB := Zero_Extend.64_bits(NOT(LEA.32_bits(SRCMEM))); 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 
BNDMK void * _bnd_set_ptr_bounds(const void * q, size_t size); 


Flags Affected 
None 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 


If 67H prefix is not used and CS.D=0. 
If 67H prefix is used and CS.D=1. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 


If 16-bit addressing is used. 
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Virtual-8086 Mode Exceptions 

#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
If RIP-relative addressing is used. 
#SS(0) If the memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
Same exceptions as in protected mode. 


BNDMK—Make Bounds Vol.2A 3-115 


INSTRUCTION SET REFERENCE, A-L 


BNDMOV—Move Bounds 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
66 OF 1A /r RM NE/V MPX Move lower and upper bound from bnd2/m64 to bound register 
BNDMOV bnd1, bnd2/m64 bnd1. 
66 OF 1A /r RM V/NE MPX Move lower and upper bound from bnd2/m1 28 to bound register 
BNDMOV bnd1, bnd2/m128 bnd1. 
66 OF 1B /r MR NE/V MPX Move lower and upper bound from bnd2 to bnd1/m64. 
BNDMOV bnd1/m64, bnd2 
66 OF 1B /r MR V/NE MPX Move lower and upper bound from bnd2 to bound register 
BNDMOV bnd1/m128, bnd2 bnd1/m128. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (w) ModRM:r/m (r) NA 
MR ModRM:r/m (w) ModRM:reg (r) NA 
Description 


BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the 
destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction. 
The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5. 


Upper Bound (UB) 


Lower Bound (LB) 


16 ier 


Oe 0 Byte offset 


BNDMOV to memory in 64-bit mode 


Upper Bound (UB) 


Lower Bound (LB) 


BNDMOV to memory in 32-bit mode 


0 Byte offset 


Figure 3-5. Memory Layout of BNDMOV to/from Memory 


This instruction does not change flags. 


Operation 


BNDMOV register to register 


DEST.LB := SRC.LB; 
DEST.UB := SRC.UB; 
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BNDMOV from memory 


IF 64-bit mode THEN 


DEST.LB := LOAD_QWORD(SRC); 
DEST.UB := LOAD_QWORD(SRC+8); 


ELSE 


DEST.LB := LOAD_DWORD_ZERO_EXT(SRC); 
DEST.UB := LOAD_DWORD_ZERO_EXT(SRC+4); 


Fl; 


BNDMOV to memory 


IF 64-bit mode THEN 


DEST[63:0] := SRC.LB; 
DEST[127:64] := SRC.UB; 


ELSE 


DEST[31:0] := SRC.LB; 
DEST[63:32] := SRC.UB; 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


BNDMOV void * _bnd_copy_ptr_bounds(const void *q, const void *r) 
Flags Affected 
None 


Protected Mode Exceptions 


#UD 


#SS(0) 
#GP(0) 


#AC(0) 
#PF(fault code) 


If the LOCK prefix is used but the destination is not a memory operand. 

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 

If 67H prefix is not used and CS.D=0. 

If 67H prefix is used and CS.D=1. 

If the memory operand effective address is outside the SS segment limit. 

If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the destination operand points to a non-writable segment 

If the DS, ES, FS, or GS segment register contains a NULL segment selector. 

If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. 
If a page fault occurs. 


Real-Address Mode Exceptions 


#UD 


#GP(0) 
#SS 
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If the LOCK prefix is used but the destination is not a memory operand. 

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 

If 16-bit addressing is used. 

If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the memory operand effective address is outside the SS segment limit. 
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Virtual-8086 Mode Exceptions 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 


#GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If the memory operand effective address is outside the SS segment limit. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. 


#PF(fault code) If a page fault occurs. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used but the destination is not a memory operand. 
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
#SS(0) If the memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. 


#PF(fault code) If a page fault occurs. 
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BNDSTX—Store Extended Bounds Using Address Translation 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 
NP OF 1B /r MR VIV MPX Store the bounds in bnd and the pointer value in the index regis- 
BNDSTX mib, bnd ter of mib to a bound table entry (BTE) with address translation 
using the base of mib. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
SIB.base (r): Address of pointer : 
MR SIB.index(r) ModRM:reg (r) NA 
Description 


BNDSTX uses the linear address constructed from the displacement and base register of the SIB-addressing form 
of the memory operand (mib) to perform address translation to store to a bound table entry. The bounds in the 
source operand bnd are written to the lower and upper bounds in the BTE. The content of the index register of mib 
is written to the pointer value field in the BTE. 

This instruction does not cause memory access to the linear address of mib nor the effective address referenced by 
the base, and does not read or write any flags. 

Segment overrides apply to the linear address computation with the base of mib, and are used during address 
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be 
linear address. There are no segmentation checks performed on the base of mib. 


The base of mib will not be checked for canonical address violation as it does not access memory. 


Any encoding of this instruction that does not specify base or index register will treat those registers as zero 
(constant). The reg-reg form of this instruction will remain a NOP. 


The scale field of the SIB byte has no effect on these instructions and is ignored. 


The bound register may be partially updated on memory faults. The order in which memory operands are loaded is 
implementation specific. 


Operation 


base := mib.SIB.base ? mib.SIB.base + Disp: 0; 
ptr_value := mib.SIB.index ? mib.SIB.index : 0; 


Outside 64-bit mode 
A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 ); 
A_BT[31:0] := LoadFrom(A_BDE); 
IF A_BT[O] equal O Then 
BNDSTATUS := A_BDE | 02H; 
#BR; 
Fl; 
A_DEST[31:0] := (Zero_extend32(base[1 1:2] « 4) + (A_BT[31:2] « 2 ); // address of Bound table entry 
A_DEST[8][31:0] := ptr_value; 
A_DEST[0][31:0] := BND.LB; 
A_DEST[4][31:0] := BND.UB; 
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In 64-bit mode 
A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );! 
A_BT[63:0] := LoadFrom(A_BDE); 
IF A_BT[O] equal O Then 
BNDSTATUS := A_BDE | 02H; 
#BR; 
Fl; 
A_DEST[63:0] := (Zero_extend64(base[1 9:3] « 5) + (A_BT[63:3] « 3 ); // address of Bound table entry 
A_DEST[16][63:0] := ptr_value; 
A_DEST[0][63:0] := BND.LB; 
A_DEST[8][63:0] := BND.UB; 


Intel C/C++ Compiler Intrinsic Equivalent 
BNDSTX: _bnd_store_ptr_bounds(const void **ptr_addr, const void *ptr_val); 


Flags Affected 
None 


Protected Mode Exceptions 
#BR If the bound directory entry is invalid. 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 67H prefix is not used and CS.D=0. 
If 67H prefix is used and CS.D=1. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 
If DS register contains a NULL segment selector. 
If the destination operand points to a non-writable segment 
#PF(fault code) If a page fault occurs. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 


Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. 
If 16-bit addressing is used. 
#GP(0) If a destination effective address of the Bound Table entry is outside the DS segment limit. 
#PF(fault code) If a page fault occurs. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer- 
ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Section 17.3.1 of Intel® 64 and IA-32 Architectures Software Devel- 
oper's Manual, Volume 1. 
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64-Bit Mode Exceptions 
#BR If the bound directory entry is invalid. 
#UD If ModRM is RIP relative. 
If the LOCK prefix is used. 
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. 
#GP(0) If the memory address (A_BDE or A_BTE) is in a non-canonical form. 
If the destination operand points to a non-writable segment 
#PF(fault code) If a page fault occurs. 
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BOUND—Check Array Index Against Bounds 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
62 /r BOUND r16, m16&16 RM | Invalid Valid Check if 76 (array index) is within bounds 
specified by m76&16. 
62 /r BOUND r32, mM32&32 RM | Invalid Valid Check if r32 (array index) is within bounds 
specified by m32&32. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


BOUND determines if the first operand (array index) is within the bounds of an array specified the second operand 
(bounds operand). The array index is a signed integer located in a register. The bounds operand is a memory loca- 
tion that contains a pair of signed doubleword-integers (when the operand-size attribute is 32) or a pair of signed 
word-integers (when the operand-size attribute is 16). The first doubleword (or word) is the lower bound of the 

array and the second doubleword (or word) is the upper bound of the array. The array index must be greater than 
or equal to the lower bound and less than or equal to the upper bound plus the operand size in bytes. If the index 
is not within bounds, a BOUND range exceeded exception (#BR) is signaled. When this exception is generated, the 
saved return instruction pointer points to the BOUND instruction. 


The bounds limit data structure (two words or doublewords containing the lower and upper limits of the array) is 
usually placed just before the array itself, making the limits addressable via a constant offset from the beginning of 
the array. Because the address of the array already will be present in a register, this practice avoids extra bus cycles 


to obtain the effective address of the array bounds. 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 


IF 64bit Mode 
THEN 
#UD; 
ELSE 


IF (Arraylndex < LowerBound OR Arraylndex > UpperBound) THEN 


(* Below lower bound or above upper bound *) 
IF <equation for PL enabled> THEN BNDSTATUS := 0 


#BR; 
Fl; 
Fl; 


Flags Affected 
None. 
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Protected Mode Exceptions 


#BR If the bounds test fails. 

#UD If second operand is not a memory location. 
If the LOCK prefix is used. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 


Real-Address Mode Exceptions 


#BR If the bounds test fails. 
#UD If second operand is not a memory location. 
If the LOCK prefix is used. 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 


Virtual-8086 Mode Exceptions 


#BR If the bounds test fails. 
#UD If second operand is not a memory location. 
If the LOCK prefix is used. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 


BOUND—Check Array Index Against Bounds Vol.2A 3-123 


INSTRUCTION SET REFERENCE, A-L 


BSF—Bit Scan Forward 


Opcode Instruction Op/ | 64-bit Compat/ |Description 

En |Mode Leg Mode 
OF BC /r BSF r16, r/m16 RM | Valid Valid Bit scan forward on r/m16. 
OF BC /r BSF r32, r/m32 RM | Valid Valid Bit scan forward on r/m32. 
REX.W + OF BC /r BSF r64, r/m64 RM_ | Valid N.E. Bit scan forward on r/m64, 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Searches the source operand (second operand) for the least significant set bit (1 bit). If a least significant 1 bit is 
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a 
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source 
operand. If the content of the source operand is 0, the content of the destination operand is undefined. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF SRC = 0 
THEN 
ZF := 1; 
DEST is undefined; 
ELSE 
ZF := 0; 
temp := 0; 
WHILE Bit(SRC, temp) = 0 
DO 
temp := temp + 1; 
OD; 
DEST := temp; 
Fl; 


Flags Affected 


The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF flags 
are undefined. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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BSR—Bit Scan Reverse 


Opcode Instruction Op/ | 64-bit Compat/ |Description 

En |Mode Leg Mode 
OF BD /r BSR r16, r/m16 RM _ | Valid Valid Bit scan reverse on r/m16. 
OF BD /r BSR r32, r/m32 RM _ | Valid Valid Bit scan reverse on r/m32. 
REX.W + OF BD /r BSR r64, r/m64 RM | Valid N.E. Bit scan reverse on r/m64. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Searches the source operand (second operand) for the most significant set bit (1 bit). If a most significant 1 bit is 
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a 
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source 
operand. If the content source operand is 0, the content of the destination operand is undefined. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF SRC =0 

THEN 
ZF := 1; 
DEST is undefined; 

ELSE 
ZF := 0; 
temp := OperandSize - 1; 
WHILE Bit(SRC, temp) = 0 


DO 
temp := temp - 1; 
OD; 
DEST := temp; 
Fl; 
Flags Affected 


The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF flags 
are undefined. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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BSWAP—Byte Swap 


Opcode Instruction Op/ | 64-bit Compat/ |Description 

En |Mode Leg Mode 
OF C8+rd BSWAP r32 O Valid* Valid Reverses the byte order of a 32-bit register. 
REX.W + OF C8+rd BSWAP r64 6) Valid N.E. Reverses the byte order of a 64-bit register. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
O opcode + rd (r, w) NA NA NA 
Description 


Reverses the byte order of a 32-bit or 64-bit (destination) register. This instruction is provided for converting little- 
endian values to big-endian format and vice versa. To swap bytes in a word value (16-bit register), use the XCHG 
instruction. When the BSWAP instruction references a 16-bit register, the result is undefined. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


IA-32 Architecture Legacy Compatibility 


The BSWAP instruction is not supported on IA-32 processors earlier than the Intel486™ processor family. For 
compatibility with this instruction, software should include functionally equivalent code for execution on Intel 
processors earlier than the Intel486 processor family. 


Operation 


TEMP := DEST 
IF 64-bit mode AND OperandSize = 64 
THEN 
DEST[7:0] := TEMP[63:56]; 
DEST[1 5:8] := TEMP[55:48]; 
DEST[23:16] := TEMP[47:40]; 
DEST[31:24] := TEMP[39:32]; 
DEST[39:32] := TEMP[31:24]; 
DEST[47:40] := TEMP[23:16]; 
DEST[55:48] := TEMP[1 5:8]; 
DEST[63:56] := TEMP[7:0]; 
ELSE 
DEST[7:0] := TEMP[31:24]; 
DEST[1 5:8] := TEMP[23:16]; 
DEST[23:16] := TEMP[1 5:8]; 
DEST[31:24] := TEMP[7:0]; 
Fl; 


Flags Affected 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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BT—Bit Test 
Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
OF A3 /r BT r/m16, r16 MR | Valid Valid Store selected bit in CF flag. 
OF A3 /r BT r/m32, r32 MR | Valid Valid Store selected bit in CF flag. 
REX.W + OF A3 /r BT r/m64, r64 MR | Valid N.E. Store selected bit in CF flag. 
OF BA /4 ib BT r/m16, imm8 MI Valid Valid Store selected bit in CF flag. 
OF BA /4 ib BT r/m32, imm8 MI Valid Valid Store selected bit in CF flag. 
REX.W + OF BA /4 ib BT r/m64, imm8 MI Valid N.E. Store selected bit in CF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 

MR ModRM:r/m (r) ModRM:reg (r) NA NA 

MI ModRM:r/m (r) imm8 NA NA 
Description 


Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by 
the bit offset (specified by the second operand) and stores the value of the bit in the CF flag. The bit base operand 
can be a register or a memory location; the bit offset operand can be a register or an immediate value: 


° If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset 
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit 
mode). 


e If the bit base operand specifies a memory location, the operand represents the address of the byte in memory 
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be 
referenced by the offset operand depends on the operand size. 


See also: Bit(BitBase, BitOffset) on page 3-11. 


Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina- 
tion with the displacement field of the memory operand. In this case, the low-order 3 or 5 bits (3 for 16-bit oper- 
ands, 5 for 32-bit operands) of the immediate bit offset are stored in the immediate bit offset field, and the high- 
order bits are shifted and combined with the byte displacement in the addressing mode by the assembler. The 
processor will ignore the high order bits if they are not zero. 


When accessing a bit in memory, the processor may access 4 bytes starting from the memory address for a 32-bit 
operand size, using by the following relationship: 


Effective Address + (4 * (BitOffset DIV 32)) 
Or, it may access 2 bytes starting from the memory address for a 16-bit operand, using this relationship: 


Effective Address + (2 * (BitOffset DIV 16)) 


It may do so even when only a single byte needs to be accessed to reach the given bit. When using this bit 
addressing mechanism, software should avoid referencing areas of memory close to address space holes. In partic- 
ular, it should avoid references to memory-mapped I/O registers. Instead, software should use the MOV instruc- 
tions to load from or store to these addresses, and use the register form of these instructions to manipulate the 
data. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper- 
ands. See the summary chart at the beginning of this section for encoding data and limits. 


Operation 


CF := Bit(BitBase, BitOffset); 
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Flags Affected 


The CF flag contains the value of the selected bit. The ZF flag is unaffected. The OF, SF, AF, and PF flags are 
undefined. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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BTC—Bit Test and Complement 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 

OF BB /r BTC r/m16, r16 MR | Valid Valid Store selected bit in CF flag and complement. 
OF BB /r BTC r/m32, r32 MR | Valid Valid Store selected bit in CF flag and complement. 
REX.W + OF BB /r BTC r/m64, r64 MR | Valid N.E. Store selected bit in CF flag and complement. 
OF BA /7 ib BTC r/m16, imm8& MI | Valid Valid Store selected bit in CF flag and complement. 
OF BA /7 ib BTC r/m32, imm8& MI | Valid Valid Store selected bit in CF flag and complement. 
REX.W + OF BA /7 ib BTC r/m64, imm8 MI | Valid N.E. Store selected bit in CF flag and complement. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8 NA NA 
Description 


Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by 
the bit offset operand (second operand), stores the value of the bit in the CF flag, and complements the selected 
bit in the bit string. The bit base operand can be a register or a memory location; the bit offset operand can be a 
register or an immediate value: 


e If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset 
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit 
mode). This allows any bit position to be selected. 


° If the bit base operand specifies a memory location, the operand represents the address of the byte in memory 
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be 
referenced by the offset operand depends on the operand size. 


See also: Bit(BitBase, BitOffset) on page 3-11. 


Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina- 
tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on 
this addressing mechanism. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


CF := Bit(BitBase, BitOffset); 
Bit(BitBase, BitOffset) := NOT Bit(BitBase, BitOffset); 


Flags Affected 


The CF flag contains the value of the selected bit before it is complemented. The ZF flag is unaffected. The OF, SF, 
AF, and PF flags are undefined. 
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Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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BTR—Bit Test and Reset 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 

OF B3 /r BTR r/m16, r16 MR | Valid Valid Store selected bit in CF flag and clear. 
OF B3 /r BTR r/m32, r32 MR | Valid Valid Store selected bit in CF flag and clear. 
REX.W + OF B3 /r BTR r/m64, r64 MR | Valid N.E. Store selected bit in CF flag and clear. 
OF BA /6 ib BTR r/m16, imm8 MI | Valid Valid Store selected bit in CF flag and clear. 
OF BA /6 ib BTR r/m32, imm8 MI | Valid Valid Store selected bit in CF flag and clear. 
REX.W + OF BA /6 ib BTR r/m64, imm8& MI | Valid N.E. Store selected bit in CF flag and clear. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8 NA NA 
Description 


Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by 
the bit offset operand (second operand), stores the value of the bit in the CF flag, and clears the selected bit in the 
bit string to 0. The bit base operand can be a register or a memory location; the bit offset operand can be a register 
or an immediate value: 


¢ If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset 
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit 
mode). This allows any bit position to be selected. 


° If the bit base operand specifies a memory location, the operand represents the address of the byte in memory 
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be 
referenced by the offset operand depends on the operand size. 


See also: Bit(BitBase, BitOffset) on page 3-11. 


Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina- 
tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on 
this addressing mechanism. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


CF := Bit(BitBase, BitOffset); 
Bit(BitBase, BitOffset) := 0; 


Flags Affected 


The CF flag contains the value of the selected bit before it is cleared. The ZF flag is unaffected. The OF, SF, AF, and 
PF flags are undefined. 
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Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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BTS—Bit Test and Set 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 

OF AB /r BTS r/m16, r16 MR | Valid Valid Store selected bit in CF flag and set. 
OF AB /r BTS r/m32, r32 MR | Valid Valid Store selected bit in CF flag and set. 
REX.W + OF AB /r BTS r/m64, r64 MR | Valid N.E. Store selected bit in CF flag and set. 
OF BA /5 ib BTS r/m16, imm8 MI Valid Valid Store selected bit in CF flag and set. 
OF BA/5 ib BTS r/m32, imm8& MI Valid Valid Store selected bit in CF flag and set. 
REX.W + OF BA/5 ib BTS r/m64, imm8& MI | Valid N.E. Store selected bit in CF flag and set. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
MI ModRM:r/m (r, w) imm8 NA NA 
Description 


Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by 

the bit offset operand (second operand), stores the value of the bit in the CF flag, and sets the selected bit in the 

bit string to 1. The bit base operand can be a register or a memory location; the bit offset operand can be a register 

or an immediate value: 

° If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset 
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit 
mode). This allows any bit position to be selected. 


° If the bit base operand specifies a memory location, the operand represents the address of the byte in memory 
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be 
referenced by the offset operand depends on the operand size. 


See also: Bit(BitBase, BitOffset) on page 3-11. 


Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina- 
tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on 
this addressing mechanism. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


CF := Bit(BitBase, BitOffset); 
Bit(BitBase, BitOffset) := 1; 


Flags Affected 


The CF flag contains the value of the selected bit before it is set. The ZF flag is unaffected. The OF, SF, AF, and PF 
flags are undefined. 
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Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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BZHI — Zero High Bits Starting with Specified Bit Position 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode | Flag 
VEX.LZ.0F38.W0 F5 /r RMV | V/V BMI2 Zero bits in r/m32 starting with the position in r32b, write result to 
BZHI r32a, r/m32, r32b r32a. 
VEX.LZ.0F38.W1 F5 /r RMV | V/N.E. BMI2 Zero bits in r/m64 starting with the position in r64b, write result to 
BZHI r64a, r/m64, r64b r64a. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMV ModRM:reg (w) ModRM:r/m (r) VEX.vvvv (r) NA 
Description 


BZHI copies the bits of the first source operand (the second operand) into the destination operand (the first 
operand) and clears the higher bits in the destination according to the INDEX value specified by the second source 
operand (the third operand). The INDEX is specified by bits 7:0 of the second source operand. The INDEX value is 
saturated at the value of OperandSize -1. CF is set, if the number contained in the 8 low bits of the third operand 
is greater than OperandSize -1. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An 
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 

N := SRC2[7:0] 

DEST := SRC1 

IF (N < OperandSize) 
DEST[OperandSize-1:N] := 0 

Fl 

IF (N > OperandSize - 1) 
CF := 1 

ELSE 


Fl 


Flags Affected 
ZF, CF and SF flags are updated based on the result. OF flag is cleared. AF and PF flags are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
BZHI: unsigned __int32 _bzhi_u32(unsigned __int32 src, unsigned __int32 index); 


BZHI: unsigned __int64_bzhi_u64(unsigned __int64 src, unsigned __int32 index); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 

E8 cw CALL rel16 D NS. Valid Call near, relative, displacement relative to next 
instruction. 

E8 cd CALL re/32 D Valid Valid Call near, relative, displacement relative to next 
instruction. 32-bit displacement sign extended to 
64-bits in 64-bit mode. 

FF /2 CALL r/m16 M N.E. Valid Call near, absolute indirect, address given in r/m16. 

FF /2 CALL r/m32 M N.E. Valid Call near, absolute indirect, address given in r/m32. 

FF /2 CALL r/m64 M Valid N.E. Call near, absolute indirect, address given in r/m64. 

9A cd CALL ptr16:16 D Invalid Valid Call far, absolute, address given in operand. 

SA cp CALL ptr16:32 D Invalid Valid Call far, absolute, address given in operand. 

FF /3 CALL m16:16 M Valid Valid Call far, absolute indirect address given in m76:76. 
In 32-bit mode: if selector points to a gate, then RIP 
= 32-bit zero extended displacement taken from 
gate; else RIP = zero extended 16-bit offset from 
far pointer referenced in the instruction. 

FF /3 CALL m16:32 M Valid Valid In 64-bit mode: If selector points to a gate, then RIP 
= 64-bit displacement taken from gate; else RIP = 
zero extended 32-bit offset from far pointer 
referenced in the instruction. 

REX.W FF /3 CALL m16:64 M Valid N.E. In 64-bit mode: If selector points to a gate, then RIP 
= 64-bit displacement taken from gate; else RIP = 
64-bit offset from far pointer referenced in the 
instruction. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
D Offset NA NA NA 
M ModRM:r/m (r) NA NA NA 
Description 


Saves procedure linking information on the stack and branches to the called procedure specified using the target 
operand. The target operand specifies the address of the first instruction in the called procedure. The operand can 
be an immediate value, a general-purpose register, or a memory location. 


This instruction can be used to execute four types of calls: 


¢ Near Call — A call to a procedure in the current code segment (the segment currently pointed to by the CS 
register), sometimes referred to as an intra-segment call. 


¢ Far Call — A call to a procedure located in a different segment than the current code segment, sometimes 


referred to as an inter-segment call. 


¢ Inter-privilege-level far call — A far call to a procedure in a segment at a different privilege level than that 
of the currently executing program or procedure. 


* Task switch — A call to a procedure located in a different task. 


The latter two call types (inter-privilege-level call and task switch) can only be executed in protected mode. See 
“Calling Procedures Using Call and RET” in Chapter 6 of the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 1, for additional information on near, far, and inter-privilege-level calls. See Chapter 7, 
“Task Management,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for infor- 
mation on performing task switches with the CALL instruction. 
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Near Call. When executing a near call, the processor pushes the value of the EIP register (which contains the offset 
of the instruction following the CALL instruction) on the stack (for use later as a return-instruction pointer). The 
processor then branches to the address in the current code segment specified by the target operand. The target 
operand specifies either an absolute offset in the code segment (an offset from the base of the code segment) ora 
relative offset (a signed displacement relative to the current value of the instruction pointer in the EIP register; this 
value points to the instruction following the CALL instruction). The CS register is not changed on near calls. 


For a near call absolute, an absolute offset is specified indirectly in a general-purpose register or a memory location 
(r/m16, r/m32, or r/m64). The operand-size attribute determines the size of the target operand (16, 32 or 64 
bits). When in 64-bit mode, the operand size for near call (and all near branches) is forced to 64-bits. Absolute 
offsets are loaded directly into the EIP(RIP) register. If the operand size attribute is 16, the upper two bytes of the 
EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits. When accessing an absolute 
offset indirectly using the stack pointer [ESP] as the base register, the base value used is the value of the ESP 
before the instruction executes. 


A relative offset (re/16 or re/32) is generally specified as a label in assembly code. But at the machine code level, it 
is encoded as a signed, 16- or 32-bit immediate value. This value is added to the value in the EIP(RIP) register. In 
64-bit mode the relative offset is always a 32-bit immediate value which is sign extended to 64-bits before it is 
added to the value in the RIP register for the target calculation. As with absolute offsets, the operand-size attribute 
determines the size of the target operand (16, 32, or 64 bits). In 64-bit mode the target operand will always be 64- 
bits because the operand size is forced to 64-bits for near branches. 


Far Calls in Real-Address or Virtual-8086 Mode. When executing a far call in real- address or virtual-8086 mode, the 
processor pushes the current value of both the CS and EIP registers on the stack for use as a return-instruction 
pointer. The processor then performs a “far branch” to the code segment and offset specified with the target 
operand for the called procedure. The target operand specifies an absolute far address either directly with a pointer 
(ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). With the pointer method, the 
segment and offset of the called procedure is encoded in the instruction using a 4-byte (16-bit operand size) or 6- 
byte (32-bit operand size) far address immediate. With the indirect method, the target operand specifies a memory 
location that contains a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address. The operand-size 
attribute determines the size of the offset (16 or 32 bits) in the far address. The far address is loaded directly into 
the CS and EIP registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared. 


Far Calls in Protected Mode. When the processor is operating in protected mode, the CALL instruction can be used to 
perform the following types of far calls: 


¢ Far call to the same privilege level 
¢ Far call to a different privilege level (inter-privilege level call) 
¢ Task switch (far call to another task) 


In protected mode, the processor always uses the segment selector part of the far address to access the corre- 
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access 
rights determine the type of call operation to be performed. 


If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is 
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming, 
a general-protection exception is generated.) A far call to the same privilege level in protected mode is very similar 
to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far address either 
directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or mM16:32). The 
operand- size attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment 
selector and its descriptor are loaded into CS register; the offset from the instruction is loaded into the EIP register. 


A call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the same 
privilege level. Using this mechanism provides an extra level of indirection and is the preferred method of making 
calls between 16-bit and 32-bit code segments. 


When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed 
through a call gate. The segment selector specified by the target operand identifies the call gate. The target 
operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly 
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code 
segment and the new instruction pointer (offset) from the call gate descriptor. (The offset from the target operand 
is ignored when a call gate is used.) 
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On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The 
segment selector for the new stack segment is specified in the TSS for the currently running task. The branch to the 
new code segment occurs after the stack switch. (Note that when using a call gate to perform a far call toa 
segment at the same privilege level, no stack switch occurs.) On the new stack, the processor pushes the segment 
selector and stack pointer for the calling procedure’s stack, an optional set of parameters from the calling proce- 
dures stack, and the segment selector and instruction pointer for the calling procedure’s code segment. (A value in 
the call gate descriptor determines how many parameters to copy to the new stack.) Finally, the processor 
branches to the address of the procedure being called within the new code segment. 


Executing a task switch with the CALL instruction is similar to executing a call through a call gate. The target 
operand specifies the segment selector of the task gate for the new task activated by the switch (the offset in the 
target operand is ignored). The task gate in turn points to the TSS for the new task, which contains the segment 
selectors for the task’s code and stack segments. Note that the TSS also contains the EIP value for the next instruc- 
tion that was to be executed before the calling task was suspended. This instruction pointer value is loaded into the 
EIP register to re-start the calling task. 


The CALL instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of 
the task gate. See Chapter 7, “Task Management,” in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3A, for information on the mechanics of a task switch. 


When you execute at task switch with a CALL instruction, the nested task flag (NT) is set in the EFLAGS register and 
the new TSS‘s previous task link field is loaded with the old task’s TSS selector. Code is expected to suspend this 
nested task by executing an IRET instruction which, because the NT flag is set, automatically uses the previous task 
link to return to the calling task. (See “Task Linking” in Chapter 7 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A, for information on nested tasks.) Switching tasks with the CALL instruction differs 
in this regard from JMP instruction. JMP does not set the NT flag and therefore does not expect an IRET instruction 
to suspend the task. 


Mixing 16-Bit and 32-Bit Calls. When making far calls between 16-bit and 32-bit code segments, use a call gate. If 
the far call is from a 32-bit code segment to a 16-bit code segment, the call should be made from the first 64 
KBytes of the 32-bit code segment. This is because the operand-size attribute of the instruction is set to 16, so only 
a 16-bit return address offset can be saved. Also, the call should be made using a 16-bit call gate so that 16-bit 
values can be pushed on the stack. See Chapter 20, “Mixing 16-Bit and 32-Bit Code,” in the Inte/® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 3B, for more information. 


Far Calls in Compatibility Mode. When the processor is operating in compatibility mode, the CALL instruction can be 
used to perform the following types of far calls: 


¢ Far call to the same privilege level, remaining in compatibility mode 
¢ Far call to the same privilege level, transitioning to 64-bit mode 
¢ Far call to a different privilege level (inter-privilege level call), transitioning to 64-bit mode 


Note that a CALL instruction can not be used to cause a task switch in compatibility mode since task switches are 
not supported in IA-32e mode. 


In compatibility mode, the processor always uses the segment selector part of the far address to access the corre- 
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine 
the type of call operation to be performed. 


If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is 
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming, 
a general-protection exception is generated.) A far call to the same privilege level in compatibility mode is very 
similar to one carried out in protected mode. The target operand specifies an absolute far address either directly 
with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). The operand-size 
attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment selector and its 
descriptor are loaded into CS register and the offset from the instruction is loaded into the EIP register. The differ- 
ence is that 64-bit mode may be entered. This specified by the L bit in the new code segment descriptor. 


Note that a 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code 
segment at the same privilege level. However, using this mechanism requires that the target code segment 
descriptor have the L bit set, causing an entry to 64-bit mode. 


When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed 
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target 
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operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly 
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code 
segment and the new instruction pointer (offset) from the 16-byte call gate descriptor. (The offset from the target 
operand is ignored when a call gate is used.) 


On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The 
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the 
currently running task. The branch to the new code segment occurs after the stack switch. (Note that when using 
a call gate to perform a far call to a segment at the same privilege level, an implicit stack switch occurs as a result 
of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use a segment base of 0x0, 
the limit is ignored, and the default stack size is 64-bits. The full value of RSP is used for the offset, of which the 
upper 32-bits are undefined.) On the new stack, the processor pushes the segment selector and stack pointer for 
the calling procedure’s stack and the segment selector and instruction pointer for the calling procedure’s code 
segment. (Parameter copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the 
procedure being called within the new code segment. 


Near/(Far) Calls in 64-bit Mode. When the processor is operating in 64-bit mode, the CALL instruction can be used to 
perform the following types of far calls: 


¢ Far call to the same privilege level, transitioning to compatibility mode 
¢ Far call to the same privilege level, remaining in 64-bit mode 
¢ Far call to a different privilege level (inter-privilege level call), remaining in 64-bit mode 


Note that in this mode the CALL instruction can not be used to cause a task switch in 64-bit mode since task 
switches are not supported in IA-32e mode. 


In 64-bit mode, the processor always uses the segment selector part of the far address to access the corresponding 
descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine the type 
of call operation to be performed. 


If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is 
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming, 
a general-protection exception is generated.) A far call to the same privilege level in 64-bit mode is very similar to 
one carried out in compatibility mode. The target operand specifies an absolute far address indirectly with a 
memory location (m16:16, m16:32 or m16:64). The form of CALL with a direct specification of absolute far 
address is not defined in 64-bit mode. The operand-size attribute determines the size of the offset (16, 32, or 64 
bits) in the far address. The new code segment selector and its descriptor are loaded into the CS register; the offset 
from the instruction is loaded into the EIP register. The new code segment may specify entry either into compati- 
bility or 64-bit mode, based on the L bit value. 


A 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the 
same privilege level. However, using this mechanism requires that the target code segment descriptor have the L 
bit set. 


When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed 
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target 
operand can only specify the call gate segment selector indirectly with a memory location (m16:16, m16:32 or 
m16:64). The processor obtains the segment selector for the new code segment and the new instruction pointer 
(offset) from the 16-byte call gate descriptor. (The offset from the target operand is ignored when a call gate is 
used.) 


On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The 
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the 
currently running task. The branch to the new code segment occurs after the stack switch. 


Note that when using a call gate to perform a far call to a segment at the same privilege level, an implicit stack 
switch occurs as a result of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use 
a segment base of 0x0, the limit is ignored, and the default stack size is 64-bits. (The full value of RSP is used for 
the offset.) On the new stack, the processor pushes the segment selector and stack pointer for the calling proce- 
dure’s stack and the segment selector and instruction pointer for the calling procedure’s code segment. (Parameter 
copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the procedure being called 
within the new code segment. 
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Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Tech- 
nology (CET)” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET details. 


Instruction ordering. Instructions following a far call may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the far call have 
completed execution (the later instructions may execute before data stored by the earlier instructions have become 


globally visible). 


Certain situations may lead to the next sequential instruction after a near indirect CALL being speculatively 
executed. If software needs to prevent this (e.g., in order to prevent a speculative execution side channel), then an 
LFENCE instruction opcode can be placed after the near indirect CALL in order to block speculative execution. 


Operation 


IF near call 


THEN IF near relative call 


THEN 


IF OperandSize = 64 


Fl; 


THEN 


tempDEST := SignExtend(DEST); (* DEST is rel32 *) 

tempRIP := RIP + tempDEST; 

IF stack not large enough for a 8-byte return address 
THEN #SS(0); Fl; 

Push(RIP); 

IF ShadowStackEnabled(CPL) AND DEST != 0 
ShadowStackPush8B(RIP); 

Fl; 

RIP := tempRIP; 


IF OperandSize = 32 


Fl; 


THEN 


tempEIP := EIP + DEST; (* DEST is re/32*) 

IF tempEIP is not within code segment limit THEN #GP(0); Fl; 

IF stack not large enough for a 4-byte return address 
THEN #SS(0); FI; 

Push(EIP); 

IF ShadowStackEnabled(CPL) AND DEST != 0 
ShadowStackPush4B(EIP); 

Fl; 

EIP := tempEIP; 


IF OperandSize = 16 


Fl; 


THEN 


tempElP := (EIP + DEST) AND OOOOFFFFH; (* DEST is re/76 *) 

IF tempEIP is not within code segment limit THEN #GP(0); Fl; 

IF stack not large enough for a 2-byte return address 
THEN #SS(0); Fl; 

Push(IP); 

IF ShadowStackEnabled(CPL) AND DEST != 0 
(* IP is zero extended and pushed as a 32 bit value on shadow stack *) 
ShadowStackPush4B(IP); 

FI; 

EIP := tempEIP; 


ELSE (* Near absolute call *) 
IF OperandSize = 64 


3-142 Vol. 2A 


CALL—Call Procedure 


INSTRUCTION SET REFERENCE, A-L 


THEN 
tempRIP := DEST; (* DEST is r/m64 *) 
IF stack not large enough for a 8-byte return address 
THEN #SS(0); Fl; 
Push(RIP); 
IF ShadowStackEnabled(CPL) 
ShadowStackPush8B(RIP); 
Fl; 
RIP := tempRIP; 
Fl; 
IF OperandSize = 32 
THEN 
tempEIP := DEST; (* DEST is r/m32 *) 
IF tempEIP is not within code segment limit THEN #GP(0); Fl; 
IF stack not large enough for a 4-byte return address 
THEN #SS(0); Fl; 
Push(EIP); 
IF ShadowStackEnabled(CPL) 
ShadowStackPush4B(EIP); 
Fl; 
EIP := tempEIP; 
Fl; 
IF OperandSize = 16 
THEN 
tempEIP := DEST AND OOOOFFFFH; (* DEST is r/m76 *) 
IF tempEIP is not within code segment limit THEN #GP(0); Fl; 
IF stack not large enough for a 2-byte return address 
THEN #SS(0); Fl; 
Push(IP); 
IF ShadowStackEnabled(CPL) 
(* IP is zero extended and pushed as a 32 bit value on shadow stack *) 
ShadowStackPush4B(IP); 
Fl; 
EIP := tempEIP; 
Fl; 
Fl;rel/abs 
IF (Call near indirect, absolute indirect) 
IF EndbranchEnabledAndNotSuppressed(CPL) 


IF CPL = 3 
THEN 
IF (no 3EH prefix OR IA32_U_CET.NO_TRACK_EN == 0 ) 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 
Fl; 
ELSE 
IF (no 3EH prefix OR IA32_S_CET.NO_TRACK_EN == 0 ) 
THEN 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
Fl; 
Fl; 
Fl; 
Fl; 
Fl; near 
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IF far call and (PE = O or (PE = 1 and VM = 1)) (* Real-address or virtual-8086 mode *) 


THEN 
IF OperandSize = 32 
THEN 
IF stack not large enough for a 6-byte return address 
THEN #SS(0); FI; 
IF DEST[31:16] is not zero THEN #GP(0); Fl; 
Push(CS); (* Padded with 16 high-order bits *) 
Push(EIP); 
CS := DEST[47:32]; (* DEST is ptr76:32 or [m16:32] *) 
EIP := DEST[31:0]; (* DEST is ptr76:32 or [m16:32] *) 
ELSE (* OperandSize = 16 *) 
IF stack not large enough for a 4-byte return address 
THEN #SS(0); FI; 
Push(CS); 
Push(IP); 
CS := DEST[31:16]; (* DEST is ptr76:16 or [m16:76] *) 
EIP := DEST[15:0]; (* DEST is ptr76:76 or [m16:16]; clear upper 16 bits *) 
Fl; 


Fl; 


IF far call and (PE = 1 and VM = 0) (* Protected mode or IA-32e Mode, not virtual-8086 mode*) 
THEN 
IF segment selector in target operand NULL 
THEN #GP(0); FI; 
IF segment selector index not within descriptor table limits 
THEN #GP(new code segment selector); Fl; 
Read type and access rights of selected segment descriptor; 
IF IA32_EFER.LMA = 0 
THEN 
IF segment type is not a conforming or nonconforming code segment, call 
gate, task gate, or TSS 
THEN #GP(segment selector); Fl; 
ELSE 
IF segment type is not a conforming or nonconforming code segment or 
64-bit call gate, 
THEN #GP(segment selector); Fl; 
Fl; 
Depending on type and access rights: 
GO TO CONFORMING-CODE-SEGMENT; 
GO TO NONCONFORMING-CODE-SEGMENT; 
GO TO CALL-GATE; 
GO TO TASK-GATE; 
GO TO TASK-STATE-SEGMENT; 
Fl; 


CONFORMING-CODE-SEGMENT: 
IF L bit = 1 and D bit = 1 and IA32_EFER.LMA = 1 
THEN GP(new code segment selector); FI; 
IF DPL > CPL 
THEN #GP(new code segment selector); FI; 
IF segment not present 
THEN #NP(new code segment selector); Fl; 
IF stack not large enough for return address 
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THEN #SS(0); FI; 
tempEIP := DEST(Offset); 
IF target mode = Compatibility mode 
THEN tempEIP := tempEIP AND OOO000000_FFFFFFFFH; FI; 
IF OperandSize = 16 
THEN 
tempEIP := tempEIP AND OOOOFFFFH; FI; (* Clear upper 16 bits *) 
IF ([A32_EFER.LMA = O or target mode = Compatibility mode) and (tempEIP outside new code segment limit) 
THEN #GP(0); Fl; 
IF tempElP is non-canonical 
THEN #GP(0); Fl; 
IF ShadowStackEnabled(CPL) 
IF OperandSize = 32 


THEN 
tempPushLIP = CSBASE + EIP; 
ELSE 
IF OperandSize = 16 
THEN 
tempPushLIP = CSBASE + IP; 
ELSE (* OperandSize = 64 *) 
tempPushLIP = RIP; 
Fl; 
Fl; 
tempPushCS = CS; 
Fl; 
IF OperandSize = 32 
THEN 
Push(CS); (* Padded with 16 high-order bits *) 
Push(EIP); 
CS := DEST(CodeSegmentSelector); 
(* Segment descriptor information also loaded *) 
CS(RPL) := CPL; 
EIP := tempEIP; 
ELSE 
IF OperandSize = 16 
THEN 
Push(CS); 
Push(IP); 
CS := DEST(CodeSegmentSelector); 
(* Segment descriptor information also loaded *) 
CS(RPL) := CPL; 
EIP := tempEIP; 
ELSE (* OperandSize = 64 *) 
Push(CS); (* Padded with 48 high-order bits *) 
Push(RIP); 
CS := DEST(CodeSegmentSelector); 
(* Segment descriptor information also loaded *) 
CS(RPL) := CPL; 
RIP := tempElP; 
Fl; 
Fl; 


IF ShadowStackEnabled(CPL) 
IF (IA32_EFER.LMA and DEST(CodeSegmentSelector).L) = 0 
(* If target is legacy or compatibility mode then the SSP must be in low 4GB *) 
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IF (SSP & OxFFFFFFFFOOO00000 != 0) 
THEN #GP(0); Fl; 

FI; 
(* align to 8 byte boundary if not already aligned *) 
tempSSP = SSP; 
Shadow_stack_store 4 bytes of 0 to (SSP - 4) 
SSP = SSP & OxFFFFFFFFFFFFFFF8H 
ShadowStackPush8B(tempPushCs); (* Padded with 48 high-order bits of O *) 
ShadowStackPush8B(tempPushLIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(tempSSP); 


Fl; 
IF EndbranchEnabled(CPL) 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 
FI; 
Fl; 
END; 


NONCONFORMING-CODE-SEGMENT: 
IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1 
THEN GP(new code segment selector); Fl; 
IF (RPL > CPL) or (DPL # CPL) 
THEN #GP(new code segment selector); Fl; 
IF segment not present 
THEN #NP(new code segment selector); FI; 
IF stack not large enough for return address 
THEN #SS(0); Fl; 
tempEIP := DEST(Offset); 
IF target mode = Compatibility mode 
THEN tempElP := tempEIP AND OOO00000_FFFFFFFFH; FI; 
IF OperandSize = 16 
THEN temp€lP := tempElIP AND OOOOFFFFH; FI; (* Clear upper 16 bits *) 
IF (IA32_EFER.LMA = O or target mode = Compatibility mode) and (tempEIP outside new code segment limit) 
THEN #GP(0); Fl; 
IF tempEIP is non-canonical 
THEN #GP(0); Fl; 
IF ShadowStackEnabled(CPL) 
IF IA32_EFER.LMA & CS.L 
tempPushLIP = RIP 
ELSE 
tempPushLIP = CSBASE + EIP; 


Fl; 
tempPusnCs = CS; 
Fl; 
IF OperandSize = 32 
THEN 
Push(CS); (* Padded with 16 high-order bits *) 
Push(EIP); 


CS := DEST(CodeSegmentSelector); 
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(* Segment descriptor information also loaded *) 


CS(RPL) := CPL; 
EIP := tempEIP; 
ELSE 
IF OperandSize = 16 
THEN 
Push(CS); 
Push(IP); 


CS := DEST(CodeSegmentSelector); 
(* Segment descriptor information also loaded *) 


CS(RPL) := CPL; 
EIP := tempElP; 
ELSE (* OperandSize = 64 *) 


Push(CS); (* Padded with 48 high-order bits *) 


Push(RIP); 


CS := DEST(CodeSegmentSelector); 
(* Segment descriptor information also loaded *) 


CS(RPL) := CPL; 
RIP := tempElP; 
Fl; 
Fl; 
IF ShadowStackEnabled(CPL) 


IF (IA32_EFER.LMA and DEST(CodeSegmentSelector).L) = 0 
(* If target is legacy or compatibility mode then the SSP must be in low 4GB *) 
IF (SSP & OxFFFFFFFFOOO00000 != 0) 


THEN #GP(0); Fl; 
Fl; 


(* align to 8 byte boundary if not already aligned *) 


tempSSP = SSP; 


Shadow_stack_store 4 bytes of 0 to (SSP - 4) 


SSP = SSP & OxFFFFFFFFFFFFFFFBH 


ShadowStackPush8B(tempPushCS); (* Padded with 48 high-order 0 bits *) 
ShadowStackPush8B(tempPushLIP); (* Padded 32 high-order bits of O for 32 bit LIP*) 


ShadowStackPush8B(tempSSP); 
Fl; 
IF EndbranchEnabled(CPL) 
IF CPL = 3 
THEN 


IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 


IA32_U_CET.SUPPRESS = 0 
ELSE 


IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 


IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 
END; 


CALL-GATE: 
IF call gate (DPL < CPL) or (RPL > DPL) 
THEN #GP(call-gate selector); Fl; 
IF call gate not present 
THEN #NP(call-gate selector); FI; 
IF call-gate code-segment selector is NULL 
THEN #GP(0); Fl; 
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IF call-gate code-segment selector index is outside descriptor table limits 
THEN #GP(call-gate code-segment selector); FI; 

Read call-gate code-segment descriptor; 

IF call-gate code-segment descriptor does not indicate a code segment 

or call-gate code-segment descriptor DPL > CPL 
THEN #GP(call-gate code-segment selector); FI; 

IF IA32_EFER.LMA = 1 AND (call-gate code-segment descriptor is 

not a 64-bit code segment or call-gate code-segment descriptor has both L-bit and D-bit set) 
THEN #GP(call-gate code-segment selector); FI; 

IF call-gate code segment not present 
THEN #NP(call-gate code-segment selector); Fl; 

IF call-gate code segment is non-conforming and DPL < CPL 
THEN go to MORE-PRIVILEGE; 
ELSE go to SAME-PRIVILEGE; 

Fl; 

END; 


MORE-PRIVILEGE: 
IF current TSS is 32-bit 
THEN 
TSSstackAddress := (new code-segment DPL * 8) + 4; 
IF (TSSstackAddress + 5) > current TSS limit 
THEN #TS(current TSS selector); Fl; 
NewsSS := 2 bytes loaded from (TSS base + TSSstackAddress + 4); 
NewESP := 4 bytes loaded from (TSS base + TSSstackAddress); 
ELSE 
IF current TSS is 16-bit 
THEN 
TSSstackAddress := (new code-segment DPL * 4) + 2 
IF (TSSstackAddress + 3) > current TSS limit 
THEN #TS(current TSS selector); Fl; 
NewsSS := 2 bytes loaded from (TSS base + TSSstackAddress + 2); 
NewESP := 2 bytes loaded from (TSS base + TSSstackAddress); 
ELSE (* current TSS is 64-bit *) 
TSSstackAddress := (new code-segment DPL * 8) + 4; 
IF (TSSstackAddress + 7) > current TSS limit 
THEN #TS(current TSS selector); Fl; 
NewSS := new code-segment DPL; (* NULL selector with RPL = new CPL *) 
NewRSP := 8 bytes loaded from (current TSS base + TSSstackAddress); 
FI; 
Fl; 
IF IA32_EFER.LMA = 0 and NewSS is NULL 
THEN #TS(NewSS); Fl; 
Read new stack-segment descriptor; 
IF IA32_EFER.LMA = 0 and (NewSS RPL # new code-segment DPL 
or new stack-segment DPL # new code-segment DPL or new stack segment is not a 
writable data segment) 
THEN #TS(NewSS); FI 
IF [A32_EFER.LMA = 0 and new stack segment not present 
THEN #SS(NewsSS); FI; 
IF CallGateSize = 32 
THEN 
IF new stack does not have room for parameters plus 16 bytes 
THEN #SS(NewSS); Fl; 


3-148 Vol. 2A CALL—Call Procedure 


INSTRUCTION SET REFERENCE, A-L 


IF CallGate(InstructionPointer) not within new code-segment limit 
THEN #GP(0); Fl; 
SS := newSS; (* Segment descriptor information also loaded *) 
ESP := newESP; 
CS:EIP := CallGate(CS:InstructionPointer); 
(* Segment descriptor information also loaded *) 
Push(oldSS:oldESP); (* From calling procedure *) 
temp := parameter count from call gate, masked to 5 bits; 
Push(parameters from calling procedure’s stack, temp) 
Push(oldCS:oldEIP); (* Return address to calling procedure *) 
ELSE 
IF CallGateSize = 16 
THEN 
IF new stack does not have room for parameters plus 8 bytes 
THEN #SS(NewSS); Fl; 
IF (CallGate(InstructionPointer) AND FFFFH) not in new code-segment limit 
THEN #GP(0); Fl; 
SS := newSS; (* Segment descriptor information also loaded *) 
ESP := newESP; 
CS:IP := CallGate(CS:InstructionPointer); 
(* Segment descriptor information also loaded *) 
Push(oldSS:oldESP); (* From calling procedure *) 
temp := parameter count from call gate, masked to 5 bits; 
Push(parameters from calling procedure’s stack, temp) 
Push(oldCS:oldEIP); (* Return address to calling procedure *) 
ELSE (* CallGateSize = 64 *) 
IF pushing 32 bytes on the stack would use a non-canonical address 
THEN #SS(NewSS); Fl; 
IF (CallGate(InstructionPointer) is non-canonical) 
THEN #GP(0); Fl; 
SS := NewSS; (* NewSS is NULL) 
RSP := NewESP; 
CS:IP := CallGate(CS:InstructionPointer); 
(* Segment descriptor information also loaded *) 
Push(oldSS:oldESP); (* From calling procedure *) 
Push(oldCS:oldEIP); (* Return address to calling procedure *) 
Fl; 
Fl; 
IF ShadowStackEnabled(CPL) AND CPL = 3 
THEN 
IF IA32_EFER.LMA = 0 
THEN IA32_PL3_SSP := SSP; 
ELSE (* adjust so bits 63:N get the value of bit N-1, where N is the CPU’s maximum linear-address width *) 
IA32_PL3_SSP := LA_adjust(SSP); 
Fl; 
Fl; 
CPL := CodeSegment(DPL) 
CS(RPL) := CPL 
IF ShadowStackEnabled(CPL) 
oldSSP := SSP 
SSP := IA32_PLi_SSP; (* where i is the CPL *) 
IF SSP & 0x07 != 0 (* if SSP not aligned to 8 bytes then #GP *) 
THEN #GP(0); Fl; 
(* Token and CS:LIP:oldSSP pushed on shadow stack must be contained in a naturally aligned 32-byte region*) 
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IF (SSP & ~Ox1F) != ((SSP - 24) & ~Ox1F) 
#GP(0); FI; 
IF ((IA32_EFER.LMA and CS.L) = 0 AND SSP[63:32] != 0) 
THEN #GP(0); FI; 
expected_token_value = SSP (* busy bit - bit position O - must be clear *) 
new_token_value = SSP | BUSY_BIT (* Set the busy bit *) 
IF shadow_stack_lock_cmpxchg8b(SSP, new_token_value, expected_token_value) != expected_token_value 
THEN #GP(0); FI; 
IF oldSS.DPL != 3 
(* These stack pushes should not cause faults, VM exits, or data breakpoints *) 
(* Such events will apply to the earlier accesses to the token, which is in the same naturally aligned 32-byte region *) 
ShadowStackPush8B(oldCS); (* Padded with 48 high-order bits of O *) 
ShadowStackPush8B(oldCSBASE+oldRIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(oldSSP); 
Fl; 
Fl; 
IF EndbranchEnabled (CPL) 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 
Fl; 
END; 


SAME-PRIVILEGE: 
IF CallGateSize = 32 
THEN 
IF stack does not have room for 8 bytes 
THEN #SS(0); Fl; 
IF CallGate(InstructionPointer) not within code segment limit 
THEN #GP(0); Fl; 
CS:EIP := CallGate(CS:EIP) (* Segment descriptor information also loaded *) 
Push(oldCS:oldEIP); (* Return address to calling procedure *) 
ELSE 
If CallGateSize = 16 
THEN 
IF stack does not have room for 4 bytes 
THEN #SS(0); Fl; 
IF CallGate(InstructionPointer) not within code segment limit 
THEN #GP(0); Fl; 
CS:IP := CallGate(CS:instruction pointer); 
(* Segment descriptor information also loaded *) 
Push(oldCS:oldIP); (* Return address to calling procedure *) 
ELSE (* CallGateSize = 64) 
IF pushing 16 bytes on the stack touches non-canonical addresses 
THEN #SS(0); Fl; 
IF RIP non-canonical 
THEN #GP(0); Fl; 
CS:IP := CallGate(CS:instruction pointer); 
(* Segment descriptor information also loaded *) 
Push(oldCS:oldIP); (* Return address to calling procedure *) 
FI; 
Fl; 
CS(RPL) := CPL 
IF ShadowStackEnabled(CPL) 
(* Align to next 8 byte boundary *) 
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tempSSP = SSP; 

Shadow_stack_store 4 bytes of 0 to (SSP - 4) 

SSP = SSP & OxFFFFFFFFFFFFFFF8H; 

(* push cs:lip:ssp on shadow stack *) 

ShadowStackPush8B(oldCS); (* Padded with 48 high-order bits of 0 *) 
ShadowStackPush8B(oldCSBASE + oldRIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(tempSSP); 


Fl; 
IF EndbranchEnabled (CPL) 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 
END; 
TASK-GATE: 


IF task gate DPL < CPL or RPL 
THEN #GP(task gate selector); FI; 
IF task gate not present 
THEN #NP(task gate selector); Fl; 
Read the TSS segment selector in the task-gate descriptor; 
IF TSS segment selector local/global bit is set to local 
or index not within GDT limits 
THEN #GP(TSS selector); Fl; 
Access TSS descriptor in GDT; 
IF descriptor is not a TSS segment 
THEN #GP(TSS selector); Fl; 
IF TSS descriptor specifies that the TSS is busy 
THEN #GP(TSS selector); Fl; 
IF TSS not present 
THEN #NP(TSS selector); Fl; 
SWITCH-TASKS (with nesting) to TSS; 
IF EIP not within code segment limit 
THEN #GP(0); Fl; 
END; 


TASK-STATE-SEGMENT: 
IF TSS DPL < CPL or RPL 
or TSS descriptor indicates TSS not available 
THEN #GP(TSS selector); Fl; 
IF TSS is not present 
THEN #NP(TSS selector); Fl; 
SWITCH-TASKS (with nesting) to TSS; 
IF EIP not within code segment limit 
THEN #GP(0); Fl; 
END; 
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Flags Affected 


All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur. 


Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


#SS(0) 


#SS(selector) 


#NP(selector) 
#TS(selector) 
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If the target offset in destination operand is beyond the new code segment limit. 

If the segment selector in the destination operand is NULL. 

If the code segment selector in the gate is NULL. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If target mode is compatibility mode and SSP is not in low 4GB. 
If SSP in IA32_PLi_SSP (where i is the new CPL) is not 8 byte aligned. 


If the token and the stack frame to be pushed on shadow stack are not contained in a naturally 
aligned 32-byte region of the shadow stack. 


If “supervisor Shadow Stack” token on new shadow stack is marked busy. 


If destination mode is 32-bit or compatibility mode, but SSP address in “supervisor shadow 
stack” token is beyond 4GB. 


If SSP address in “supervisor shadow stack” token does not match SSP address in 
IA32_PLi_SSP (where i is the new CPL). 


If a code segment or gate or TSS selector index is outside descriptor table limits. 


If the segment descriptor pointed to by the segment selector in the destination operand is not 
for a conforming-code segment, nonconforming-code segment, call gate, task gate, or task 
state segment. 


If the DPL for a nonconforming-code segment is not equal to the CPL or the RPL for the 
segment’s segment selector is greater than the CPL. 


If the DPL for a conforming-code segment is greater than the CPL. 


If the DPL from a call-gate, task-gate, or TSS segment descriptor is less than the CPL or than 
the RPL of the call-gate, task-gate, or TSS’s segment selector. 


If the segment descriptor for a segment selector from a call gate does not indicate it is a code 
segment. 


If the segment selector from a call gate is beyond the descriptor table limits. 

If the DPL for a code-segment obtained from a call gate is greater than the CPL. 
If the segment selector for a TSS has its local/global bit set for local. 

If a TSS segment descriptor specifies that the TSS is busy or not available. 


If pushing the return address, parameters, or stack segment pointer onto the stack exceeds 
the bounds of the stack segment, when no stack switch occurs. 


If a memory operand effective address is outside the SS segment limit. 


If pushing the return address, parameters, or stack segment pointer onto the stack exceeds 
the bounds of the stack segment, when a stack switch occurs. 


If the SS register is being loaded as part of a stack switch and the segment pointed to is 
marked not present. 


If stack segment does not have room for the return address, parameters, or stack segment 
pointer, when stack switch occurs. 


If a code segment, data segment, call gate, task gate, or TSS is not present. 
If the new stack segment selector and ESP are beyond the end of the TSS. 
If the new stack segment selector is NULL. 


If the RPL of the new stack segment selector in the TSS is not equal to the DPL of the code 
segment being accessed. 


If DPL of the stack segment descriptor for the new stack segment is not equal to the DPL of the 
code segment descriptor. 
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If the new stack segment is not a writable data segment. 
If segment-selector index for stack segment is outside descriptor table limits. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the target offset is beyond the code segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the target offset is beyond the code segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 

Same exceptions as in protected mode. 

#GP(selector) If a memory address accessed by the selector is in non-canonical space. 
#GP(0) If the target offset in the destination operand is non-canonical. 


64-Bit Mode Exceptions 
#GP(0) If a memory address is non-canonical. 
If target offset in destination operand is non-canonical. 
If the segment selector in the destination operand is NULL. 
If the code segment selector in the 64-bit gate is NULL. 
If target mode is compatibility mode and SSP is not in low 4GB. 
If SSP in IA32_PLi_SSP (where i is the new CPL) is not 8 byte aligned. 


If the token and the stack frame to be pushed on shadow stack are not contained in a naturally 
aligned 32-byte region of the shadow stack. 


If “supervisor Shadow Stack” token on new shadow stack is marked busy. 


If destination mode is 32-bit mode or compatibility mode, but SSP address in “super-visor 
shadow” stack token is beyond 4GB. 


If SSP address in “supervisor shadow stack” token does not match SSP address in 
IA32_PLi_SSP (where i is the new CPL). 


#GP(selector) If code segment or 64-bit call gate is outside descriptor table limits. 
If code segment or 64-bit call gate overlaps non-canonical space. 


If the segment descriptor pointed to by the segment selector in the destination operand is not 
for a conforming-code segment, nonconforming-code segment, or 64-bit call gate. 


If the segment descriptor pointed to by the segment selector in the destination operand is a 
code segment and has both the D-bit and the L- bit set. 


If the DPL for a nonconforming-code segment is not equal to the CPL, or the RPL for the 
segment’s segment selector is greater than the CPL. 


If the DPL for a conforming-code segment is greater than the CPL. 
If the DPL from a 64-bit call-gate is less than the CPL or than the RPL of the 64-bit call-gate. 
If the upper type field of a 64-bit call gate is not 0x0. 
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If the segment selector from a 64-bit call gate is beyond the descriptor table limits. 
If the DPL for a code-segment obtained from a 64-bit call gate is greater than the CPL. 


If the code segment descriptor pointed to by the selector in the 64-bit gate doesn't have the L- 
bit set and the D-bit clear. 


If the segment descriptor for a segment selector from the 64-bit call gate does not indicate it 
is a code segment. 


#SS(0) If pushing the return offset or CS selector onto the stack exceeds the bounds of the stack 
segment when no stack switch occurs. 


If a memory operand effective address is outside the SS segment limit. 
If the stack address is in a non-canonical form. 


#SS(selector) If pushing the old values of SS selector, stack pointer, EFLAGS, CS selector, offset, or error 
code onto the stack violates the canonical boundary when a stack switch occurs. 

#NP(selector) If a code segment or 64-bit call gate is not present. 

#TS(selector) If the load of the new RSP exceeds the limit of the TSS. 

#UD (64-bit mode only) If a far call is direct to an absolute address in memory. 


If the LOCK prefix is used. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
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CBW/CWDE/CDQE—Convert Byte to Word/Convert Word to Doubleword/Convert Doubleword to 
Quadword 


Opcode Instruction Op/ | 64-bit Compat/ |Description 

En |Mode Leg Mode 
98 CBW ZO | Valid Valid AX := sign-extend of AL. 
98 CWDE ZO ‘| Valid Valid EAX := sign-extend of AX. 
REX.W + 98 CDQE ZO ‘| Valid N.E. RAX := sign-extend of EAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Double the size of the source operand by means of sign extension. The CBW (convert byte to word) instruction 
copies the sign (bit 7) in the source operand into every bit in the AH register. The CWDE (convert word to double- 
word) instruction copies the sign (bit 15) of the word in the AX register into the high 16 bits of the EAX register. 


CBW and CWDE reference the same opcode. The CBW instruction is intended for use when the operand-size attri- 
bute is 16; CWDE is intended for use when the operand-size attribute is 32. Some assemblers may force the 
operand size. Others may treat these two mnemonics as synonyms (CBW/CWDE) and use the setting of the 
operand-size attribute to determine the size of values to be converted. 


In 64-bit mode, the default operation size is the size of the destination register. Use of the REX.W prefix promotes 
this instruction (CDQE when promoted) to operate on 64-bit operands. In which case, CDQE copies the sign (bit 
31) of the doubleword in the EAX register into the high 32 bits of RAX. 


Operation 


IF OperandSize = 16 (* Instruction = CBW *) 
THEN 
AX := SignExtend(AL); 
ELSE IF (OperandSize = 32, Instruction = CWDE) 
EAX := SignExtend(AX); Fl; 
ELSE (* 64-Bit Mode, OperandSize = 64, Instruction = CDQE*) 
RAX := SignExtend(EAX); 
FI; 


Flags Affected 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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CLAC—Clear AC Flag in EFLAGS Register 


Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
NP OF 01 CA ZO VIV SMAP Clear the AC flag in the EFLAGS register. 
CLAC 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Clears the AC flag bit in EFLAGS register. This disables any alignment checking of user-mode data accesses. Ifthe 
SMAP bit is set in the CR4 register, this disallows explicit supervisor-mode data accesses to user-mode pages. 


This instruction's operation is the same in non-64-bit modes and 64-bit mode. Attempts to execute CLAC when 
CPL > 0 cause #UD. 


Operation 


EFLAGS.AC := 0; 


Flags Affected 
AC cleared. Other flags are unaffected. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


Virtual-8086 Mode Exceptions 
#UD The CLAC instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 
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Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
F8 CLC ZO | Valid Valid Clear CF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Clears the CF flag in the EFLAGS register. Operation is the same in all modes. 


Operation 


CF := 0; 


Flags Affected 


The CF flag is set to 0. The OF, ZF, SF, AF, and PF flags are unaffected. 


Exceptions (All Operating Modes) 


#UD 


CLC—Clear Carry Flag 


If the LOCK prefix is used. 
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CLD—Clear Direction Flag 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
FC CLD ZO | Valid Valid Clear DF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Clears the DF flag in the EFLAGS register. When the DF flag is set to 0, string operations increment the index regis- 
ters (ESI and/or EDI). Operation is the same in all modes. 


Operation 


DF := 0; 


Flags Affected 
The DF flag is set to 0. The CF, OF, ZF, SF, AF, and PF flags are unaffected. 


Exceptions (All Operating Modes) 


#UD 
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CLDEMOTE—Cache Line Demote 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature Flag 
Support 
NP OF 1C/0 A VV CLDEMOTE Hint to hardware to move the cache line containing m8 to a 
CLDEMOTE m8 more distant level of the cache without writing back to mem- 
ory. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
A ModRM:r/m (w) NA NA NA 
Description 


Hints to hardware that the cache line that contains the linear address specified with the memory operand should be 
moved (“demoted”) from the cache(s) closest to the processor core to a level more distant from the processor 
core. This may accelerate subsequent accesses to the line by other cores in the same coherence domain, especially 
if the line was written by the core that demotes the line. Moving the line in such a manner is a performance optimi- 
zation, i.e., it is a hint which does not modify architectural state. Hardware may choose which level in the cache 
hierarchy to retain the line (e.g., L3 in typical server designs). The source operand is a byte memory location. 


The availability of the CLDEMOTE instruction is indicated by the presence of the CPUID feature flag CLDEMOTE (bit 
25 of the ECX register in sub-leaf 07H, see “CPUID—CPU Identification”). On processors which do not support the 
CLDEMOTE instruction (including legacy hardware) the instruction will be treated as a NOP. 


A CLDEMOTE instruction is ordered with respect to stores to the same cache line, but unordered with respect to 
other instructions including memory fences, CLDEMOTE, CLWB or CLFLUSHOPT instructions to a different cache 
line. Since CLDEMOTE will retire in order with respect to stores to the same cache line, software should ensure that 
after issuing CLDEMOTE the line is not accessed again immediately by the same core to avoid cache data move- 
ment penalties. 


The effective memory type of the page containing the affected line determines the effect; cacheable types are 
likely to generate a data movement operation, while uncacheable types may cause the instruction to be ignored. 


Speculative fetching can occur at any time and is not tied to instruction execution. The CLDEMOTE instruction is not 
ordered with respect to PREFETCHh instructions or any of the speculative fetching mechanisms. That is, data can 
be speculatively loaded into a cache line just before, during, or after the execution of a CLDEMOTE instruction that 
references the cache line. 


Unlike CLFLUSH, CLFLUSHOPT and CLWB instructions, CLDEMOTE is not guaranteed to write back modified data to 
memory. 


The CLDEMOTE instruction may be ignored by hardware in certain cases and is not a guarantee. 

The CLDEMOTE instruction can be used at all privilege levels. In certain processor implementations the CLDEMOTE 
instruction may set the A bit but not the D bit in the page tables. 

If the line is not found in the cache, the instruction will be treated as a NOP. 

In some implementations, the CLDEMOTE instruction may always cause a transactional abort with Transactional 


Synchronization Extensions (TSX). However, programmers must not rely on CLDEMOTE instruction to force a 
transactional abort. 


1. The Mod field of the ModR/M byte cannot have value 11B. 
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Operation 
Cache_Line_Demote(m8); 


Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 
CLDEMOTE void _cldemote(const void*); 


Protected Mode Exceptions 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 
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CLFLUSH—Flush Cache Line 


Opcode / Op/ | 64-bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF AE /7 M Valid Valid Flushes cache line containing m8. 
CLFLUSH m8 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Invalidates from every level of the cache hierarchy in the cache coherence domain the cache line that contains the 
linear address specified with the memory operand. If that cache line contains modified data at any level of the 
cache hierarchy, that data is written back to memory. The source operand is a byte memory location. 


The availability of CLFLUSH is indicated by the presence of the CPUID feature flag CLFSH 
(CPUID.01H:EDX[bit 19]). The aligned cache line size affected is also indicated with the CPUID instruction (bits 8 
through 15 of the EBX register when the initial value in the EAX register is 1). 


The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It 
should be noted that processors are free to speculatively fetch and cache data from system memory regions 
assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types). PREFETCHA 
instructions can be used to provide the processor with hints for this speculative behavior. Because this speculative 
fetching can occur at any time and is not tied to instruction execution, the CLFLUSH instruction is not ordered with 
respect to PREFETCHA instructions or any of the speculative fetching mechanisms (that is, data can be specula- 
tively loaded into a cache line just before, during, or after the execution of a CLFLUSH instruction that references 
the cache line). 


Executions of the CLFLUSH instruction are ordered with respect to each other and with respect to writes, locked 
read-modify-write instructions, and fence instructions.! They are not ordered with respect to executions of 
CLFLUSHOPT and CLWB. Software can use the SFENCE instruction to order an execution of CLFLUSH relative to one 
of those operations. 


The CLFLUSH instruction can be used at all privilege levels and is subject to all permission checking and faults asso- 
ciated with a byte load (and in addition, a CLFLUSH instruction is allowed to flush a linear address in an execute- 
only segment). Like a load, the CLFLUSH instruction sets the A bit but not the D bit in the page tables. 


In some implementations, the CLFLUSH instruction may always cause transactional abort with Transactional 
Synchronization Extensions (TSX). The CLFLUSH instruction is not expected to be commonly used inside typical 
transactional regions. However, programmers must not rely on CLFLUSH instruction to force a transactional abort, 
since whether they cause transactional abort is implementation dependent. 


The CLFLUSH instruction was introduced with the SSE2 extensions; however, because it has its own CPUID feature 
flag, it can be implemented in IA-32 processors that do not include the SSE2 extensions. Also, detecting the pres- 
ence of the SSE2 extensions with the CPUID instruction does not guarantee that the CLFLUSH instruction is imple- 
mented in the processor. 


CLFLUSH operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


Flush_Cache_Line(SRC); 


Intel C/C++ Compiler Intrinsic Equivalents 
CLFLUSH: void _mm_clflush(void const *p) 


1. Earlier versions of this manual specified that executions of the CLFLUSH instruction were ordered only by the MFENCE instruction. 
All processors implementing the CLFLUSH instruction also order it relative to the other operations enumerated above. 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 

#PF(fault-code) For a page fault. 

#UD If CPUID.01H:EDX.CLFSH[bit 19] = 0. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If any part of the operand lies outside the effective address space from 0 to FFFFH. 
#UD If CPUID.01H:EDX.CLFSH[bit 19] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 
#PF(fault-code) For a page fault. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) For a page fault. 

#UD If CPUID.01H:EDX.CLFSH[bit 19] = 0. 


If the LOCK prefix is used. 
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CLFLUSHOPT—Flush Cache Line Optimized 


Opcode / Op/ | 64-bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NFx 66 OF AE /7 M Valid Valid Flushes cache line containing m8. 
CLFLUSHOPT m8 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Invalidates from every level of the cache hierarchy in the cache coherence domain the cache line that contains the 
linear address specified with the memory operand. If that cache line contains modified data at any level of the 
cache hierarchy, that data is written back to memory. The source operand is a byte memory location. 


The availability of CLFLUSHOPT is indicated by the presence of the CPUID feature flag CLFLUSHOPT 
(CPUID.(EAX=7,ECX=0):EBX[bit 23]). The aligned cache line size affected is also indicated with the CPUID instruc- 
tion (bits 8 through 15 of the EBX register when the initial value in the EAX register is 1). 


The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It 
should be noted that processors are free to speculatively fetch and cache data from system memory regions 
assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types). PREFETCHA 
instructions can be used to provide the processor with hints for this speculative behavior. Because this speculative 
fetching can occur at any time and is not tied to instruction execution, the CLFLUSH instruction is not ordered with 
respect to PREFETCHA instructions or any of the speculative fetching mechanisms (that is, data can be specula- 
tively loaded into a cache line just before, during, or after the execution of a CLFLUSH instruction that references 
the cache line). 


Executions of the CLFLUSHOPT instruction are ordered with respect to fence instructions and to locked read- 
modify-write instructions; they are also ordered with respect to older writes to the cache line being invalidated. 
They are not ordered with respect to other executions of CLFLUSHOPT, to executions of CLFLUSH and CLWB, or to 
younger writes to the cache line being invalidated. Software can use the SFENCE instruction to order an execution 
of CLFLUSHOPT relative to one of those operations. 


The CLFLUSHOPT instruction can be used at all privilege levels and is subject to all permission checking and faults 
associated with a byte load (and in addition, a CLFLUSHOPT instruction is allowed to flush a linear address in an 
execute-only segment). Like a load, the CLFLUSHOPT instruction sets the A bit but not the D bit in the page tables. 


In some implementations, the CLFLUSHOPT instruction may always cause transactional abort with Transactional 
Synchronization Extensions (TSX). The CLFLUSHOPT instruction is not expected to be commonly used inside 
typical transactional regions. However, programmers must not rely on CLFLUSHOPT instruction to force a transac- 
tional abort, since whether they cause transactional abort is implementation dependent. 


CLFLUSHOPT operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


Flush_Cache_Line_Optimized(SRC); 


Intel C/C++ Compiler Intrinsic Equivalents 
CLFLUSHOPT void _mm_clflushopt(void const *p) 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 

#PF(fault-code) For a page fault. 

#UD If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0. 


If the LOCK prefix is used. 
If an instruction prefix F2H or F3H is used. 


Real-Address Mode Exceptions 
#GP If any part of the operand lies outside the effective address space from 0 to FFFFH. 
#UD If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0. 

If the LOCK prefix is used. 

If an instruction prefix F2H or F3H is used. 


Virtual-8086 Mode Exceptions 


Same exceptions as in real address mode. 
#PF(fault-code) For a page fault. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) For a page fault. 

#UD If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0. 


If the LOCK prefix is used. 
If an instruction prefix F2H or F3H is used. 
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CLI — Clear Interrupt Flag 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
FA CLI ZO | Valid Valid Clear interrupt flag; interrupts disabled when 
interrupt flag cleared. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


In most cases, CLI clears the IF flag in the EFLAGS register and no other flags are affected. Clearing the IF flag 
causes the processor to ignore maskable external interrupts. The IF flag and the CLI and STI instruction have no 
effect on the generation of exceptions and NMI interrupts. 


Operation is different in two modes defined as follows: 
¢ PVI mode (protected-mode virtual interrupts): CRO.PE = 1, EFLAGS.VM = 0, CPL = 3, and CR4.PVI = 1; 
¢ VME mode (virtual-8086 mode extensions): CRO.PE = 1, EFLAGS.VM = 1, and CR4.VME = 1. 


If IOPL < 3 and either VME mode or PVI mode is active, CLI clears the VIF flag in the EFLAGS register, leaving IF 
unaffected. 


Table 3-7 indicates the action of the CLI instruction depending on the processor operating mode, IOPL, and CPL. 


Table 3-7. Decision Table for CLI Results 


Mode IOPL CLI Result 
Real-address x! IF=0 
>CPL IF=0 
Protected, not Pvie 
<CPL #GP fault 
3 IF=0 
Protected, Pvp 
0-2 VIF = 0 
3 IF=0 
Virtual-8086, not VME? 
0-2 #GP fault 
3 IF=0 
Virtual-8086, VME3 
0-2 VIF = 0 


NOTES: 

1. X = This setting has no effect on instruction operation. 

2. For this table, “protected mode” applies whenever CRO.PE = 1 and EFLAGS.VM = 0; it includes compatibility mode and 64-bit mode. 
3. PVI mode and virtual-8086 mode each imply CPL = 3. 
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Operation 


IF CRO.PE = 0 
THEN IF := 0; (* Reset Interrupt Flag *) 
ELSE 
IF IOPL > CPL (* CPL = 3 if EFLAGS.VM = 1 *) 
THEN IF := 0; (* Reset Interrupt Flag *) 
ELSE 
IF VME mode OR PVI mode 
THEN VIF := 0; (* Reset Virtual Interrupt Flag *) 
ELSE #GP(0); 
FI; 
FI; 
FI; 


Flags Affected 
Either the IF flag or the VIF flag is cleared to 0. Other flags are unaffected. 


Protected Mode Exceptions 


#GP(0) If CPL is greater than IOPL and PVI mode is not active. 


If CPL is greater than IOPL and less than 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) If IOPL is less than 3 and VME mode is not active. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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CLRSSBSY—Clear Busy Flag in a Supervisor Shadow Stack Token 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF AE /6 M VIV CET_SS Clear busy flag in supervisor shadow stack token 
CLRSSBSY m64 reference by m64. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
M NA ModRM:r/m (r, w) NA NA NA 
Description 


Clear busy flag in supervisor shadow stack token reference by m64. Subsequent to marking the shadow stack as 
not busy the SSP is loaded with value 0. 


Operation 


IF (CR4.CET = 0) 
THEN #UD; Fl; 


IF (IA32_S_CET.SH_STK_EN = 0) 
THEN #UD; Fl; 


IF CPL>O 
THEN GP(0); Fl; 


SSP_LA = Linear_Address(mem operand) 

IF SSP_LA not aligned to 8 bytes 
THEN #GP(0); Fl; 

expected_token_value = SSP_LA|BUSY_BIT (* busy bit - bit position O - must be set *) 

new_token_value = SSP_LA (* Clear the busy bit *) 

IF shadow_stack_lock_cmpxchg8b(SSP_LA, new_token_value, expected_token_value) != expected_token_value 
invalid_token := 1; Fl 


(* Set the CF if invalid token was detected *) 

RFLAGS.CF = (invalid_token == 1)? 1 : 0; 

RFLAGS.ZF,PF,AF,OF,SF := 0; 

SSP := 0 

Flags Affected 

CF is set if an invalid token was detected, else it is cleared. ZF, PF, AF, OF, and SF are cleared. 
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Protected Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
IF IA32_S_CET.SH_STK_EN = 0. 
#GP(0) If memory operand linear address not aligned to 8 bytes. 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If destination is located in a non-writeable segment. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If CPL is not 0. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 


Real-Address Mode Exceptions 
#UD The CLRSSBSY instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The CLRSSBSY instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 

#UD Same exceptions as in protected mode. 
#GP(0) Same exceptions as in protected mode. 
#PF(fault-code) If a page fault occurs. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
IF IA32_S_CET.SH_STK_EN = 0. 
#GP(0) If memory operand linear address not aligned to 8 bytes. 


If CPL is not 0. 

If the memory address is in a non-canonical form. 

If token is invalid. 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 
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CLTS—Clear Task-Switched Flag in CRO 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
OF 06 CLTS ZO | Valid Valid Clears TS flag in CRO. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Clears the task-switched (TS) flag in the CRO register. This instruction is intended for use in operating-system 
procedures. Itis a privileged instruction that can only be executed at a CPL of 0. It is allowed to be executed in real- 
address mode to allow initialization for protected mode. 


The processor sets the TS flag every time a task switch occurs. The flag is used to synchronize the saving of FPU 
context in multitasking applications. See the description of the TS flag in the section titled “Control Registers” in 
Chapter 2 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information 
about this flag. 


CLTS operation is the same in non-64-bit modes and 64-bit mode. 
See Chapter 24, “VMX Non-Root Operation,” of the Inte/® 64 and IA-32 Architectures Software Developer’s 


Manual, Volume 3C, for more information about the behavior of this instruction in VMX non-root operation. 
Operation 
CRO.TS[bit 3] := 0; 


Flags Affected 
The TS flag in CRO register is cleared. 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) CLTS is not recognized in virtual-8086 mode. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(0) If the CPL is greater than 0. 
#UD If the LOCK prefix is used. 
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CLWB—Cache Line Write Back 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature Flag 
Support 
66 OF AE /6 M VIV CLWB Writes back modified cache line containing m8, and may 
CLWB m8 retain the line in cache hierarchy in non-modified state. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Writes back to memory the cache line (if modified) that contains the linear address specified with the memory 
operand from any level of the cache hierarchy in the cache coherence domain. The line may be retained in the 
cache hierarchy in non-modified state. Retaining the line in the cache hierarchy is a performance optimization 
(treated as a hint by hardware) to reduce the possibility of cache miss on a subsequent access. Hardware may 
choose to retain the line at any of the levels in the cache hierarchy, and in some cases, may invalidate the line from 
the cache hierarchy. The source operand is a byte memory location. 


The availability of CLWB instruction is indicated by the presence of the CPUID feature flag CLWB (bit 24 of the EBX 
register, see “CPUID — CPU Identification” in this chapter). The aligned cache line size affected is also indicated 
with the CPUID instruction (bits 8 through 15 of the EBX register when the initial value in the EAX register is 1). 


The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It 
should be noted that processors are free to speculatively fetch and cache data from system memory regions that 
are assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types). 
PREFETCHh instructions can be used to provide the processor with hints for this speculative behavior. Because this 
speculative fetching can occur at any time and is not tied to instruction execution, the CLWB instruction is not 
ordered with respect to PREFETCHh instructions or any of the speculative fetching mechanisms (that is, data can 
be speculatively loaded into a cache line just before, during, or after the execution of a CLWB instruction that refer- 
ences the cache line). 


Executions of the CLWB instruction are ordered with respect to fence instructions and to locked read-modify-write 
instructions; they are also ordered with respect to older writes to the cache line being written back. They are not 
ordered with respect to other executions of CLWB, to executions of CLFLUSH and CLFLUSHOPT, or to younger 
writes to the cache line being written back. Software can use the SFENCE instruction to order an execution of CLWB 
relative to one of those operations. 


For usages that require only writing back modified data from cache lines to memory (do not require the line to be 
invalidated), and expect to subsequently access the data, software is recommended to use CLWB (with appropriate 
fencing) instead of CLFLUSH or CLFLUSHOPT for improved performance. 


The CLWB instruction can be used at all privilege levels and is subject to all permission checking and faults associ- 
ated with a byte load. Like a load, the CLWB instruction sets the accessed flag but not the dirty flag in the page 
tables. 


In some implementations, the CLWB instruction may always cause transactional abort with Transactional Synchro- 
nization Extensions (TSX). CLWB instruction is not expected to be commonly used inside typical transactional 
regions. However, programmers must not rely on CLWB instruction to force a transactional abort, since whether 
they cause transactional abort is implementation dependent. 


Operation 
Cache_Line_Write_Back(m8); 


1. The Mod field of the ModR/M byte cannot have value 11B. 
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Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 
CLWB void _mm_clwb(void const *p); 


Protected Mode Exceptions 


#UD If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0. 
#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 


#PF(fault-code) For a page fault. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0. 
#GP If any part of the operand lies outside the effective address space from 0 to FFFFH. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 
#PF(fault-code) For a page fault. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 

If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0. 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 


#PF(fault-code) For a page fault. 
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CMC—Complement Carry Flag 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
F5 CMC ZO | Valid Valid Complement CF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Complements the CF flag in the EFLAGS register. CMC operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


EFLAGS.CF[bit 0] := NOT EFLAGS.CF[bit 0]; 


Flags Affected 


The CF flag contains the complement of its original value. The OF, ZF, SF, AF, and PF flags are unaffected. 


Exceptions (All Operating Modes) 
If the LOCK prefix is used. 


#UD 
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CMOVcc—Conditional Move 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 47 /r CMOVA r16, r/m16 RM | Valid Valid Move if above (CF=0 and ZF=0). 
OF 47 /r CMOVA r32, r/m32 RM _ | Valid Valid Move if above (CF=0 and ZF=0). 
REX.W + OF 47 /r CMOVA r64, r/m64 RM_ | Valid N.E. Move if above (CF=0 and ZF=0). 
OF 43 /r CMOVAE 76, r/m16 RM_ | Valid Valid Move if above or equal (CF=0). 
OF 43 /r CMOVAE r32, r/m32 RM_ | Valid Valid Move if above or equal (CF=0). 
REX.W + OF 43 /r CMOVAE r64, r/m64 RM | Valid N.E. Move if above or equal (CF=0). 
OF 42 /r CMOVB r16, r/m16 RM _ | Valid Valid Move if below (CF=1). 
OF 42 /r CMOVB r32, r/m32 RM_ | Valid Valid Move if below (CF=1). 
REX.W + OF 42 /r CMOVB r64, r/m64 RM_ | Valid N.E. Move if below (CF=1). 
OF 46 /r CMOVBE r716, r/m16 RM_ | Valid Valid Move if below or equal (CF=1 or ZF=1). 
OF 46 /r CMOVBE r32, r/m32 RM_ | Valid Valid Move if below or equal (CF=1 or ZF=1). 
REX.W + OF 46 /r CMOVBE r64, r/m64 RM_ | Valid N.E. Move if below or equal (CF=1 or ZF=1). 
OF 42 /r CMOVC 16, r/m16 RM | Valid Valid Move if carry (CF=1). 
OF 42 /r CMOVC r32, r/m32 RM | Valid Valid Move if carry (CF=1). 
REX.W + OF 42 /r CMOVC r64, r/m64 RM_ | Valid N.E. Move if carry (CF=1). 
OF 44 /r CMOVE r76, r/m16 RM_ | Valid Valid Move if equal (ZF=1). 
OF 44 /r CMOVE r32, r/m32 RM _ | Valid Valid Move if equal (ZF=1). 
REX.W + OF 44 /r CMOVE r64, r/m64 RM_ | Valid N.E. Move if equal (ZF=1). 
OF 4F /r CMOVG r16, r/m16 RM _ | Valid Valid Move if greater (ZF=0 and SF=OF). 
OF 4F /r CMOVG r32, r/m32 RM _ | Valid Valid Move if greater (ZF=0 and SF=OF). 
REX.W + OF 4F /r CMOVG 164, r/m64 RM | V/N.E. NA Move if greater (ZF=0 and SF=OF). 
OF 4D /r CMOVGE r16, r/m16 RM _ | Valid Valid Move if greater or equal (SF=OF). 
OF 4D /r CMOVGE r32, r/m32 RM_ | Valid Valid Move if greater or equal (SF=OF). 
REX.W + OF 4D /r CMOVGE r64, r/m64 RM _ | Valid N.E. Move if greater or equal (SF=OF). 
OF 4C /r CMOVL r16, r/m16 RM_ | Valid Valid Move if less (SF# OF). 
OF 4C /r CMOVL r32, r/m32 RM_ | Valid Valid Move if less (SF# OF). 
REX.W + OF 4C /r CMOVL r64, r/m64 RM_ | Valid N.E. Move if less (SF# OF). 
OF 4E /r CMOVLE r16, r/m16 RM | Valid Valid Move if less or equal (ZF=1 or SF# OF). 
OF 4E /r CMOVLE r32, r/m32 RM | Valid Valid Move if less or equal (ZF=1 or SF# OF). 
REX.W + OF 4€ /r CMOVLE r64, r/m64 RM | Valid N.E. Move if less or equal (ZF=1 or SF# OF). 
OF 46 /r CMOVNA r16, r/m16 RM | Valid Valid Move if not above (CF=1 or ZF=1). 
OF 46 /r CMOVNA r32, r/m32 RM _ | Valid Valid Move if not above (CF=1 or ZF=1). 
REX.W + OF 46 /r CMOVNA r64, r/m64 RM _ | Valid N.E. Move if not above (CF=1 or ZF=1). 
OF 42 /r CMOVNAE r16, r/m16 RM | Valid Valid Move if not above or equal (CF=1). 
OF 42 /r CMOVNAE r32, r/m32 RM _ | Valid Valid Move if not above or equal (CF=1). 
REX.W + OF 42 /r CMOVNAE r64, r/m64 RM_ | Valid N.E. Move if not above or equal (CF=1). 
OF 43 /r CMOVNB r76, r/m16 RM _ | Valid Valid Move if not below (CF=0). 
OF 43 /r CMOVNB r32, r/m32 RM _ | Valid Valid Move if not below (CF=0). 
REX.W + OF 43 /r CMOVNB r64, r/m64 RM_ | Valid N.E. Move if not below (CF=0). 
OF 47 /r CMOVNBE r16, r/m16 RM_ | Valid Valid Move if not below or equal (CF=0 and ZF=0). 
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Opcode Instruction Op/ |64-Bit |Compat/ |Description 
En |Mode Leg Mode 
OF 47 /r CMOVNBE r32, r/m32 RM | Valid Valid Move if not below or equal (CF=0 and ZF=0). 
REX.W + OF 47 /r CMOVNBE r64, r/m64 RM | Valid N.E. Move if not below or equal (CF=0 and ZF=0). 
OF 43 /r CMOVNC r76, r/m16 RM _ | Valid Valid Move if not carry (CF=0). 
OF 43 /r CMOVNC r32, r/m32 RM | Valid Valid Move if not carry (CF=0). 
REX.W + OF 43 /r CMOVNC r64, r/m64 RM | Valid N.E. Move if not carry (CF=0). 
OF 45 /r CMOVNE r76, r/m16 RM | Valid Valid Move if not equal (ZF=0). 
OF 45 /r CMOVNE r32, r/m32 RM | Valid Valid Move if not equal (ZF=0). 
REX.W + OF 45 /r CMOVNE r64, r/m64 RM_ | Valid N.E. Move if not equal (ZF=0). 
OF 4€ /r CMOVNG r76, r/m16 RM | Valid Valid Move if not greater (ZF=1 or SF4 OF). 
OF 4€ /r CMOVNG r32, r/m32 RM | Valid Valid Move if not greater (ZF=1 or SFA OF). 
REX.W + OF 4€ /r CMOVNG r64, r/m64 RM _ | Valid N.E. Move if not greater (ZF=1 or SF4 OF). 
OF 4C /r CMOVNGE r76, r/m16 RM_ | Valid Valid Move if not greater or equal (SF# OF). 
OF 4C /r CMOVNGE r32, r/m32 RM _ | Valid Valid Move if not greater or equal (SF# OF). 
REX.W + OF 4C /r CMOVNGE r64, r/m64 RM _ | Valid N.E. Move if not greater or equal (SF# OF). 
OF 4D /r CMOVNL r76, r/m16 RM | Valid Valid Move if not less (SF=OF). 
OF 4D /r CMOVNL r32, r/m32 RM _ | Valid Valid Move if not less (SF=OF). 
REX.W + OF 4D /r CMOVNL r64, r/m64 RM_ | Valid N.E. Move if not less (SF=OF). 
OF 4F /r CMOVNLE r16, r/m16 RM _ | Valid Valid Move if not less or equal (ZF=0 and SF=OF). 
OF 4F /r CMOVNLE r32, r/m32 RM_ | Valid Valid Move if not less or equal (ZF=0 and SF=OF). 
REX.W + OF 4F /r CMOVNLE r64, r/m64 RM | Valid N.E. Move if not less or equal (ZF=0 and SF=OF). 
OF 41 /r CMOVNO r16, r/m16 RM _ | Valid Valid Move if not overflow (OF=0). 
OF 41 /r CMOVNO r32, r/m32 RM _ | Valid Valid Move if not overflow (OF=0). 
REX.W + OF 41 /r CMOVNO r64, r/m64 RM_ | Valid N.E. Move if not overflow (OF=0). 
OF 4B /r CMOVNP r16, r/m16 RM_ | Valid Valid Move if not parity (PF=0). 
OF 4B /r CMOVNP r32, r/m32 RM_ | Valid Valid Move if not parity (PF=0). 
REX.W + OF 4B /r CMOVNP r64, r/m64 RM_ | Valid N.E. Move if not parity (PF=0). 
OF 49 /r CMOVNS 16, r/m16 RM_ | Valid Valid Move if not sign (SF=0). 
OF 49 /r CMOVNS r32, r/m32 RM | Valid Valid Move if not sign (SF=0). 
REX.W + OF 49 /r CMOVNS r64, r/m64 RM_ | Valid N.E. Move if not sign (SF=0). 
OF 45 /r CMOVNZ r76, r/m16 RM_ | Valid Valid Move if not zero (ZF=0). 
OF 45 /r CMOVNZ r32, r/m32 RM_ | Valid Valid Move if not zero (ZF=0). 
REX.W + OF 45 /r CMOVNZ r64, r/m64 RM | Valid N.E. Move if not zero (ZF=0). 
OF 40 /r CMOVO r16, r/m16 RM | Valid Valid Move if overflow (OF=1). 
OF 40 /r CMOVO r32, r/m32 RM_ | Valid Valid Move if overflow (OF=1). 
REX.W + OF 40 /r CMOVO r64, r/m64 RM | Valid N.E. Move if overflow (OF=1). 
OF 4A /r CMOVP r16, r/m16 RM_ | Valid Valid Move if parity (PF=1). 
OF 4A /r CMOVP r32, r/m32 RM_ | Valid Valid Move if parity (PF=1). 
REX.W + OF 4A /r CMOVP r64, r/m64 RM_ | Valid N.E. Move if parity (PF=1). 
OF 4A /r CMOVPE r16, r/m16 RM _ | Valid Valid Move if parity even (PF=1). 
OF 4A /r CMOVPE r32, r/m32 RM | Valid Valid Move if parity even (PF=1). 
REX.W + OF 4A /r CMOVPE r64, r/m64 RM | Valid N.E. Move if parity even (PF=1). 
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Opcode Instruction Op/ |64-Bit |Compat/ | Description 
En |Mode Leg Mode 

OF 4B /r CMOVPO r16, r/m16 RM | Valid Valid Move if parity odd (PF=0). 

OF 4B /r CMOVPO r32, r/m32 RM | Valid Valid Move if parity odd (PF=0). 
REX.W + OF 4B /r CMOVPO 164, r/m64 RM | Valid N.E. Move if parity odd (PF=0). 

OF 48 /r CMOVS r16, r/m16 RM_ | Valid Valid Move if sign (SF=1). 

OF 48 /r CMOVS r32, r/m32 RM_ | Valid Valid Move if sign (SF=1). 

REX.W + OF 48 /r CMOVS r64, r/m64 RM _ | Valid N.E. Move if sign (SF=1). 

OF 44 /r CMOVZ 16, r/m16 RM _ | Valid Valid Move if zero (ZF=1). 

OF 44 /r CMOVZ 32, r/m32 RM _ | Valid Valid Move if zero (ZF=1). 

REX.W + OF 44 /r CMOVZ r64, r/m64 RM _ | Valid N.E. Move if zero (ZF=1). 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Each of the CMOVcc instructions performs a move operation if the status flags in the EFLAGS register (CF, OF, PF, 
SF, and ZF) are in a specified state (or condition). A condition code (cc) is associated with each instruction to indi- 
cate the condition being tested for. If the condition is not satisfied, a move is not performed and execution 
continues with the instruction following the CMOVcc instruction. 


Specifically, CMOVcc loads data from its source operand into a temporary register unconditionally (regardless of 
the condition code and the status flags in the EFLAGS register). If the condition code associated with the instruction 
(cc) is satisfied, the data in the temporary register is then copied into the instruction's destination operand. 


These instructions can move 16-bit, 32-bit or 64-bit values from memory to a general-purpose register or from one 
general-purpose register to another. Conditional moves of 8-bit register operands are not supported. 


The condition for each CMOVcc mnemonic is given in the description column of the above table. The terms “less” 
and “greater” are used for comparisons of signed integers and the terms “above” and “below” are used for 
unsigned integers. 


Because a particular state of the status flags can sometimes be interpreted in two ways, two mnemonics are 
defined for some opcodes. For example, the CMOVA (conditional move if above) instruction and the CMOVNBE 
(conditional move if not below or equal) instruction are alternate mnemonics for the opcode OF 47H. 


The CMOVcc instructions were introduced in P6 family processors; however, these instructions may not be 
supported by all IA-32 processors. Software can determine if the CMOVcc instructions are supported by checking 
the processor's feature information with the CPUID instruction (see “CPUID—CPU Identification” in this chapter). 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 
temp := SRC 


IF condition TRUE 
THEN DEST := temp; 

ELSE IF (OperandSize = 32 and IA-32e mode active) 
THEN DEST[63:32] := 0; 

Fl; 
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Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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CMP—Compare Two Operands 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
3C ib CMP AL, imm8& | Valid Valid Compare imm8 with AL. 
3D iw CMP AX, imm16 | Valid Valid Compare imm76 with AX. 
3D id CMP EAX, imm32 | Valid Valid Compare imm32 with EAX. 
REX.W + 3D id CMP RAX, imm32 | Valid N.E. Compare imm32 sign-extended to 64-bits 
with RAX. 
80 /7 ib CMP r/m8, imm8 MI | Valid Valid Compare imm8 with r/m8. 
REX + 80/7 ib CMP r/m8 , imm8 MI | Valid N.E. Compare imm8 with r/mé. 
81/7 iw CMP r/m16, imm16 MI | Valid Valid Compare imm176 with r/m16. 
81 /7 id CMP r/m32, imm32 MI | Valid Valid Compare imm32 with r/m32. 
REX.W + 81 /7 id CMP r/m64, imm32 MI | Valid N.E. Compare imm32 sign-extended to 64-bits 
with r/m64. 
83 /7 ib CMP r/m16, imm8& MI | Valid Valid Compare imm8 with r/m16. 
83 /7 ib CMP r/m32, imm8& MI | Valid Valid Compare imm8 with r/m32. 
REX.W + 83 /7 ib CMP r/m64, imm8& MI | Valid N.E. Compare imm8 with r/m64. 
38 /r CMP r/m&, r8 MR | Valid Valid Compare r8 with r/m8. 
REX + 38 /r CMP r/m8 , 8 MR | Valid N.E. Compare r8 with r/m8. 
39 /r CMP r/m16, r16 MR | Valid Valid Compare r76 with r/m16. 
39 /r CMP r/m32, r32 MR | Valid Valid Compare r32 with r/m32. 
REX.W + 39 /r CMP r/m64,r64 MR | Valid N.E. Compare r64 with r/m64. 
3A /r CMP r8, r/m8 RM | Valid Valid Compare r/m8 with r8. 
REX + 3A/r CMP 8, r/m& RM | Valid N.E. Compare r/m8 with rg. 
3B /r CMP r716, r/m16 RM | Valid Valid Compare r/m16 with r16. 
3B /r CMP r32, r/m32 RM | Valid Valid Compare r/m32 with r32. 
REX.W + 3B /r CMP r64, r/m64 RM | Valid N.E. Compare r/m64 with r64. 
NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
MR ModRM:r/m (r) ModRM:reg (r) NA NA 
MI ModRM:r/m (r) imm8/16/32 NA NA 
| AL/AX/EAX/RAX (r) imm8/16/32 NA NA 
Description 


Compares the first source operand with the second source operand and sets the status flags in the EFLAGS register 
according to the results. The comparison is performed by subtracting the second operand from the first operand 
and then setting the status flags in the same manner as the SUB instruction. When an immediate value is used as 
an operand, it is sign-extended to the length of the first operand. 


The condition codes used by the Jcc, CMOVcc, and SETcc instructions are based on the results of a CMP instruction. 
Appendix B, “EFLAGS Condition Codes,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1, shows the relationship of the status flags and the condition codes. 


CMP—Compare Two Operands Vol.2A 3-177 


INSTRUCTION SET REFERENCE, A-L 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 


temp := SRC1 — SignExtend(SRC2); 
ModifyStatusFlags; (* Modify status flags in the same manner as the SUB instruction”) 


Flags Affected 
The CF, OF, SF, ZF, AF, and PF flags are set according to the result. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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CMPPD—Compare Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
66 OF C2 /r ib A VIV SSE2 Compare packed double-precision floating-point values 
CMPPD xmm1, xmm2/m1 28, imm8 in xmm2/m128 and xmm_1 using bits 2:0 of imm8 as a 
comparison predicate. 
VEX.128.66.0F.WIG C2 /r ib B VIV AVX Compare packed double-precision floating-point values 
VCMPPD xmm1, xmm2, xmm3/m1 28, in xmm3/m128 and xmmcz using bits 4:0 of imm8 as a 
imm8 comparison predicate. 
VEX.256.66.0F.WIG C2 /r ib B VIV AVX Compare packed double-precision floating-point values 
VCMPPD ymm1, ymm2, ymm3/m256, in ymm3/m256 and ymmz using bits 4:0 of imm8 as a 
imm8 comparison predicate. 
EVEX.128.66.0F.W1 C2 /r ib C VIV AVX512VL | Compare packed double-precision floating-point values 
VCMPPD k1 {k2}, xmm2, AVX512F in xmm3/m128/m64bcst and xmm2z using bits 4:0 of 
xmm3/m128/m64bcst, imm8 imm8 as a comparison predicate with writemask k2 
and leave the result in mask register k1. 
EVEX.256.66.0F.W1 C2 /r ib C VIV AVX512VL | Compare packed double-precision floating-point values 
VCMPPD k1 {k2}, ymm2, AVX512F in ymm3/m256/m64bcst and ymmz using bits 4:0 of 
ymm3/m256/m64bcst, imm8 imm8 as a comparison predicate with writemask k2 
and leave the result in mask register k1. 
EVEX.512.66.0F.W1 C2 /r ib C VIV AVX512F Compare packed double-precision floating-point values 
VCMPPD k1 {k2}, zmm2, in zmm3/m512/m64bcst and zmmz using bits 4:0 of 
zmm3/m512/m64bcst{sae}, imm8 imm8 as a comparison predicate with writemask k2 
and leave the result in mask register k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Performs a SIMD compare of the packed double-precision floating-point values in the second source operand and 
the first source operand and returns the result of the comparison to the destination operand. The comparison pred- 
icate operand (immediate byte) specifies the type of comparison performed on each pair of packed values in the 
two source operands. 


EVEX encoded versions: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand (first operand) is an opmask register. 
Comparison results are written to the destination operand under the writemask k2. Each comparison result is a 
single mask bit of 1 (comparison true) or 0 (comparison false). 


VEX.256 encoded version: The first source operand (second operand) is a YMM register. The second source 
operand (third operand) can be a YMM register or a 256-bit memory location. The destination operand (first 
operand) is a YMM register. Four comparisons are performed with results written to the destination operand. The 
result of each comparison is a quadword mask of all 1s (comparison true) or all Os (comparison false). 


128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The 
second source operand (second operand) can be an XMM register or 128-bit memory location. Bits (MAXVL-1:128) 
of the corresponding ZMM destination register remain unchanged. Two comparisons are performed with results 
written to bits 127:0 of the destination operand. The result of each comparison is a quadword mask of all 1s 
(comparison true) or all Os (comparison false). 
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VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source 
operand (third operand) can be an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destina- 
tion ZMM register are zeroed. Two comparisons are performed with results written to bits 127:0 of the destination 
operand. 


The comparison predicate operand is an 8-bit immediate: 


¢ For instructions encoded using the VEX or EVEX prefix, bits 4:0 define the type of comparison to be performed 
(see Table 3-1). Bits 5 through 7 of the immediate are reserved. 


¢ For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see the 
first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved. 


Table 3-1. Comparison Predicate for CMPPD and CMPPS Instructions 


Predicate imm8 | Description Result: A Is 1st Operand, B Is 2nd Operand | Signals 
Value A>B  |A<B |/A=B_ |Unordered! ONAN 
EQ_00 (EQ) OH Equal (ordered, non-signaling) False False True False No 
LT_OS (LT) 1H Less-than (ordered, signaling) False True False False Yes 
LE_OS (LE) 2H Less-than-or-equal (ordered, signaling) False True True False Yes 
UNORD_Q (UNORD) | 3H Unordered (non-signaling) False False False True No 
NEQ_UQ (NEQ) 4H Not-equal (unordered, non-signaling) True True False True No 
NLT_US (NLT) 5H Not-less-than (unordered, signaling) True False True True Yes 
NLE_US (NLE) 6H Not-less-than-or-equal (unordered, signaling) | True False False True Yes 
ORD_Q (ORD) 7H Ordered (non-signaling) True True True False No 
EQ_UQ 8H Equal (unordered, non-signaling) False False True True No 
NGE_US (NGE) SH Not-greater-than-or-equal (unordered, False True False True Yes 
signaling) 
NGT_US (NGT) AH Not-greater-than (unordered, signaling) False True True True Yes 
FALSE_OQ(FALSE) | BH False (ordered, non-signaling) False False False False No 
NEQ_0Q CH Not-equal (ordered, non-signaling) True True False False No 
GE_OS (GE) DH Greater-than-or-equal (ordered, signaling) True False True False Yes 
GT_OS (GT) EH Greater-than (ordered, signaling) True False False False Yes 
TRUE_UQ(TRUE) FH True (unordered, non-signaling) True True True True No 
EQ_OS 10H Equal (ordered, signaling) False False True False Yes 
LT_0Q 11H | Less-than (ordered, nonsignaling) False True False False No 
LE_OQ 12H Less-than-or-equal (ordered, nonsignaling) False True True False No 
UNORD_S 13H | Unordered (signaling) False False False True Yes 
NEQ_US 14H Not-equal (unordered, signaling) True True False True Yes 
NLT_UQ 15H | Not-less-than (unordered, nonsignaling) True False True True No 
NLE_UQ 16H Not-less-than-or-equal (unordered, nonsig- True False False True No 
naling) 
ORD_S 17H | Ordered (signaling) True True True False Yes 
EQ_US 18H Equal (unordered, signaling) False False True True Yes 
NGE_UQ 19H Not-greater-than-or-equal (unordered, non- | False True False True No 
signaling) 
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Table 3-1. Comparison Predicate for CMPPD and CMPPS Instructions (Contd.) 


Predicate imm8 | Description Result: A Is 1st Operand, B Is 2nd Operand | Signals 
value A>B  |A<B |A=B_ [Unordered! ONAN 
NGT_UQ 1AH | Not-greater-than (unordered, nonsignaling) | False True True True No 
FALSE_OS 1BH _ | False (ordered, signaling) False False False False Yes 
NEQ_OS 1CH Not-equal (ordered, signaling) True True False False Yes 
GE_O0Q 1DH | Greater-than-or-equal (ordered, nonsignal- True False True False No 
ing) 
GT_0Q 1€H Greater-than (ordered, nonsignaling) True False False False No 
TRUE_US 1FH | True (unordered, signaling) True True True True Yes 
NOTES: 


1. If either operand A or B is a NAN. 


The unordered relationship is true when at least one of the two source operands being compared is a NaN; the 
ordered relationship is true when neither source operand is a NaN. 


A subsequent computational instruction that uses the mask result in the destination operand as an input operand 
will not generate an exception, because a mask of all Os corresponds to a floating-point value of +0.0 and a mask 
of all 1s corresponds to a QNaN. 


Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”, 
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either 
by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison) 
or by using software emulation. When using software emulation, the program must swap the operands (copying 
registers when necessary to protect the data that will now be in the destination), and then perform the compare 
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7 
(Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 2A) under the heading Emulation. 


Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand 
CMPPD instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-2. Compiler should treat reserved 
Immé8 values as illegal syntax. 


Table 3-2. Pseudo-Op and CMPPD Implementation 
Pseudo-Op CMPPD Implementation 


CMPEQPD xmm1, xmm2 


CMPPD xmm1, xmm2, 0 


CMPLTPD xmm1, xmm2 


CMPLEPD xmm1, xmm2 


CMPPD xmm1, xmmz, 1 
CMPPD xmm1, xmm2, 2 


CMPUNORDPD xmm1, xmm2 


CMPPD xmm1, xmm2, 3 


CMPNEQPD xmm1, xmm2 


CMPNLTPD xmm7, xmm2 


CMPPD xmm1, xmm2, 4 
CMPPD xmm1, xmm2, 5 


CMPNLEPD xmm1, xmm2 


CMPPD xmm1, xmm2, 6 


CMPPD xmm1, xmm2, 7 


CMPORDPD xmm1, xmm2 


The greater-than relations that the processor does not implement require more than one instruction to emulate in 
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the 
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to 
the correct destination register and that the source operand is left intact.) 


Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-3, soft- 
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand 
pseudo-ops in addition to the four-operand VCMPPD instruction. See Table 3-3, where the notations of regi reg2, 
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Immé8 values as illegal 
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syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter- 
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPPD instructions 
ina similar fashion by extending the syntax listed in Table 3-3. 


Table 3-3. Pseudo-Op and VCMPPD Implementation 


Pseudo-Op 


CMPPD Implementation 


VCMPEQPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 0 


VCMPLTPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 1 


VCMPLEPD reg1, reg2, reg3 


VCMPPD reg, reg2, reg3, 2 


VCMPUNORDPD reg1, reg2, reg3 


VCMPPD reg, reg2, reg3, 3 


VCMPNEOPD reg7, reg2, reg3 


VCMPPD reg1, reg2, reg3, 4 


VCMPNLTPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 5 


VCMPNLEPD reg1, reg2, reg3 


VCMPPD reg, reg2, reg3, 6 


VCMPORDPD reg], reg2, reg3 
VCMPEQ_UOQPD reg, reg2, reg3 
VCMPNGEPD reg1, reg2, reg3 


VCMPPD reg, reg2, reg3, 7 
VCMPPD reg, reg2, reg3, 8 
VCMPPD reg1, reg2, reg3, 9 


VCMPNGTPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, OAH 


VCMPFALSEPD reg1, reg2, reg3 
VCMPNEQ_OOQPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, OBH 
VCMPPD reg1, reg2, reg3, OCH 


VCMPGEPD reg], reg2, reg3 


VCMPPD reg1, reg2, reg3, ODH 


VCMPGTPD reg1, reg2, reg3 
VCMPTRUEPD reg], reg2, reg3 
VCMPEQ_OSPD reg1, reg2, reg3 


VCMPPD reg, reg2, reg3, OEH 
VCMPPD reg1, reg2, reg3, OFH 
VCMPPD reg1, reg2, reg3, 10H 


VCMPLT_OQPD reg7, reg2, reg3 
VCMPLE_OQPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 11H 
VCMPPD reg1, reg2, reg3, 12H 


VCMPUNORD_SPD reg1, reg2, reg3 


VCMPPD reg], reg2, reg3, 13H 


VCMPNEQ_USPD reg7, reg2, reg3 
VCMPNLT_UOQPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 14H 
VCMPPD reg1, reg2, reg3, 15H 


VCMPNLE_UQPD reg7, reg2, reg3 


VCMPPD reg1, reg2, reg3, 16H 


VCMPORD_SPD reg1, reg2, reg3 
VCMPEQ_USPD reg, reg2, reg3 


VCMPPD reg, reg2, reg3, 17H 
VCMPPD reg1, reg2, reg3, 18H 


VCMPNGE_UQPD reg, reg2, reg3 


VCMPPD reg1, reg2, reg3, 19H 


VCMPNGT_UQPD reg1, reg2, reg3 
VCMPFALSE_OSPD reg], reg2, reg3 


VCMPPD reg1, reg2, reg3, 1AH 
VCMPPD reg1, reg2, reg3, 1BH 


VCMPNEQ_OSPD reg7, reg2, reg3 


VCMPPD reg1, reg2, reg3, 1CH 


VCMPGE_OOQPD reg7, reg2, reg3 
VCMPGT_OQPD reg1, reg2, reg3 


VCMPPD reg1, reg2, reg3, 1DH 
VCMPPD reg, reg2, reg3, 1EH 


VCMPTRUE_USPD reg/, reg2, reg3 


VCMPPD reg], reg2, reg3, 1FH 
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Operation 


CASE (COMPARISON PREDICATE) OF 
0: OP3 := EQ_OQ; OP5 := EQ_OQ; 
1: OP3 := LT_OS; OP5 := LT_OS; 
2: OP3 := LE_OS; OP5 := LE_OS; 
3: OP3 := UNORD_Q; OP5 := UNORD_Q; 
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ; 
5: OP3 := NLT_US; OP5 := NLT_US; 
6: OP3 := NLE_US; OP5 := NLE_US; 
7: OP3 := ORD_Q; OP5 := ORD_Q; 
8: OPS := EQ_UQ; 
9: OP5 := NGE_US; 
10: OP5 := NGT_US; 
11: OP5 := FALSE_OQ; 
12: OP5 := NEQ_OQ; 
13: OP5 := GE_OS; 
14: OPS := GT_OS; 
15: OPS := TRUE_UQ; 
16: OP5 := EQ_OS; 
17: OP5 := LT_OQ; 
18: OPS := LE_OQ; 
19: OP5 := UNORD_S; 
20: OPS := NEQ_US; 
21: OPS := NLT_UQ; 
22: OPS := NLE_UQ; 
23: OP5 := ORD_S; 
24: OPS := EQ_US; 
25: OPS := NGE_UQ; 
26: OPS := NGT_UQ; 
27: OPS := FALSE_OS; 
28: OPS := NEQ_OS; 
29: OPS := GE_OQ; 
30: OP5 := GT_OQ; 
31: OPS := TRUE_US; 
DEFAULT: Reserved; 
ESAC; 
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VCMPPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
CMP := SRC1[i+63:i] OPS SRC2[63:0] 
ELSE 
CMP := SRC1[i+63:i] OPS SRC2[i+63:i] 
Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{[j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VCMPPD (VEX.256 encoded version) 
CMPO := SRC1[63:0] OPS SRC2[63:0]; 
CMP1 := SRC1[127:64] OP5 SRC2[1 27:64]; 
CMP2 := SRC1[191:128] OPS SRC2[191:128]; 
CMP3 := SRC1[255:192] OP5 SRC2[255:192]; 
IF CMPO = TRUE 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := OOOOOODDO000000OH;; FI; 
IF CMP1 = TRUE 
THEN DEST[1 27:64] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[127:64] := QOOOOOODOD0000ONH,; FI; 
IF CMP2 = TRUE 
THEN DEST[191:1 28] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[191:1 28] := OOOOOODDD0000000H;; FI; 
IF CMP3 = TRUE 
THEN DEST[255:192] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[255:1 92] := OOOOOODD00000000H;; FI; 
DEST[MAXVL-1:256] := 0 


VCMPPD (VEX.128 encoded version) 
CMPO := SRC1[63:0] OPS SRC2[63:0]; 
CMP1 := SRC1[127:64] OP5 SRC2[1 27:64]; 
IF CMPO = TRUE 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := OOOOOODDOO000O00OH;; FI; 
IF CMP1 = TRUE 
THEN DEST[1 27:64] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[1 27:64] := QOOOOODDO00000ONH; FI; 
DEST[MAXVL-1:128] := 0 
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CMPPD (128-bit Legacy SSE version) 
CMPO := SRC1[63:0] OP3 SRC2[63:0]; 
CMP1 := SRC1[127:64] OP3 SRC2[127:64]; 
IF CMPO = TRUE 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := QOOOODDDD0000000H;; FI; 
IF CMP1 = TRUE 
THEN DEST[127:64] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[127:64] := OOOOODD000000000H ; FI; 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCMPPD __mmask8 _mm512_cmp_pd_mask(__m512da,__m512db, int imm); 

VCMPPD __mmask8 _mm512_cmp_round_pd_mask(__m512d a,__m512d b, int imm, int sae); 

VCMPPD __mmask8 _mm512_mask_cmp_pd_mask(_mmask8 k1,__m512da,__m512d b, int imm); 

VCMPPD __mmask8 _mm512_mask_cmp_round_pd_mask(__mmask8 k1,__m512da,__m512d, int imm, int sae); 
VCMPPD __mmask8 _mm256_cmp_pd_mask(__m256d a,___ m256d b, int imm); 

VCMPPD __mmask8 _mm256_mask_cmp_pd_mask(___mmask8 k1,__ m256d a, ___m256d b, int imm); 

VCMPPD __mmask8 _mm_cmp_pd_mask(__m128d a,_m128d b, int imm); 

VCMPPD __mmask8 _mm_mask_cmp_pd_mask(_mmask8 k1,__m128d a,__m128d b, int imm); 

VCMPPD __m256 _mm256_cmp_pd(__m256d a, __m256d b, int imm) 

(V)CMPPD __m128_mm_cmp_pd(__m128d a,__m128d b, int imm) 


SIMD Floating-Point Exceptions 
Invalid if SNaN operand and invalid if QNaN and predicate as listed in Table 3-1. 
Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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CMPPS—Compare Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF C2 /r ib A VIV SSE Compare packed single-precision floating-point values in 
CMPPS xmm1, xmm2/m1 28, xmm2/m128 and xmm_1 using bits 2:0 of imm8 as a 
imm8 comparison predicate. 
VEX.128.0F.WIG C2 /r ib B VIV AVX Compare packed single-precision floating-point values in 
VCMPPS xmm1, xmm2, xmm3/m128 and xmmz using bits 4:0 of imm8 as a 
xmm3/m1 28, imm8 comparison predicate. 
VEX.256.0F.WIG C2 /r ib B VIV AVX Compare packed single-precision floating-point values in 
VCMPPS ymm1, ymm2, ymm3/m256 and ymmz using bits 4:0 of imm8 as a 
ymm3/m256, imm8 comparison predicate. 
EVEX.128.0F.WO C2 /r ib C VIV AVX512VL | Compare packed single-precision floating-point values in 
VCMPPS k1 {k2}, xmm2, AVX512F xmm3/m128/m32bcst and xmmcz using bits 4:0 of imm8 as 
xmm3/m128/m32bcst, imm8 a comparison predicate with writemask k2 and leave the 
result in mask register k1. 
EVEX.256.0F.WO C2 /r ib C VIV AVX512VL | Compare packed single-precision floating-point values in 
VCMPPS k1 {k2}, ymm2, AVX512F ymm3/m256/m32bcst and ymm2 using bits 4:0 of imm8 as 
ymm3/m256/m32bcst, imm8 a comparison predicate with writemask k2 and leave the 
result in mask register k1. 
EVEX.512.0F.WO C2 /r ib C VIV AVX512F Compare packed single-precision floating-point values in 
VCMPPS k1 {k2}, zmm2, zmm3/m512/m32bcst and zmmz using bits 4:0 of imm8 as 
zmm3/m512/m32bcst{sae}, imm8 a comparison predicate with writemask k2 and leave the 
result in mask register k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Performs a SIMD compare of the packed single-precision floating-point values in the second source operand and 
the first source operand and returns the result of the comparison to the destination operand. The comparison pred- 
icate operand (immediate byte) specifies the type of comparison performed on each of the pairs of packed values. 


EVEX encoded versions: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand (first operand) is an opmask register. 
Comparison results are written to the destination operand under the writemask k2. Each comparison result is a 
single mask bit of 1 (comparison true) or 0 (comparison false). 


VEX.256 encoded version: The first source operand (second operand) is a YMM register. The second source operand 
(third operand) can be a YMM register or a 256-bit memory location. The destination operand (first operand) is a 

YMM register. Eight comparisons are performed with results written to the destination operand. The result of each 
comparison is a doubleword mask of all 1s (comparison true) or all Os (comparison false). 


128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The 
second source operand (second operand) can be an XMM register or 128-bit memory location. Bits (MAXVL-1:128) 
of the corresponding ZMM destination register remain unchanged. Four comparisons are performed with results 
written to bits 127:0 of the destination operand. The result of each comparison is a doubleword mask of all 1s 
(comparison true) or all Os (comparison false). 


VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source 
operand (third operand) can be an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destina- 
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tion ZMM register are zeroed. Four comparisons are performed with results written to bits 127:0 of the destination 
operand. 


The comparison predicate operand is an 8-bit immediate: 


° For instructions encoded using the VEX prefix and EVEX prefix, bits 4:0 define the type of comparison to be 
performed (see Table 3-1). Bits 5 through 7 of the immediate are reserved. 


¢ For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see 
the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved. 


The unordered relationship is true when at least one of the two source operands being compared is a NaN; the 
ordered relationship is true when neither source operand is a NaN. 


A subsequent computational instruction that uses the mask result in the destination operand as an input operand 
will not generate an exception, because a mask of all Os corresponds to a floating-point value of +0.0 and a mask 
of all 1s corresponds to a QNaN. 


Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”, 
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either 
by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison) 
or by using software emulation. When using software emulation, the program must swap the operands (copying 
registers when necessary to protect the data that will now be in the destination), and then perform the compare 
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7 
(Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 2A) under the heading Emulation. 


Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand 
CMPPS instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-4. Compiler should treat reserved 
Immé8 values as illegal syntax. 


Table 3-4. Pseudo-Op and CMPPS Implementation 


Pseudo-Op CMPPS Implementation 
CMPEQPS xmm1, xmm2 CMPPS xmm1, xmm2, 0 
CMPLTPS xmm1, xmm2 CMPPS xmm1, xmm2, 1 

CMPLEPS xmm1, xmm2 CMPPS xmm1, xmm2, 2 
CMPUNORDPS xmm17, xmm2 CMPPS xmm1, xmm2, 3 
CMPNEOQPS xmm1, xmm2 CMPPS xmm1, xmm2, 4 
CMPNLTPS xmm7, xmm2 CMPPS xmm1, xmm2, 5 
CMPNLEPS xmm1, xmm2 CMPPS xmm1, xmm2, 6 
CMPORDPS xmm17, xmm2 CMPPS xmm1, xmm2, 7 


The greater-than relations that the processor does not implement require more than one instruction to emulate in 
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the 
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to 
the correct destination register and that the source operand is left intact. ) 


Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-5, soft- 
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand 
pseudo-ops in addition to the four-operand VCMPPS instruction. See Table 3-5, where the notation of regi and 
reg2 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal 
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter- 
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPPS instructions 
in a similar fashion by extending the syntax listed in Table 3-5. 
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Table 3-5. Pseudo-Op and VCMPPS Implementation 


Pseudo-Op 


CMPPS Implementation 


VCMPEOQPS reg1, reg2, reg3 


VCMPPS reg1, reg2, reg3, 0 


VCMPLTPS reg17, reg2, reg3 


VCMPPS reg, reg2, reg3, 1 


VCMPLEPS reg1, reg2, reg3 


VCMPPS reg1, reg2, reg3, 2 


VCMPUNORDPS reg1, reg2, reg3 


VCMPPS reg1, reg2, reg3, 3 


VCMPNEOPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, 4 


VCMPNLTPS reg1, reg2, reg3 


VCMPPS reg1, reg2, reg3, 5 


VCMPNLEPS reg/7, reg2, reg3 


VCMPPS reg1, reg2, reg3, 6 


VCMPORDPS reg/, reg2, reg3 
VCMPEQ_UOPS reg/, reg2, reg3 


VCMPPS reg, reg2, reg3, 7 
VCMPPS reg1, reg2, reg3, 8 


VCMPNGEPS reg/7, reg2, reg3 


VCMPPS reg1, reg2, reg3, 9 


VCMPNGTPS reg, reg2, reg3 


VCMPPS reg, reg2, reg3, OAH 


VCMPFALSEPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, OBH 


VCMPNEQ_OOPS reg/, reg2, reg3 


VCMPPS reg, reg2, reg3, OCH 


VCMPGEPS reg], reg2, reg3 


VCMPPS reg, reg2, reg3, ODH 


VCMPGTPS reg1, reg2, reg3 


VCMPPS reg, reg2, reg3, OEH 


VCMPTRUEPS reg7, reg2, reg3 
VCMPEQ_OSPS reg], reg2, reg3 


VCMPPS reg, reg2, reg3, OFH 
VCMPPS reg, reg2, reg3, 10H 


VCMPLT_OOQPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, 11H 


VCMPLE_OOPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, 12H 


VCMPUNORD_SPS reg17, reg2, reg3 


VCMPPS reg, reg2, reg3, 13H 


VCMPNEQ_USPS reg1, reg2, reg3 


VCMPPS reg, reg2, reg3, 14H 


VCMPNLT_UOPS reg], reg2, reg3 


VCMPPS reg, reg2, reg3, 15H 


VCMPNLE_UOPS reg1, reg2, reg3 


VCMPPS reg, reg2, reg3, 16H 


VCMPORD_SPS reg/1, reg2, reg3 
VCMPEQ_USPS reg], reg2, reg3 


VCMPPS reg, reg2, reg3, 17H 
VCMPPS reg, reg2, reg3, 18H 


VCMPNGE_UOPS reg, reg2, reg3 
VCMPNGT_UOPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, 19H 
VCMPPS reg1, reg2, reg3, 1AH 


VCMPFALSE_OSPS reg, reg2, reg3 


VCMPPS reg, reg2, reg3, 1BH 


VCMPNEQ_OSPS reg1, reg2, reg3 


VCMPPS reg, reg2, reg3, 1CH 


VCMPGE_OOPS reg7, reg2, reg3 


VCMPPS reg, reg2, reg3, 1DH 


VCMPGT_OOQPS reg1, reg2, reg3 


VCMPPS reg, reg2, reg3, 1EH 


VCMPTRUE_USPS reg, reg2, reg3 


VCMPPS reg, reg2, reg3, 1FH 
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Operation 


CASE (COMPARISON PREDICATE) OF 
0: OP3 := EQ_OQ; OP5 := EQ_0Q; 
1: OP3 := LT_OS; OP5 := LT_OS; 

2: OP3 := LE_OS; OP5 := LE_OS; 
3: OP3 := UNORD_Q; OP5 := UNORD_Q; 
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ; 
5: OP3 := NLT_US; OP5 := NLT_US; 
6: OP3 := NLE_US; OP5 := NLE_US; 
7: OP3 := ORD_Q; OP5 := ORD_Q; 
8: OPS := EQ_UQ; 
9: OP5 := NGE_US; 
10: OP5 := NGT_US; 
11: OP5 := FALSE_OQ; 
12: OP5 := NEQ_OQ; 
13: OP5 := GE_OS; 
14: OPS := GT_OS; 
15: OPS := TRUE_UQ; 
16: OP5 := EQ_OS; 
17: OP5 := LT_OQ; 
18: OPS := LE_OQ; 
19: OP5 := UNORD_S; 
20: OPS := NEQ_US; 
21: OPS := NLT_UQ; 
22: OPS := NLE_UQ; 
23: OP5 := ORD_S; 
24: OPS := EQ_US; 
25: OPS := NGE_UQ; 
26: OPS := NGT_UQ; 
27: OPS := FALSE_OS; 
28: OPS := NEQ_OS; 
29: OPS := GE_OQ; 
30: OPS := GT_OQ; 
31: OPS := TRUE_US; 
DEFAULT: Reserved 
ESAC; 
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VCMPPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
CMP := SRC1[i+31:i] OPS SRC2[31:0] 
ELSE 
CMP := SRC1[i+31:i] OPS SRC2[i+31:i] 
Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VCMPPS (VEX.256 encoded version) 
CMPO := SRC1[31:0] OPS SRC2[31:0]; 
CMP1 := SRC1[63:32] OPS SRC2[63:32]; 
CMP2 := SRC1[95:64] OPS SRC2[95:64]; 
CMP3 := SRC1[127:96] OP5 SRC2[1 27:96]; 
CMP4 := SRC1[159:128] OPS SRC2[159:1 28]; 
CMP5 := SRC1[191:160] OP5 SRC2[191:160]; 
CMP6 := SRC1[223:192] OPS SRC2[223:192]; 
CMP7 := SRC1[255:224] OPS SRC2[255:224]; 
IF CMPO = TRUE 

THEN DEST[31:0] :=FFFFFFFFH; 

ELSE DEST[31:0] := OOOOOOOOOH;; FI; 
IF CMP1 = TRUE 

THEN DEST[63:32] := FFFFFFFFH; 

ELSE DEST[63:32] :=OOOOO0000H; FI; 
IF CMP2 = TRUE 

THEN DEST[95:64] := FFFFFFFFH; 

ELSE DEST[95:64] := OOOOOOOOOH;; FI; 
IF CMP3 = TRUE 

THEN DEST[1 27:96] := FFFFFFFFH; 

ELSE DEST[127:96] := OOOOOOOOOH;; FI; 
IF CMP4 = TRUE 

THEN DEST[159:128] := FFFFFFFFH; 

ELSE DEST[159:128] := OOOOOOCOOH; FI; 
IF CMPS = TRUE 

THEN DEST[191:160] := FFFFFFFFH; 

ELSE DEST[191:160] := OOOOOOCOOH; FI; 
IF CMP6 = TRUE 

THEN DEST[223:192] := FFFFFFFFH; 

ELSE DEST[223:192] :=OOOO00000H;; FI; 
IF CMP7 = TRUE 

THEN DEST[255:224] := FFFFFFFFH; 

ELSE DEST[255:224] := OOOOO00OOH; FI; 
DEST[MAXVL-1:256] := 0 
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VCMPPS (VEX.128 encoded version) 
CMPO := SRC1[31:0] OPS SRC2[31:0]; 
CMP1 := SRC1[63:32] OP5 SRC2[63:32]; 
CMP2 := SRC1[95:64] OP5 SRC2[95:64]; 
CMP3 := SRC1[127:96] OP5 SRC2[127:96]; 
IF CMPO = TRUE 

THEN DEST[31:0] :=FFFFFFFFH; 

ELSE DEST[31:0] := OOOOOOOOOH; FI; 
IF CMP1 = TRUE 

THEN DEST[63:32] := FFFFFFFFH; 

ELSE DEST[63:32] := OOOOOOOOOH;; FI; 
IF CMP2 = TRUE 

THEN DEST[95:64] := FFFFFFFFH; 

ELSE DEST[95:64] := OOOOOO00OH;; FI; 
IF CMP3 = TRUE 

THEN DEST[1 27:96] := FFFFFFFFH; 

ELSE DEST[127:96] :=OOOOOO0OOH; FI; 
DEST[MAXVL-1:128] := 0 


CMPPS (128-bit Legacy SSE version) 
CMPO := SRC1[31:0] OP3 SRC2[31:0]; 
CMP1 := SRC1[63:32] OP3 SRC2[63:32]; 
CMP2 := SRC1[95:64] OP3 SRC2[95:64]; 
CMP3 := SRC1[127:96] OP3 SRC2[1 27:96]; 
IF CMPO = TRUE 

THEN DEST[31:0] :=FFFFFFFFH; 

ELSE DEST[31:0] := QOOOOO0OOH;; FI; 
IF CMP1 = TRUE 

THEN DEST[63:32] := FFFFFFFFH; 

ELSE DEST[63:32] := OOOOOOOOOH; FI; 
IF CMP2 = TRUE 

THEN DEST[95:64] := FFFFFFFFH; 

ELSE DEST[95:64] := OOOOOOOOOH; FI; 
IF CMP3 = TRUE 

THEN DEST[127:96] := FFFFFFFFH; 

ELSE DEST[127:96] :=OOO000000H; FI; 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
VCMPPS __mmask16 _mm512_cmp_ps_mask( 


m512 a,__m512 5, int imm); 


VCMPPS __mmask16 __mm512_cmp_round_ps_mask( 


m512 a,__m512b, int imm, int sae); 


VCMPPS __mmask16 _mm512_mask_cmp_ps_mask( 


mmask16 k1,__m512 a, 


VCMPPS __mmask16 __mm512_mask_cmp_round_ps_mask( 


VCMPPS __mmask8 _mm256_cmp_ps_mask( 


m256 b, int imm); 


mmask8 k1,__m256 a, 


VCMPPS __mmask8 _mm256_mask_cmp_ps_mask( 
VCMPPS __mmask8 __mm_cmp_ps_mask(_m128 a,__m128 b, int imm); 


VCMPPS __mmask8 _mm_mask_cmp_ps_mask( 


m256 b, int imm); 


m128 b, int imm); 


VCMPPS __m256 _mm256_cmp_ps(__m256 a,__m256 b, int imm) 
CMPPS __m128_mm_cmp_ps(__m128 a,__m128 b, int imm) 


SIMD Floating-Point Exceptions 


Invalid if SNaN operand and invalid if QNaN and predicate as listed in Table 3-1. 


Denormal 
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m512 b, int imm); 
m512 b, int imm, int sae); 
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Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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CMPS/CMPSB/CMPSW/CMPSD/CMPSQ—Compare String Operands 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
A6 CMPS m8, m& ZO | Valid Valid For legacy mode, compare byte at address DS:(E)SI with 


byte at address ES:(E)DI; For 64-bit mode compare byte 
at address (RIE)SI to byte at address (RIE)DI. The status 
flags are set accordingly. 


A7 CMPS m16, m16 ZO | Valid Valid For legacy mode, compare word at address DS:(E)SI 
with word at address E€S:(E)DI; For 64-bit mode 
compare word at address (R|E)SI with word at address 
(RJE)DI. The status flags are set accordingly. 

A7 CMPS m32, m32 ZO | Valid Valid For legacy mode, compare dword at address DS:(E)SI at 
dword at address ES:(€)DI; For 64-bit mode compare 
dword at address (R|E)SI at dword at address (RIE)DI. 
The status flags are set accordingly. 


REX.W + A7 CMPS m64, m64 ZO | Valid N.E. Compares quadword at address (R|E)SI with quadword 
at address (RJE)DI and sets the status flags accordingly. 
A6 CMPSB ZO | Valid Valid For legacy mode, compare byte at address DS:(E)SI with 


byte at address ES:(€)DI; For 64-bit mode compare byte 
at address (R|E)SI with byte at address (R|E)DI. The 
status flags are set accordingly. 


A7 CMPSW ZO | Valid Valid For legacy mode, compare word at address DS:(E)SI 
with word at address ES:(E)DI; For 64-bit mode 
compare word at address (R|E)SI with word at address 
(RJE)DI. The status flags are set accordingly. 

A7 CMPSD ZO | Valid Valid For legacy mode, compare dword at address DS:(E)SI 
with dword at address ES:(€)DI; For 64-bit mode 
compare dword at address (RJE)SI with dword at 
address (RIE)DI. The status flags are set accordingly. 
REX.W + A7 CMPSQ ZO ‘| Valid N.E. Compares quadword at address (R|E)SI with quadword 
at address (RJE)DI and sets the status flags accordingly. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Compares the byte, word, doubleword, or quadword specified with the first source operand with the byte, word, 
doubleword, or quadword specified with the second source operand and sets the status flags in the EFLAGS register 
according to the results. 


Both source operands are located in memory. The address of the first source operand is read from DS:SI, DS:ESI 
or RSI (depending on the address-size attribute of the instruction is 16, 32, or 64, respectively). The address of the 
second source operand is read from ES:DI, ES:EDI or RDI (again depending on the address-size attribute of the 
instruction is 16, 32, or 64). The DS segment may be overridden with a segment override prefix, but the ES 
segment cannot be overridden. 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the CMPS mnemonic) allows the two source operands 
to be specified explicitly. Here, the source operands should be symbols that indicate the size and location of the 
source values. This explicit-operand form is provided to allow documentation. However, note that the documenta- 
tion provided by this form can be misleading. That is, the source operand symbols must specify the correct type 
(size) of the operands (bytes, words, or doublewords, quadwords), but they do not have to specify the correct loca- 
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tion. Locations of the source operands are always specified by the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) regis- 
ters, which must be loaded correctly before the compare string instruction is executed. 


The no-operands form provides “short forms” of the byte, word, and doubleword versions of the CMPS instructions. 
Here also the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) registers are assumed by the processor to specify the loca- 
tion of the source operands. The size of the source operands is selected with the mnemonic: CMPSB (byte compar- 
ison), CMPSW (word comparison), CMPSD (doubleword comparison), or CMPSQ (quadword comparison using 
REX.W). 


After the comparison, the (E/R)SI and (E/R)DI registers increment or decrement automatically according to the 
setting of the DF flag in the EFLAGS register. (If the DF flag is 0, the (E/R)SI and (E/R)DI register increment; if the 
DF flag is 1, the registers decrement.) The registers increment or decrement by 1 for byte operations, by 2 for word 
operations, 4 for doubleword operations. If operand size is 64, RSI and RDI registers increment by 8 for quadword 
operations. 


The CMPS, CMPSB, CMPSW, CMPSD, and CMPSQ instructions can be preceded by the REP prefix for block compar- 
isons. More often, however, these instructions will be used in a LOOP construct that takes some action based on the 
setting of the status flags before the next comparison is made. See “REP/REPE/REPZ /REPNE/REPNZ—Repeat 
String Operation Prefix” in Chapter 4 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 2B, for a description of the REP prefix. 


In 64-bit mode, the instruction’s default address size is 64 bits, 32 bit address size is supported using the prefix 
67H. Use of the REX.W prefix promotes doubleword operation to 64 bits (see CMPSQ). See the summary chart at 
the beginning of this section for encoding data and limits. 


Operation 
temp := SRC1 - SRC2; 
SetStatusFlags(temp); 
IF (64-Bit Mode) 
THEN 
IF (Byte comparison) 
THEN IF DF = 0 
THEN 
(RJE)SI := (RIE)SI + 1; 
(RJE)DI := (RIE)DI + 1; 
ELSE 
(RIE)SI := (RIE)SI - 1; 
(RJE)DI := (RIE)DI - 1; 
FI; 
ELSE IF (word comparison) 
THEN IF DF =O 
THEN 
(RIE)SI := (RIE)SI + 2; 
(RJE)DI := (RIE)DI + 2; 
ELSE 
(RIE)SI := (RIE)SI - 2; 
(RJE)DI := (RIE)DI - 2; 
FI; 
ELSE IF (Doubleword comparison) 
THEN IF DF = 0 
THEN 


(RIE)SI := (RIE)SI + 4; 
(RJE)DI := (RIE)DI + 4; 
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#SS(0) 
#PF(fault-code) 
#AC(0) 


#UD 


ELSE (* Quadword comparison *) 


THEN IF DF =0 
(RJE)SI := (RIE)SI + 8; 
(RJE)DI := (RIE)DI + 8; 
ELSE 
(RJE)SI := (RIE)SI - 8; 
(RJE)DI := (RIE)DI - 8; 
Fl; 
Fl; 
ELSE (* Non-64-bit Mode *) 
IF (byte comparison) 
THEN IF DF =0 
THEN 
(E)SI := (E)SI + 1; 
(E)DI := (E)DI + 1; 
ELSE 
(E)SI = (E)SI - 1; 
(E)DI := (E)DI - 1; 
Fl; 
ELSE IF (Word comparison) 
THEN IF DF =O 
(E)SI := (E)SI + 2; 
(€)DI := (E)DI + 2; 


Fl; 


ELSE (* Doubleword comparison *) 


THEN IF DF = 0 
(E)SI := (€)SI + 4; 
(E)DI := (E)DI + 4; 


ELSE 
(E)SI := (€)SI - 4; 
(E)DI := (€)DI - 4; 
Fl; 
Fl; 
Flags Affected 


Protected Mode Exceptions 
#GP(0) 
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The CF, OF, SF, ZF, AF, and PF flags are set according to the temporary result of the comparison. 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register contains a NULL segment selector. 
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If a memory operand effective address is outside the SS segment limit. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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CMPSD—Compare Scalar Double-Precision Floating-Point Value 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F2 OF C2 /r ib A VN SSE2 
CMPSD xmm1, xmm2/m64, imm8 


Compare low double-precision floating-point value in 
xmm2/m64 and xmm1 using bits 2:0 of imm8 as comparison 
predicate. 

Compare low double-precision floating-point value in 
xmm3/m64 and xmm_z using bits 4:0 of imm8 as comparison 
predicate. 

AVX512F | Compare low double-precision floating-point value in 
xmm3/m64 and xmm_z using bits 4:0 of imm8 as comparison 
predicate with writemask k2 and leave the result in mask 
register k1. 


VEX.LIG.F2.0F.WIG C2 /r ib B VV AVX 
VCMPSD xmm1, xmm2, 
xmm3/m64, imm8 

EVEX.LLIG.F2.0F.W1 C2 /r ib C VIV 
VCMPSD k1 {k2}, xmm2, 
xmm3/m64{sae}, imm8 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8s NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Compares the low double-precision floating-point values in the second source operand and the first source operand 
and returns the result of the comparison to the destination operand. The comparison predicate operand (imme- 
diate operand) specifies the type of comparison performed. 


128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The 
second source operand (second operand) can be an XMM register or 64-bit memory location. Bits (MAXVL-1:64) of 
the corresponding YMM destination register remain unchanged. The comparison result is a quadword mask of all 1s 
(comparison true) or all Os (comparison false). 


VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source 
operand (third operand) can be an XMM register or a 64-bit memory location. The result is stored in the low quad- 
word of the destination operand; the high quadword is filled with the contents of the high quadword of the first 
source operand. Bits (MAXVL-1:128) of the destination ZMM register are zeroed. The comparison result is a quad- 
word mask of all 1s (comparison true) or all Os (comparison false). 


EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand 
can be a XMM register or a 64-bit memory location. The destination operand (first operand) is an opmask register. 
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination 
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared. 


The comparison predicate operand is an 8-bit immediate: 
¢ For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see 
Table 3-1). Bits 5 through 7 of the immediate are reserved. 


¢ For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see 
the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved. 


The unordered relationship is true when at least one of the two source operands being compared is a NaN; the 
ordered relationship is true when neither source operand is a NaN. 


A subsequent computational instruction that uses the mask result in the destination operand as an input operand 
will not generate an exception, because a mask of all Os corresponds to a floating-point value of +0.0 and a mask 
of all 1s corresponds to a QNaN. 


Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”, 
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either 
by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison) 
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or by using software emulation. When using software emulation, the program must swap the operands (copying 
registers when necessary to protect the data that will now be in the destination), and then perform the compare 
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7 
(Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 2A) under the heading Emulation. 


Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand 
CMPSD instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-6. Compiler should treat reserved 
Immé8 values as illegal syntax. 


Table 3-6. Pseudo-Op and CMPSD Implementation 
Pseudo-Op CMPSD Implementation 


CMPEQSD xmm1, xmm2 


CMPSD xmm1, xmm2, 0 


CMPLTSD xmm17, xmm2 


CMPSD xmm1, xmm2, 1 


CMPLESD xmm17, xmm2 


CMPSD xmm1, xmm2, 2 


CMPUNORDSD xmm17, xmm2 


CMPSD xmm1, xmm2, 3 


CMPNEQSD xmm1, xmm2 


CMPSD xmm1, xmm2, 4 


CMPNLTSD xmm17, xmm2 


CMPSD xmm1, xmm2, 5 


CMPNLESD xmm17, xmm2 
CMPORDSD xmm1, xmm2 


CMPSD xmm1, xmm2, 6 
CMPSD xmm1, xmm2, 7 


The greater-than relations that the processor does not implement require more than one instruction to emulate in 
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the 
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to 
the correct destination register and that the source operand is left intact.) 


Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-7, soft- 
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand 
pseudo-ops in addition to the four-operand VCMPSD instruction. See Table 3-7, where the notations of regi reg2, 
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal 
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter- 
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSD instructions 
in a similar fashion by extending the syntax listed in Table 3-7. 


Table 3-7. Pseudo-Op and VCMPSD Implementation 


Pseudo-Op 
VCMPEQSD reg1, reg2, reg3 


CMPSD Implementation 
VCMPSD reg1, reg2, reg3, 0 


VCMPLTSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1 


VCMPLESD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 2 


VCMPUNORDSD reg/, reg2, reg3 


VCMPSD reg1, reg2, reg3, 3 


VCMPNEQSD reg, reg2, reg3 


VCMPSD reg1, reg2, reg3, 4 


VCMPNLTSD reg7, reg2, reg3 
VCMPNLESD reg17, reg2, reg3 


VCMPSD reg1, reg2, reg3, 5 
VCMPSD reg1, reg2, reg3, 6 


VCMPORDSD reg1, reg2, reg3 
VCMPEQ_UQSD reg7, reg2, reg3 
VCMPNGESD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 7 
VCMPSD reg1, reg2, reg3, 8 
VCMPSD reg1, reg2, reg3, 9 


VCMPNGTSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, OAH 


VCMPFALSESD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, OBH 


VCMPNEQ_OQSD reg7, reg2, reg3 


VCMPSD reg1, reg2, reg3, OCH 


VCMPGESD reg, reg2, reg3 


VCMPSD reg1, reg2, reg3, ODH 
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Table 3-7. Pseudo-Op and VCMPSD Implementation 


Pseudo-Op 


CMPSD Implementation 


VCMPGTSD reg], reg2, reg3 


VCMPSD reg1, reg2, reg3, OEH 


VCMPTRUESD reg], reg2, reg3 
VCMPEQ_OSSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, OFH 
VCMPSD reg17, reg2, reg3, 10H 


VCMPLT_OQSD reg1, reg2, reg3 


VCMPSD reg17, reg2, reg3, 11H 


VCMPLE_OQSD reg/, reg2, reg3 


VCMPSD reg17, reg2, reg3, 12H 


VCMPUNORD_SSD reg/, reg2, reg3 


VCMPSD reg7, reg2, reg3, 13H 


VCMPNEQ_USSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 14H 


VCMPNLT_UQSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 15H 


VCMPNLE_UQSD reg7, reg2, reg3 


VCMPSD reg7, reg2, reg3, 16H 


VCMPORD_SSD reg1, reg2, reg3 
VCMPEQ_USSD reg1, reg2, reg3 


VCMPSD reg7, reg2, reg3, 17H 
VCMPSD reg17, reg2, reg3, 18H 


VCMPNGE_UQSD reg/, reg2, reg3 


VCMPSD reg1, reg2, reg3, 19H 


VCMPNGT_UQSD reg1, reg2, reg3 


VCMPSD reg7, reg2, reg3, 1AH 


VCMPFALSE_OSSD reg1, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1BH 


VCMPNEQ_OSSD reg, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1CH 


VCMPGE_OQSD reg, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1DH 


VCMPGT_OQSD reg7, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1€H 


VCMPTRUE_USSD reg17, reg2, reg3 


VCMPSD reg1, reg2, reg3, 1FH 


Software should ensure VCMPSD is encoded with VEX.L=0. Encoding VCMPSD with VEX.L=1 may encounter unpre- 


dictable behavior across different processor generations. 


Operation 


CASE (COMPARISON PREDICATE) OF 
0: OP3 := EQ_0Q; OPS := EQ_0Q; 
1: OP3 := LT_OS; OP5 := LT_OS; 

2: OP3 := LE_OS; OP5 := LE_OS; 

3: OP3 := UNORD_Q; OP5 := UNORD_Q; 
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ; 
5: OP3 := NLT_US; OP5 := NLT_US; 
6: OP3 := NLE_US; OP5 := NLE_US; 
7: OP3 := ORD_Q; OP5 := ORD_Q; 

8: OP5 := EQ_UQ; 

9: OPS := NGE_US; 

10: OPS := NGT_US; 

11: OP5 := FALSE_OQ; 

12: OPS := NEQ_OQ; 

13: OP5 := GE_OS; 

14: OPS := GT_OS; 

15: OPS := TRUE_UQ; 

16: OPS := EQ_OS; 

17: OPS := LT_OQ; 

18: OP5 := LE_OQ; 

19: OPS := UNORD_S; 

20: OPS := NEQ_US; 

21: OPS := NLT_UQ; 
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22: OPS := NLE_UQ; 
23: OP5 := ORD_S; 
24: OP5 := EQ_US; 
25: OPS := NGE_UQ; 
26: OPS := NGT_UQ; 
27: OPS := FALSE_OS; 
28: OPS := NEQ_OS; 
29: OP5 := GE_OQ; 
30: OPS := GT_OQ; 
31: OPS := TRUE_US; 
DEFAULT: Reserved 
ESAC; 


VCMPSD (EVEX encoded version) 
CMPO := SRC1[63:0] OP5 SRC2[63:0]; 


IF k2[O0] or *no writemask* 
THEN — IF CMPO = TRUE 
THEN DEST[0] := 1; 
ELSE DEST[O] := 0; Fl; 
ELSE DEST[O] := 0 ; zeroing-masking only 
Fl; 
DEST[MAX_KL-1:1] := 0 


CMPSD (128-bit Legacy SSE version) 

CMPO := DEST[63:0] OP3 SRC[63:0]; 

IF CMPO = TRUE 

THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := QOOOODD000000000H; FI; 
DEST[MAXVL-1:64] (Unmodified) 


VCMPSD (VEX.128 encoded version) 

CMPO := SRC1[63:0] OPS SRC2[63:0]; 

IF CMPO = TRUE 

THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := OOOOOODDD00000NNH; FI; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VCMPSD __mmask8 _mm_cmp_sd_mask(__m128d a,_m128d b, int imm); 

VCMPSD __mmask8 _mm_cmp_round_sd_mask(_m128d a,_m128d b, int imm, int sae); 

VCMPSD __mmask8 _mm_mask_cmp_sd_mask(__mmask8 k1,__m128da,__m128d, int imm); 

VCMPSD __mmask8 _mm_mask_cmp_round_sd_mask(___mmask8 k1,__m128d a,__m128d b, int imm, int sae); 
(V)CMPSD __m128d __mm_cmp_sd(__m128d a, ___m128d b, const int imm) 


SIMD Floating-Point Exceptions 
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1 Denormal. 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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CMPSS—Compare Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF C2 /r ib A VV SSE Compare low single-precision floating-point value in 
CMPSS xmm1, xmm2/m32, imm8 xmm2/m32 and xmm1 using bits 2:0 of imm8 as 
comparison predicate. 
VEX.LIG.F3.0F.WIG C2 /r ib B VIV AVX Compare low single-precision floating-point value in 
VCMPSS xmm1, xmm_2, xmm3/m32, xmm3/m32 and xmmz using bits 4:0 of imm8 as 
imm8 comparison predicate. 
EVEX.LLIG.F3.0F.WO C2 /r ib C VV AVX512F | Compare low single-precision floating-point value in 
VCMPSS k1 {k2}, xmm2, xmm3/m32 and xmmz using bits 4:0 of imm8 as 
xmm3/m32{sae}, imm8 comparison predicate with writemask k2 and leave the 
result in mask register k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8s 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Compares the low single-precision floating-point values in the second source operand and the first source operand 
and returns the result of the comparison to the destination operand. The comparison predicate operand (imme- 
diate operand) specifies the type of comparison performed. 


128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The 
second source operand (second operand) can be an XMM register or 32-bit memory location. Bits (MAXVL-1:32) of 
the corresponding YMM destination register remain unchanged. The comparison result is a doubleword mask of all 
1s (comparison true) or all Os (comparison false). 


VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source 
operand (third operand) can be an XMM register or a 32-bit memory location. The result is stored in the low 32 bits 
of the destination operand; bits 127:32 of the destination operand are copied from the first source operand. Bits 
(MAXVL-1:128) of the destination ZMM register are zeroed. The comparison result is a doubleword mask of all 1s 
(comparison true) or all Os (comparison false). 


EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand 
can be a XMM register or a 32-bit memory location. The destination operand (first operand) is an opmask register. 
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination 
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared. 


The comparison predicate operand is an 8-bit immediate: 


¢ For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see 
Table 3-1). Bits 5 through 7 of the immediate are reserved. 


¢ For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see 
the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved. 


The unordered relationship is true when at least one of the two source operands being compared is a NaN; the 
ordered relationship is true when neither source operand is a NaN. 


A subsequent computational instruction that uses the mask result in the destination operand as an input operand 
will not generate an exception, because a mask of all Os corresponds to a floating-point value of +0.0 and a mask 
of all 1s corresponds to a QNaN. 


Note that processors with “CPUID.1H:ECX.AVX =0” do not implement the “greater-than”, “greater-than-or-equal”, 
“not-greater than”, and “not-greater-than-or-equal relations” predicates. These comparisons can be made either 
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by using the inverse relationship (that is, use the “not-less-than-or-equal” to make a “greater-than” comparison) 
or by using software emulation. When using software emulation, the program must swap the operands (copying 

registers when necessary to protect the data that will now be in the destination), and then perform the compare 

using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7 

(Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 2A) under the heading Emulation. 


Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand 
CMPSS instruction, for processors with “CPUID.1H:ECX.AVX =0”. See Table 3-8. Compiler should treat reserved 
Immé8 values as illegal syntax. 


Table 3-8. Pseudo-Op and CMPSS Implementation 


Pseudo-Op CMPSS Implementation 
CMPEQSS xmm7, xmm2 CMPSS xmm1, xmm2, 0 
CMPLTSS xmm17, xmm2 CMPSS xmm1, xmm2, 1 
CMPLESS xmm1, xmm2 CMPSS xmm17, xmm2, 2 
CMPUNORDSS xmm1, xmm2 CMPSS xmm1, xmm2, 3 
CMPNEQSS xmm1, xmm2 CMPSS xmm1, xmm2, 4 
CMPNLTSS xmm1, xmm2 CMPSS xmm1, xmm2, 5 
CMPNLESS xmm17, xmm2 CMPSS xmm1, xmm2, 6 
CMPORDSS xmm1, xmm2 CMPSS xmm1, xmm2, 7 


The greater-than relations that the processor does not implement require more than one instruction to emulate in 
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the 
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to 
the correct destination register and that the source operand is left intact.) 


Processors with “CPUID.1H:ECX.AVX =1” implement the full complement of 32 predicates shown in Table 3-7, soft- 
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand 
pseudo-ops in addition to the four-operand VCMPSS instruction. See Table 3-9, where the notations of regi reg2, 
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal 
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter- 
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSS instructions 
in a similar fashion by extending the syntax listed in Table 3-9. 


Table 3-9. Pseudo-Op and VCMPSS Implementation 


Pseudo-Op 


CMPSS Implementation 


VCMPEQSS reg1, reg2, reg3 


VCMPSS reg1, reg2, reg3, 0 


VCMPLTSS reg1, reg2, reg3 
VCMPLESS reg1, reg2, reg3 


VCMPSS reg1, reg2, reg3, 1 
VCMPSS reg1, reg2, reg3, 2 


VCMPUNORDSS reg/7, reg2, reg3 


VCMPSS reg1, reg2, reg3, 3 


VCMPNEOQSS reg7, reg2, reg3 


VCMPSS reg1, reg2, reg3, 4 


VCMPNLTSS reg], reg2, reg3 


VCMPSS reg1, reg2, reg3, 5 


VCMPNLESS reg/, reg2, reg3 


VCMPSS reg1, reg2, reg3, 6 


VCMPORDSS reg1, reg2, reg3 
VCMPEQ_UQSS reg], reg2, reg3 


VCMPSS reg1, reg2, reg3, 7 
VCMPSS reg17, reg2, reg3, 8 


VCMPNGESS reg, reg2, reg3 


VCMPSS reg1, reg2, reg3, 9 


VCMPNGTSS reg], reg2, reg3 VCMPSS reg1, reg2, reg3, OAH 
VCMPFALSESS reg1, reg2, reg3 VCMPSS reg1, reg2, reg3, OBH 
VCMPNEQ_OQSS reg1, reg2, reg? VCMPSS reg, reg2, reg3, OCH 
VCMPGESS reg], reg2, reg3 VCMPSS reg1, reg2, reg3, ODH 
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Table 3-9. Pseudo-Op and VCMPSS Implementation 


Pseudo-Op 


CMPSS Implementation 


VCMPGTSS reg, reg2, reg3 


VCMPSS reg], reg2, reg3, OEH 


VCMPTRUESS reg1, reg2, reg3 
VCMPEQ_OSSS reg], reg2, reg3 


VCMPSS reg], reg2, reg3, OFH 
VCMPSS reg], reg2, reg3, 10H 


VCMPLT_OOQSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 11H 


VCMPLE_OOSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 12H 


VCMPUNORD_SSS reg, reg2, reg3 


VCMPSS reg], reg2, reg3, 13H 


VCMPNEQ_USSS reg, reg2, reg3 


VCMPSS reg], reg2, reg3, 14H 


VCMPNLT_UQSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 15H 


VCMPNLE_UQSS reg7, reg2, reg3 


VCMPSS reg], reg2, reg3, 16H 


VCMPORD_SSS reg17, reg2, reg3 
VCMPEQ_USSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 17H 
VCMPSS reg], reg2, reg3, 18H 


VCMPNGE_UQSS reg7, reg2, reg3 


VCMPSS reg], reg2, reg3, 19H 


VCMPNGT_UQSS reg, reg2, reg3 


VCMPSS reg], reg2, reg3, 1AH 


VCMPFALSE_OSSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 1BH 


VCMPNEQ_OSSS reg, reg2, reg3 


VCMPSS reg], reg2, reg3, 1CH 


VCMPGE_OQSS reg1, reg2, reg3 


VCMPSS reg], reg2, reg3, 1DH 


VCMPGT_OQSS reg7, reg2, reg3 


VCMPSS reg], reg2, reg3, 1€H 


VCMPTRUE_USSS reg7, reg2, reg? 


VCMPSS reg], reg2, reg3, 1FH 


Software should ensure VCMPSS is encoded with VEX.L=0. Encoding VCMPSS with VEX.L=1 may encounter unpre- 


dictable behavior across different processor generations. 


Operation 


CASE (COMPARISON PREDICATE) OF 
0: OP3 := EQ_OQ; OP5 := EQ_0Q; 
1: OP3 := LT_OS; OP5 := LT_OS; 
2: OP3 := LE_OS; OP5 := LE_OS; 


3: OP3 := UNORD_Q; OP5 := UNORD_Q; 
4: OP3 := NEQ_UQ; OP5 := NEQ_UQ; 
5: OP3 := NLT_US; OP5 := NLT_US; 
6: OP3 := NLE_US; OP5 := NLE_US; 
7: OP3 := ORD_Q; OP5 := ORD_Q; 

8: OP5 := EQ_UQ; 

9: OPS := NGE_US; 

10: OPS := NGT_US; 

11: OP5 := FALSE_OQ; 

12: OPS := NEQ_OQ; 

13: OP5 := GE_OS; 

14: OPS := GT_OS; 

15: OPS := TRUE_UQ; 

16: OPS := EQ_OS; 

17: OPS := LT_OQ; 

18: OP5 := LE_OQ; 

19: OPS := UNORD_S; 

20: OPS := NEQ_US; 

21: OPS := NLT_UQ; 
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22: OPS := NLE_UQ; 
23: OP5 := ORD_S; 
24: OP5 := EQ_US; 
25: OPS := NGE_UQ; 
26: OPS := NGT_UQ; 
27: OPS := FALSE_OS; 
28: OPS := NEQ_OS; 
29: OP5 := GE_OQ; 
30: OPS := GT_OQ; 
31: OPS := TRUE_US; 
DEFAULT: Reserved 
ESAC; 


VCMPSS (EVEX encoded version) 
CMPO := SRC1[31:0] OPS SRC2[31:0]; 


IF k2[0] or *no writemask* 
THEN — IF CMPO = TRUE 
THEN DEST[0] := 1; 
ELSE DEST[O] := 0; Fl; 
ELSE DEST[O] := 0 ; zeroing-masking only 
Fl; 
DEST[MAX_KL-1:1] := 0 


CMPSS (128-bit Legacy SSE version) 
CMPO := DEST[31:0] OP3 SRC[31:0]; 
IF CMPO = TRUE 

THEN DEST[31:0] := FFFFFFFFH; 

ELSE DEST[31:0] := OOOOOOOOH; FI; 
DEST[MAXVL-1:32] (Unmodified) 


VCMPSS (VEX.128 encoded version) 
CMPO := SRC1[31:0] OPS SRC2[31:0]; 
IF CMPO = TRUE 

THEN DEST[31:0] := FFFFFFFFH; 

ELSE DEST[31:0] := OOOOOOOOH; FI; 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCMPSS __mmask8 _mm_cmp_ss_mask(__m128 a,__m128, int imm); 

VCMPSS __mmask8 _mm_cmp_round_ss_mask(__m128 a,__m128 b, int imm, int sae); 

VCMPSS __mmask8 _mm_mask_cmp_ss_mask(__mmask8 k1,__m128 a,__m128 b, int imm); 

VCMPSS __mmask8 _mm_mask_cmp_round_ss_mask(__mmask8 k1,__m128 a,__m128 b, int imm, int sae); 
(V)CMPSS __m128_mm_cmp_ss(__m128 a,__m128 b, const int imm) 


SIMD Floating-Point Exceptions 
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1, Denormal. 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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CMPXCHG—Compare and Exchange 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

OF BO/r MR | Valid Valid* Compare AL with r/mé. If equal, ZF is set and r8 is loaded into 
CMPXCHG r/m8, r8 r/m8. Else, clear ZF and load r/m8 into AL. 

REX + OF BO/r MR | Valid N.E. Compare AL with r/m@. If equal, ZF is set and r8 is loaded into 
CMPXCHG r/m8**r8 r/m8. Else, clear ZF and load r/m8 into AL. 

OF B1/r MR | Valid Valid* Compare AX with r/m16. If equal, ZF is set and r76 is loaded 
CMPXCHG r/m16, r16 into r/m76. Else, clear ZF and load r/m76 into AX. 

OF B1/r MR | Valid Valid* Compare EAX with r/m32. If equal, ZF is set and r32 is loaded 
CMPXCHG r/m32, r32 into r/m32. Else, clear ZF and load r/m32 into EAX. 

REX.W + OF B1/r MR | Valid N.E. Compare RAX with r/m64. If equal, ZF is set and r64 is loaded 
CMPXCHG r/m64, r64 into r/m64. Else, clear ZF and load r/m64 into RAX. 

NOTES: 


* See the IA-32 Architecture Compatibility section below. 
** In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
Description 


Compares the value in the AL, AX, EAX, or RAX register with the first operand (destination operand). If the two 
values are equal, the second operand (source operand) is loaded into the destination operand. Otherwise, the 
destination operand is loaded into the AL, AX, EAX or RAX register. RAX register is available only in 64-bit mode. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. To simplify the 
interface to the processor’s bus, the destination operand receives a write cycle without regard to the result of the 
comparison. The destination operand is written back if the comparison fails; otherwise, the source operand is 

written into the destination. (The processor never produces a locked read without also producing a locked write. ) 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


IA-32 Architecture Compatibility 
This instruction is not supported on Intel processors earlier than the Intel486 processors. 


Operation 


(* Accumulator = AL, AX, EAX, or RAX depending on whether a byte, word, doubleword, or quadword comparison is being performed *) 
TEMP := DEST 
IF accumulator = TEMP 
THEN 
ZF := 1; 
DEST := SRC; 
ELSE 
ZF := 0; 
accumulator := TEMP; 
DEST := TEMP; 
Fl; 
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Flags Affected 


The ZF flag is set if the values in the destination operand and register AL, AX, or EAX are equal; otherwise it is 
cleared. The CF, PF, AF, SF, and OF flags are set according to the results of the comparison operation. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

OF C7 /1 M Valid Valid* Compare EDX:EAX with m64. If equal, set ZF and load 

CMPXCHG8B m64 ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX. 

REX.W + OF C7 /1 M Valid N.E. Compare RDX:RAX with m128. If equal, set ZF and load 

CMPXCHG16B m128 RCX:RBX into m128. Else, clear ZF and load m128 into 
RDX:RAX. 

NOTES: 


*See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
Description 


Compares the 64-bit value in EDX:EAX (or 128-bit value in RDX:RAX if operand size is 128 bits) with the operand 
(destination operand). If the values are equal, the 64-bit value in ECX:EBX (or 128-bit value in RCX:RBX) is stored 
in the destination operand. Otherwise, the value in the destination operand is loaded into EDX:EAX (or RDX:RAX). 
The destination operand is an 8-byte memory location (or 16-byte memory location if operand size is 128 bits). For 
the EDX:EAX and ECX:EBX register pairs, EDX and ECX contain the high-order 32 bits and EAX and EBX contain the 
low-order 32 bits of a 64-bit value. For the RDX:RAX and RCX:RBX register pairs, RDX and RCX contain the high- 
order 64 bits and RAX and RBX contain the low-order 64bits of a 128-bit value. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. To simplify the 
interface to the processor’s bus, the destination operand receives a write cycle without regard to the result of the 
comparison. The destination operand is written back if the comparison fails; otherwise, the source operand is 

written into the destination. (The processor never produces a locked read without also producing a locked write. ) 


In 64-bit mode, default operation size is 64 bits. Use of the REX.W prefix promotes operation to 128 bits. Note that 
CMPXCHG16B requires that the destination (memory) operand be 16-byte aligned. See the summary chart at the 
beginning of this section for encoding data and limits. For information on the CPUID flag that indicates 
CMPXCHG16B, see page 3-237. 


IA-32 Architecture Compatibility 
This instruction encoding is not supported on Intel processors earlier than the Pentium processors. 
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Operation 


IF (64-Bit Mode and OperandSize = 64) 
THEN 
TEMP128 := DEST 
IF (RDX:RAX = TEMP128) 


THEN 

ZF := 1; 

DEST := RCX:RBX; 
ELSE 

ZF := 0; 


RDX:RAX := TEMP128; 
DEST := TEMP128; 
Fl; 
Fl 
ELSE 
TEMP64 := DEST; 
IF (EDX:EAX = TEMP64) 


THEN 

ZF := 1; 

DEST := ECX:EBX; 
ELSE 

ZF := 0; 


EDX:EAX := TEMP64; 
DEST := TEMP64; 
Fl; 
Fl; 
Fl; 


Flags Affected 


The ZF flag is set if the destination operand and EDX:EAX are equal; otherwise it is cleared. The CF, PF, AF, SF, and 
OF flags are unaffected. 


Protected Mode Exceptions 

#UD If the destination is not a memory operand. 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 


Real-Address Mode Exceptions 


#UD If the destination operand is not a memory location. 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
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Virtual-8086 Mode Exceptions 


#UD If the destination operand is not a memory location. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
If memory operand for CMPXCHG16B is not aligned on a 16-byte boundary. 
If CPUID.01H:ECX.CMPXCHG16B[bit 13] = 0. 


#UD If the destination operand is not a memory location. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 
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COMISD—Compare Scalar Ordered Double-Precision Floating-Point Values and Set EFLAGS 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 2F /r A VV SSE2 Compare low double-precision floating-point values in 
COMISD xmm1, xmm2/m64 xmm1 and xmm2/mem64 and set the EFLAGS flags 
accordingly. 
VEX.LIG.66.0F.WIG 2F /r A VV AVX Compare low double-precision floating-point values in 
VCOMISD xmm1, xmm2/m64 xmm1 and xmm2/mem64 and set the EFLAGS flags 
accordingly. 
EVEX.LLIG.66.0F.W1 2F /r B VIV AVX512F | Compare low double-precision floating-point values in 
VCOMISD xmm1, xmm2/m64{sae} xmm1 and xmm2/mem64 and set the EFLAGS flags 
accordingly. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Compares the double-precision floating-point values in the low quadwords of operand 1 (first operand) and 
operand 2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unor- 
dered, greater than, less than, or equal). The OF, SF and AF flags in the EFLAGS register are set to 0. The unor- 
dered result is returned if either source operand is a NaN (QNaN or SNaN). 

Operand 1 is an XMM register; operand 2 can be an XMM register or a 64 bit memory location. The COMISD instruc- 
tion differs from the UCOMISD instruction in that it signals a SIMD floating-point invalid operation exception (#1) 
when a source operand is either a QNaN or SNaN. The UCOMISD instruction signals an invalid operation exception 
only if a source operand is an SNaN. 

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated. 

VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCOMISD is encoded with VEX.L=0. Encoding VCOMISD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 
COMISD (all versions) 
RESULT := OrderedCompare(DEST[63:0] <> SRC[63:0)) { 
(* Set EFLAGS *) CASE (RESULT) OF 
UNORDERED: ZF,PF,CF := 111; 
GREATER_THAN: ZF,PF,CF := 000; 
LESS_THAN: ZF,PF,CF := 001; 
EQUAL: ZF,PF,CF := 100; 


ESAC; 
OF, AF, SF := 0; } 
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Intel C/C++ Compiler Intrinsic Equivalent 


VCOMISD int __mm_comi_round_sd(__m128d a, ___m128d }, int imm, int sae); 
VCOMISD int __mm_comieq_sd (__m128d a,__m128d b) 

VCOMISD int __mm_comilt_sd (__m128d a,__m128d b) 

VCOMISD int __mm_comile_sd (__m128d a, ___m128d b) 

VCOMISD int __mm_comigt_sd (__m128d a,__m128d b) 

VCOMISD int __mm_comige_sd (__m128d a,__m128d b) 

VCOMISD int __mm_comineq_sd (__m128d a,__m128d b) 


SIMD Floating-Point Exceptions 
Invalid (if SNaN or QNaN operands), Denormal. 


Other Exceptions 


VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
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EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 


Additionally: 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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COMISS—Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
NP OF 2F /r A VIV SSE Compare low single-precision floating-point values in 
COMISS xmm1, xmm2/m32 xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 
VEX.LIG.OF.WIG 2F /r A VIV AVX Compare low single-precision floating-point values in 
VCOMISS xmm1, xmm2/m32 xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 
EVEX.LLIG.OF.WO 2F /r B VIV AVX512F Compare low single-precision floating-point values in 
VCOMISS xmm1, xmm2/m32{sae} xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Compares the single-precision floating-point values in the low quadwords of operand 1 (first operand) and operand 
2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unordered, 
greater than, less than, or equal). The OF, SF and AF flags in the EFLAGS register are set to 0. The unordered result 
is returned if either source operand is a NaN (QNaN or SNaN). 

Operand 1 is an XMM register; operand 2 can be an XMM register or a 32 bit memory location. 

The COMISS instruction differs from the UCOMISS instruction in that it signals a SIMD floating-point invalid opera- 
tion exception (#I) when a source operand is either a QNaN or SNaN. The UCOMISS instruction signals an invalid 
operation exception only if a source operand is an SNaN. 

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated. 

VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCOMISS is encoded with VEX.L=0. Encoding VCOMISS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 
COMISS (all versions) 
RESULT := OrderedCompare(DEST[31:0] <> SRC[31:0]) { 
(* Set EFLAGS *) CASE (RESULT) OF 
UNORDERED: ZF,PF,CF := 111; 
GREATER_THAN: ZF,PF,CF := 000; 
LESS_THAN: ZF,PF,CF := 001; 
EQUAL: ZF,PF,CF := 100; 
ESAC; 
OF, AF, SF := 0; } 
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Intel C/C++ Compiler Intrinsic Equivalent 


VCOMISS int __mm_comi_round_ss(__m128 a, ___m128, int imm, int sae); 
VCOMISS int __mm_comieq_ss (__m128 a,__m128 b) 

VCOMISS int __mm_comilt_ss (__m128 a,__m128 b) 

VCOMISS int __mm_comile_ss (_m128 a,__m128 b) 

VCOMISS int __mm_comigt_ss (__m128 a, __m128 b) 

VCOMISS int __mm_comige_ss (__m128 a,__m128 b) 

VCOMISS int __mm_comineq_ss (__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
Invalid (if SNaN or QNaN operands), Denormal. 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 


Additionally: 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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Ui 


EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions” 
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CPUID—CPU Identification 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF A2 CPUID ZO | Valid Valid Returns processor identification and feature 


information to the EAX, EBX, ECX, and EDX 
registers, as determined by input entered in 
EAX (in some cases, ECX as well). 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


The ID flag (bit 21) in the EFLAGS register indicates support for the CPUID instruction. If a software procedure can 
set and clear this flag, the processor executing the procedure supports the CPUID instruction. This instruction oper- 
ates the same in non-64-bit modes and 64-bit mode. 


CPUID returns processor identification and feature information in the EAX, EBX, ECX, and EDX registers.! The 
instruction’s output is dependent on the contents of the EAX register upon execution (in some cases, ECX as well). 
For example, the following pseudocode loads EAX with OOH and causes CPUID to return a Maximum Return Value 
and the Vendor Identification String in the appropriate registers: 


MOV EAX, OOH 
CPUID 


Table 3-8 shows information returned, depending on the initial value loaded into the EAX register. 


Two types of information are returned: basic and extended function information. If a value entered for CPUID.EAX 
is higher than the maximum input value for basic or extended function for that processor then the data for the 
highest basic information leaf is returned. For example, using some Intel processors, the following is true: 

CPUID.EAX = O5H (* Returns MONITOR/MWAIT leaf. *) 

CPUID.EAX = OAH (* Returns Architectural Performance Monitoring leaf. *) 

CPUID.EAX = OBH (* Returns Extended Topology Enumeration leaf. aye 

CPUID.EAX =1FH (* Returns V2 Extended Topology Enumeration leaf. *2 

CPUID.EAX = 80000008H (* Returns linear/physical address size data. *) 

CPUID.EAX = 8000000AH (* INVALID: Returns same information as CPUID.EAX = OBH. *) 


If a value entered for CPUID.EAX is less than or equal to the maximum input value and the leaf is not supported on 
that processor then 0 is returned in all the registers. 


When CPUID returns the highest basic leaf information as a result of an invalid input EAX value, any dependence 
on input ECX value in the basic leaf is honored. 


CPUID can be executed at any privilege level to serialize instruction execution. Serializing instruction execution 
guarantees that any modifications to flags, registers, and memory for previous instructions are completed before 
the next instruction is fetched and executed. 


See also: 


“Serializing Instructions” in Chapter 8, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3A. 


“Caching Translation Information” in Chapter 4, “Paging,” in the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 3A. 


1. On Intel 64 processors, CPUID clears the high 32 bits of the RAX/RBX/RCX/RDX registers in all modes. 


2. CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence of CPUID leaf 1FH before using 
leaf OBH. 
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Table 3-8. Information Returned by CPUID Instruction 


Initial EAX 
Value Information Provided about the Processor 
Basic CPUID Information 
OH EAX Maximum Input Value for Basic CPUID Information. 
EBX “Genu” 
ECX “ntel” 
EDX “inel” 
01H EAX Version Information: Type, Family, Model, and Stepping ID (see Figure 3-6). 
EBX Bits 07 - OO: Brand Index. 
Bits 15 - 08: CLFLUSH line size (Value * 8 = cache line size in bytes; used also by CLFLUSHOPT). 
Bits 23 - 16: Maximum number of addressable IDs for logical processors in this physical package*. 
Bits 31 - 24: Initial APIC ID**. 
ECX Feature Information (see Figure 3-7 and Table 3-10). 
EDX Feature Information (see Figure 3-8 and Table 3-11). 
NOTES: 
* The nearest power-of-2 integer that is not smaller than EBX[23:16] is the number of unique initial APIC 
IDs reserved for addressing different logical processors in a physical package. This field is only valid if 
CPUID.1.EDX.HTT[bit 28]= 1. 
** The 8-bit initial APIC ID in EBX[31:24] is replaced by the 32-bit x2APIC ID, available in Leaf OBH and 
Leaf 1FH. 
02H EAX Cache and TLB Information (see Table 3-12). 
EBX Cache and TLB Information. 
ECX Cache and TLB Information. 
EDX Cache and TLB Information. 
03H EAX Reserved. 
EBX Reserved. 
ECX Bits 00 - 31 of 96 bit processor serial number. (Available in Pentium Ill processor only; otherwise, the 
value in this register is reserved.) 
EDX Bits 32 - 63 of 96 bit processor serial number. (Available in Pentium Ill processor only; otherwise, the 
value in this register is reserved.) 
NOTES: 


Processor serial number (PSN) is not supported in the Pentium 4 processor or later. On all models, use 
the PSN flag (returned using CPUID) to check for PSN support before accessing the feature. 


CPUID leaves above 2 and below 80000000H are visible only when IA32_MISC_ENABLE[bit 22] has its default value of 0. 


Deterministic Cache Parameters Leaf 


04H 


NOTES: 
Leaf 04H output depends on the initial value in ECX.* 
See also: “INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level” on page 244. 


EAX Bits 04 - OO: Cache Type Field. 
O = Null - No more caches. 
1 = Data Cache. 
2 = Instruction Cache. 
3 = Unified Cache. 
4-31 = Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
Bits 07 - 05: Cache Level (starts at 1). 
Bit 08: Self Initializing cache level (does not need SW initialization). 
Bit 09: Fully Associative cache. 
Bits 13 - 10: Reserved. 
Bits 25 - 14: Maximum number of addressable IDs for logical processors sharing this cache**, ***. 
Bits 31 - 26: Maximum number of addressable IDs for processor cores in the physical 
package**, Bis REEEE 
EBX Bits 11 - 00: L = System Coherency Line Size**. 
Bits 21 - 12: P = Physical Line partitions**. 
Bits 31 - 22: W = Ways of associativity**. 
ECX Bits 31-00: S = Number of Sets**. 
EDX Bit 00: Write-Back Invalidate/Invalidate. 
O = WBINVD/INVD from threads sharing this cache acts upon lower level caches for threads sharing this 
cache. 
1 = WBINVD/INVD is not guaranteed to act upon lower level caches of non-originating threads sharing 
this cache. 
Bit 01: Cache Inclusiveness. 
O = Cache is not inclusive of lower cache levels. 
1 = Cache is inclusive of lower cache levels. 
Bit 02: Complex Cache Indexing. 
O = Direct mapped cache. 
1 = A complex function is used to index the cache, potentially using all address bits. 
Bits 31 - 03: Reserved = 0. 
NOTES: 
* If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n+1 is invalid if sub- 
leaf n returns EAX[4:0] as 0. 
** Add one to the return value to get the result. 
***The nearest power-of-2 integer that is not smaller than (1 + EAX[25:14]) is the number of unique ini- 
tial APIC IDs reserved for addressing different logical processors sharing this cache. 
**** The nearest power-of-2 integer that is not smaller than (1 + EAX[31:26]) is the number of unique 
Core_IDs reserved for addressing different processor cores in a physical package. Core ID is a subset of 
bits of the initial APIC ID. 
***** The returned value is constant for valid initial values in ECX. Valid ECX values start from 0. 
MONITOR/MWAIT Leaf 
05H EAX Bits 15 - 00: Smallest monitor-line size in bytes (default is processor's monitor granularity). 
Bits 31 - 16: Reserved = 0. 
EBX Bits 15 - 00: Largest monitor-line size in bytes (default is processor's monitor granularity). 
Bits 31 - 16: Reserved = 0. 
ECX Bit OO: Enumeration of Monitor-Mwait extensions (beyond EAX and EBX registers) supported. 
Bit 01: Supports treating interrupts as break-event for MWAIT, even when interrupts disabled. 
Bits 31 - O02: Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


EDX Bits 03 - OO: Number of CO* sub C-states supported using MWAIT. 
Bits 07 - 04: Number of C1* sub C-states supported using MWAIT. 
Bits 11 - 08: Number of C2* sub C-states supported using MWAIT. 
Bits 15 - 12: Number of C3* sub C-states supported using MWAIT. 
Bits 19 - 16: Number of C4* sub C-states supported using MWAIT. 
Bits 23 - 20: Number of C5* sub C-states supported using MWAIT. 
Bits 27 - 24: Number of C6* sub C-states supported using MWAIT. 
Bits 31 - 28: Number of C7* sub C-states supported using MWAIT. 
NOTE: 

* The definition of CO through C7 states for MWAIT extension are processor-specific C-states, not ACPI C- 
States. 


Thermal and Power Management Leaf 


O6H 


EAX Bit 00: Digital temperature sensor is supported if set. 
Bit 01: Intel Turbo Boost Technology available (see description of [A32_MISC_ENABLE[38)}). 
Bit 02: ARAT. APIC-Timer-always-running feature is supported if set. 
Bit 03: Reserved. 
Bit 04: PLN. Power limit notification controls are supported if set. 
Bit 05: ECMD. Clock modulation duty cycle extension is supported if set. 
Bit 06: PTM. Package thermal management is supported if set. 
Bit 07: HWP. HWP base registers (IA32_PM_ENABLE[bit 0], IA32_HWP_CAPABILITIES, 
IA32_HWP_REQUEST, IA32_HWP_STATUS) are supported if set. 
Bit 08: HWP_Notification. |A32_HWP_INTERRUPT MSR is supported if set. 
Bit 09: HWP_Activity_Window. IA32_HWP_REQUESTIbits 41:32] is supported if set. 
Bit 10: HWP_Energy_Performance_Preference. |[A32_HWP_REQUEST\Ibits 31:24] is supported if set. 
Bit 11: HWP_Package_Level_Request. IA32_HwP_REQUEST_PKG MSR is supported if set. 
Bit 12: Reserved. 
Bit 13: HDC. HDC base registers [A32_PKG_HDC_CTL, IA32_PM_CTL1, IA32_THREAD_STALL MSRs are 
supported if set. 
Bit 14: Intel? Turbo Boost Max Technology 3.0 available. 
Bit 15: HWP Capabilities. Highest Performance change is supported if set. 
Bit 16: HWP PECI override is supported if set. 
Bit 17: Flexible HWP is supported if set. 
Bit 18: Fast access mode for the [A32_HWP_REQUEST MSR is supported if set. 
Bit 19: HW_FEEDBACK. IA32_Hw_FEEDBACK_PTR MSR, IA32_Hw_FEEDBACK_CONFIG MSR, 
IA32_PACKAGE_THERM_STATUS MSR bit 26, and IA32_PACKAGE_THERM_INTERRUPT MSR bit 25 are 
supported if set. 
Bit 20: Ignoring Idle Logical Processor HWP request is supported if set. 
Bits 31 - 21: Reserved. 


EBX Bits 03 - OO: Number of Interrupt Thresholds in Digital Thermal Sensor. 
Bits 31 - 04: Reserved. 
ECX Bit 00: Hardware Coordination Feedback Capability (Presence of IA32_MPERF and IA32_APERF). The 


capability to provide a measure of delivered processor performance (since last reset of the counters), as 
a percentage of the expected processor performance when running at the TSC frequency. 

Bits 02 - 01: Reserved = 0. 

Bit 03: The processor supports performance-eneray bias preference if CPUID.O6H:ECX.SETBH[bit 3] is set 
and it also implies the presence of a new architectural MSR called [A32_ENERGY_PERF_BIAS (1BOH). 
Bits 31 - 04: Reserved = 0. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


EDX Bits 7-0: Bitmap of supported hardware feedback interface capabilities. 

O = When set to 1, indicates support for performance capability reporting. 

1 = When set to 1, indicates support for energy efficiency capability reporting. 

2-7 = Reserved 
Bits 11-8: Enumerates the size of the hardware feedback interface structure in number of 4 KB pages; 
add one to the return value to get the result. 
Bits 31-16: Index (starting at 0) of this logical processor's row in the hardware feedback interface struc- 
ture. Note that on some parts the index may be same for multiple logical processors. On some parts the 
indices may not be contiguous, i.e., there may be unused rows in the hardware feedback interface struc- 
ture. 
NOTE: 
Bits O and 1 will always be set together. 


Structured Extended Feature Flags Enumeration Leaf (Output depends on ECX input value) 


07H 


Sub-leaf O (Input ECX = 0). * 


EAX Bits 31 - 00: Reports the maximum input value for supported leaf 7 sub-leaves. 


EBX Bit 00: FSGSBASE. Supports RDFSBASE/RDGSBASE/WRFSBASE/WRGSBASE if 1. 
Bit 01: [A32_TSC_ADJUST MSR is supported if 1. 
Bit O02: SGX. Supports Intel® Software Guard Extensions (Intel® SGX Extensions) if 1. 
Bit 03: BMI1. 
Bit 04: HLE. 
Bit 05: AVX2. 
Bit 06: FDP_EXCPTN_ONLY. x87 FPU Data Pointer updated only on x87 exceptions if 1. 
Bit 07: SMEP. Supports Supervisor-Mode Execution Prevention if 1. 
Bit 08: BMI. 
Bit 09: Supports Enhanced REP MOVSB/STOSB if 1. 
Bit 10: INVPCID. If 1, supports INVPCID instruction for system software that manages process-context 
identifiers. 
Bit 11: RTM. 
Bit 12: RDT-M. Supports Intel® Resource Director Technology (Intel? RDT) Monitoring capability if 1. 
Bit 13: Deprecates FPU CS and FPU DS values if 1. 
Bit 14: MPX. Supports Intel® Memory Protection Extensions if 1. 
Bit 15: RDT-A. Supports Intel® Resource Director Technology (Intel® RDT) Allocation capability if 1. 
Bit 16: AVX512F. 
Bit 17: AVX512DQ. 
Bit 18: RDSEED. 
Bit 19: ADX. 
Bit 20: SMAP. Supports Supervisor-Mode Access Prevention (and the CLAC/STAC instructions) if 1. 
Bit 21: AVX512_IFMA. 
Bit 22: Reserved. 
Bit 23: CLFLUSHOPT. 
Bit 24: CLWB. 
Bit 25: Intel Processor Trace. 
Bit 26: AVX512PF. (Intel? Xeon Phi™ only.) 
Bit 27: AVX512ER. (Intel? Xeon Phi™ only.) 
Bit 28: AVX512CD. 
Bit 29: SHA. supports Intel® Secure Hash Algorithm Extensions (Intel® SHA Extensions) if 1. 
Bit 30: AVX512BW. 
Bit 31: AVX512VL. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 


ECX Bit OO: PREFETCHWT 1. (Intel? Xeon Phi™ only.) 
Bit 01: AVX512_VBMI. 
Bit 02: UMIP. Supports user-mode instruction prevention if 1. 
Bit 03: PKU. Supports protection keys for user-mode pages if 1. 
Bit 04: OSPKE. If 1, OS has set CR4.PKE to enable protection keys (and the RDPKRU/WRPKRU instruc- 
tions). 
Bit 05: WAITPKG. 
Bit 06: AVX512_VBMIe. 
Bit 07: CET_SS. Supports CET shadow stack features if 1. Processors that set this bit define bits 1:0 of the 
IA32_U_CET and IA32_S_CET MSRs. Enumerates support for the following MSRs: 
IA32_INTERRUPT_SPP_TABLE_ADDR, IA32_PL3_SSP, [A32_PL2_SSP, [A32_PL1_SSP, and 
IA32_PLO_SSP. 
Bit 08: GFNI. 
Bit 09: VAES. 
Bit 10: VPCLMULQDOQ. 
Bit 11: AVX512_VNNI. 
Bit 12: AVX512_BITALG. 
Bits 13: TME_EN. If 1, the following MSRs are supported: IA32_TME_CAPABILITY, IA32_TME_ACTIVATE, 
IA32_TME_EXCLUDE_MASK, and IA32_TME_EXCLUDE_BASE. 
Bit 14: AVX512_VPOPCNTDO. 
Bit 15: Reserved. 
Bit 16: LA57. Supports 57-bit linear addresses and five-level paging if 1. 
Bits 21 - 17: The value of MAWAU used by the BNDLDX and BNDSTX instructions in 64-bit mode. 
Bit 22: RDPID and |[A32_TSC_AUX are available if 1. 
Bit 23: KL. Supports Key Locker if 1. 
Bit 24: Reserved. 
Bit 25: CLDEMOTE. Supports cache line demote if 1. 
Bit 26: Reserved. 
Bit 27: MOVDIRI. Supports MOVDIRI if 1. 
Bit 28: MOVDIRG4B. Supports MOVDIRG4B if 1. 
Bit 29: Reserved. 
Bit 30: SGX_LC. Supports SGX Launch Configuration if 1. 
Bit 31: PKS. Supports protection keys for supervisor-mode pages if 1. 


EDX Bit 01: Reserved. 
Bit 02: AVX512_4VNNIW. (Intel? Xeon Phi™ only.) 
Bit 03: AVX512_4FMAPS. (Intel? Xeon Phi™ only.) 
Bit 04: Fast Short REP MOV. 
Bits 07-05: Reserved. 
Bit 08: AVX512_VP2INTERSECT. 
Bit 09: Reserved. 
Bit 10: MD_CLEAR supported. 
Bits 14-11: Reserved. 
Bit 15: Hybrid. If 1, the processor is identified as a hybrid part. 
Bits 17-16: Reserved. 
Bit 18: PCONFIG. Supports PCONFIG if 1. 
Bit 19: Reserved. 
Bit 20: CET_IBT. Supports CET indirect branch tracking features if 1. Processors that set this bit define 
bits 5:2 and bits 63:10 of the [A32_U_CET and IA32_S_CET MSRs. 
Bits 25 - 21: Reserved. 
Bit 26: Enumerates support for indirect branch restricted speculation (IBRS) and the indirect branch pre- 
dictor barrier (IBPB). Processors that set this bit support the [A32_SPEC_CTRL MSR and the 
IA32_PRED_CMD MSR. They allow software to set [A32_SPEC_CTRL[O] (IBRS) and [A32_PRED_CMD[0O] 
(IBPB). 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 


Bit 27: Enumerates support for single thread indirect branch predictors (STIBP). Processors that set this 
bit support the [A32_SPEC_CTRL MSR. They allow software to set [A32_SPEC_CTRL[1] (STIBP). 

Bit 28: Enumerates support for L1D_FLUSH. Processors that set this bit support the [A32_FLUSH_CMD 
MSR. They allow software to set [A32_FLUSH_CMD[0] (L1D_FLUSH). 

Bit 29: Enumerates support for the IA32_ARCH_CAPABILITIES MSR. 

Bit 30: Enumerates support for the IA32_CORE_CAPABILITIES MSR. 

1A32_CORE_CAPABILITIES is an architectural MSR that enumerates model-specific features. A bit being 
set in this MSR indicates that a model specific feature is supported; software must still consult CPUID 
family/model/stepping to determine the behavior of the enumerated feature as features enumerated in 
IA32_CORE_CAPABILITIES may have different behavior on different processor models. 

Additionally, on hybrid parts (CPUID.O7H.OH:EDX[15]=1), software must consult the native model ID and 
core type from the Hybrid Information Enumeration Leaf. 

Bit 31: Enumerates support for Speculative Store Bypass Disable (SSBD). Processors that set this bit sup- 
port the IA32_SPEC_CTRL MSR. They allow software to set [A32_SPEC_CTRL[2] (SSBD). 


NOTE: 
* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf 0 returns in EAX. 
Structured Extended Feature Enumeration Sub-leaf (EAX = 07H, ECX = 1) 


07H NOTES: 


Leaf 07H output depends on the initial value in ECX. 
If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. 


EAX This field reports O if the sub-leaf index, 7, is invalid. 
Bits 04-00: Reserved. 
Bit 05: AVX512_BF16. Vector Neural Network Instructions supporting BFLOAT16 inputs and conversion 
instructions from IEEE single precision. 
Bits 31-06: Reserved. 


EBX This field reports O if the sub-leaf index, 7, is invalid; otherwise it is reserved. 
ECX This field reports O if the sub-leaf index, 7, is invalid; otherwise it is reserved. 
EDX This field reports O if the sub-leaf index, 7, is invalid; otherwise it is reserved. 


Direct Cache Access Information Leaf 


09H EAX Value of bits [31:0] of IA32_PLATFORM_DCA_CAP MSR (address 1F8H). 
EBX Reserved. 
ECX Reserved. 
EDX Reserved. 


Architectural Performance Monitoring Leaf 


OAH EAX Bits 07 - OO: Version ID of architectural performance monitoring. 

Bits 15 - 08: Number of general-purpose performance monitoring counter per logical processor. 

Bits 23 - 16: Bit width of general-purpose, performance monitoring counter. 

Bits 31 - 24: Length of EBX bit vector to enumerate architectural performance monitoring events. Archi- 
tectural event x is supported if EBX[x]=0 && EAX[31:24]>x. 
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Value Information Provided about the Processor 

EBX Bit 00: Core cycle event not available if 1 or if EAX[31:24]<1. 
Bit 01: Instruction retired event not available if 1 or if EAX[31:24]<2. 
Bit 02: Reference cycles event not available if 1 or if EAX[31:24]<3. 
Bit 03: Last-level cache reference event not available if 1 or if EAX[31:24]<4. 
Bit 04: Last-level cache misses event not available if 1 or if EAX[31:24]<5. 
Bit 05: Branch instruction retired event not available if 1 or if EAX[31:24]<6. 
Bit O6: Branch mispredict retired event not available if 1 or if EAX[31:24]<7. 
Bit 07: Top-down slots event not available if 1 or if EAX[31:24]<8. 
Bits 31 - 08: Reserved = 0. 

ECX Bits 31 - 00: Supported fixed counters bit mask. Fixed-function performance counter ‘i’ is supported if bit 
‘is 1 (first counter index starts at zero). It is recommended to use the following logic to determine if a 
Fixed Counter is supported: FxCtr[i]_is_ supported := ECX{i] || (EDX[4:0] > i); 

EDX Bits 04 - 00: Number of contiguous fixed-function performance counters starting from 0 (if Version ID > 
1). 
Bits 12 - 05: Bit width of fixed-function performance counters (if Version ID > 1). 
Bits 14 - 13: Reserved = 0. 
Bit 15: AnyThread deprecation. 
Bits 31 - 16: Reserved = 0. 

Extended Topology Enumeration Leaf 

OBH NOTES: 


EAX 


EBX 


ECX 


EDX 


CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence 
of Leaf 1FH before using leaf OBH. 


Most of Leaf OBH output depends on the initial value in ECX. 

The EDX output of leaf OBH is always valid and does not vary with input value in ECX. 

Output value in ECX[7:0] always equals input value in ECX[7:0]. 

Sub-leaf index O enumerates SMT level. Each subsequent higher sub-leaf index enumerates a higher- 
level topological entity in hierarchical order. 

For sub-leaves that return an invalid level-type of O in ECX[15:8]; EAX and EBX will return O. 


If an input value n in ECX returns the invalid level-type of O in ECX[15:8], other input values with ECX > 
n also return O in ECX[1 5:8]. 


Bits 04 - 00: Number of bits to shift right on x2APIC ID to get a unique topology ID of the next level type’. 
All logical processors with the same next level ID share current level. 
Bits 31 - 05: Reserved. 


Bits 15 - 00: Number of logical processors at this level type. The number reflects configuration as shipped 
by Intel**. 
Bits 31- 16: Reserved. 


Bits 07 - OO: Level number. Same value in ECX input. 
Bits 15 - 08: Level type***. 
Bits 31 - 16: Reserved. 


Bits 31- 00: x2APIC ID the current logical processor. 


NOTES: 
* Software should use this field (EAX[4:0]) to enumerate processor topology of the system. 
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Initial EAX 
Value 


Information Provided about the Processor 


** Software must not use EBX[15:0] to enumerate processor topology of the system. This value in this 
field (EBX[15:0]) is only intended for display/diagnostic purposes. The actual number of logical processors 
available to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software 
and platform hardware configurations. 


*** The value of the “level type” field is not related to level numbers in any way, higher “level type” val- 
ues do not mean higher levels. Level type field has the following encoding: 

0: Invalid. 

1: SMT. 

2: Core. 

3-255: Reserved. 


Processor Extended State Enumeration Main Leaf (EAX = ODH, ECX = 0) 


ODH 


EAX 


EBX 


ECX 


EDX 


NOTES: 
Leaf ODH main leaf (ECX = 0). 


Bits 31 - 00: Reports the supported bits of the lower 32 bits of XCRO. XCRO[n] can be set to 1 only if 
EAX[n] is 1. 

Bit 00: x87 state. 

Bit 01: SSE state. 

Bit O2: AVX state. 

Bits 04 - 03: MPX state. 

Bits 07 - 05: AVX-512 state. 
Bit 08: Used for IA32_XSS. 
Bit 09: PKRU state. 

Bits 12 - 10: Reserved. 

Bit 13: Used for IA32_XSS. 
Bits 15 - 14: Reserved. 

Bit 16: Used for IA32_XSS. 
Bits 31 - 17: Reserved. 


Bits 31 - 00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) required by 
enabled features in XCRO. May be different than ECX if some features at the end of the XSAVE save area 
are not enabled. 


Bit 31 - 00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) of the 
XSAVE/XRSTOR save area required by all supported features in the processor, i.e., all the valid bit fields in 
XCRO. 


Bit 31 - 00: Reports the supported bits of the upper 32 bits of XCRO. XCRO[n+32] can be set to 1 only if 
EDX[n] is 1. 
Bits 31 - OO: Reserved. 


Processor Extended State Enumeration Sub-leaf (EAX = ODH, ECX = 1) 


ODH 


EAX 


EBX 


Bit 00: XSAVEOPT is available. 

Bit 01: Supports XSAVEC and the compacted form of XRSTOR if set. 
Bit O02: Supports XGETBV with ECX = 1 if set. 

Bit 03: Supports XSAVES/XRSTORS and IA32_XSS if set. 

Bits 31 - 04: Reserved. 


Bits 31 - 00: The size in bytes of the XSAVE area containing all states enabled by XCRO | [A32_XSS. 
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Value Information Provided about the Processor 


ECX Bits 31 - OO: Reports the supported bits of the lower 32 bits of the IA32_XSS MSR. IA32_XSS[n] can be 
set to 1 only if ECX[n] is 1. 
Bits 07 - 00: Used for XCRO. 
Bit 08: PT state. 

Bit 09: Used for XCRO. 

Bit 10: Reserved. 

Bit 11: CET user state. 

Bit 12: CET supervisor state. 
Bit 13: HDC state. 

Bits 15 - 14: Reserved. 

Bit 16: HWP state. 

Bits 31 - 17: Reserved. 


EDX Bits 31 - O00: Reports the supported bits of the upper 32 bits of the IA32_XSS MSR. IA32_XSS[n+32] can 
be set to 1 only if EDX[n] is 1. 
Bits 31 - 00: Reserved. 


Processor Extended State Enumeration Sub-leaves (EAX = ODH, ECX = n,n > 1) 


ODH NOTES: 

Leaf ODH output depends on the initial value in ECX. 

Each sub-leaf index (starting at position 2) is supported if it corresponds to a supported bit in either the 

XCRO register or the [A32_XSS MSR. 

* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return O. Sub-leaf n (0 < n < 31) is invalid 
if sub-leaf O returns O in EAX[n] and sub-leaf 1 returns O in ECX[n]. Sub-leaf n (32 <n < 63) is invalid if 
sub-leaf O returns O in EDX[n-32] and sub-leaf 1 returns O in EDX[n-32]. 


EAX Bits 31 - 0: The size in bytes (from the offset specified in EBX) of the save area for an extended state 
feature associated with a valid sub-leaf index, n. 


EBX Bits 31 - 0: The offset in bytes of this extended state component's save area from the beginning of the 
XSAVE/XRSTOR area. 
This field reports O if the sub-leaf index, n, does not map to a valid bit in the XCRO register*. 

ECX Bit 00 is set if the bit n (corresponding to the sub-leaf index) is supported in the [A32_XSS MSR; it is clear 


if bit n is instead supported in XCRO. 

Bit 01 is set if, when the compacted format of an XSAVE area is used, this extended state component 
located on the next 64-byte boundary following the preceding state component (otherwise, it is located 
immediately following the preceding state component). 

Bits 31 - O02 are reserved. 

This field reports O if the sub-leaf index, n, is invalid*. 


EDX This field reports O if the sub-leaf index, n, is invalid*; otherwise it is reserved. 
Intel Resource Director Technology (Inte! RDT) Monitoring Enumeration Sub-leaf (EAX = OFH, ECX = 0) 
OFH NOTES: 


Leaf OFH output depends on the initial value in ECX. 
Sub-leaf index O reports valid resource type starting at bit position 1 of EDX. 


EAX Reserved. 

EBX Bits 31 - 00: Maximum range (zero-based) of RMID within this physical processor of all types. 
ECX Reserved. 

EDX Bit 00: Reserved. 


Bit 01: Supports L3 Cache Intel RDT Monitoring if 1. 
Bits 31 - 02: Reserved. 
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Value Information Provided about the Processor 
L3 Cache Intel RDT Monitoring Capability Enumeration Sub-leaf (EAX = OFH, ECX = 1) 
OFH NOTES: 
Leaf OFH output depends on the initial value in ECX. 
EAX Reserved. 
EBX Bits 31 - 00: Conversion factor from reported [A32_QM_CTR value to occupancy metric (bytes) and Mem- 
ory Bandwidth Monitoring (MBM) metrics. 
ECX Maximum range (zero-based) of RMID of this resource type. 
EDX Bit 00: Supports L3 occupancy monitoring if 1. 
Bit 01: Supports L3 Total Bandwidth monitoring if 1. 
Bit O2: Supports L3 Local Bandwidth monitoring if 1. 
Bits 31 - 03: Reserved. 
Intel Resource Director Technology (Intel RDT) Allocation Enumeration Sub-leaf (EAX = 10H, ECX = OQ) 
10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 
Sub-leaf index O reports valid resource identification (ResID) starting at bit position 1 of EBX. 
EAX Reserved. 
EBX Bit 00: Reserved. 
Bit 01: Supports L3 Cache Allocation Technology if 1. 
Bit 02: Supports L2 Cache Allocation Technology if 1. 
Bit 03: Supports Memory Bandwidth Allocation if 1. 
Bits 31 - 04: Reserved. 
ECX Reserved. 
EDX Reserved. 
L3 Cache Allocation Technology Enumeration Sub-leaf (EAX = 10H, ECX = ResID =1) 
10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 
EAX Bits 04 - 00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to 
get the result. 
Bits 31 - 05: Reserved. 
EBX Bits 31 - 00: Bit-granular map of isolation/contention of allocation units. 
ECX Bits 01- 00: Reserved. 
Bit O2: Code and Data Prioritization Technology supported if 1. 
Bits 31 - 03: Reserved. 
EDX Bits 15 - 00: Highest COS number supported for this ResID. 
Bits 31 - 16: Reserved. 
L2 Cache Allocation Technology Enumeration Sub-leaf (EAX = 10H, ECX = ResID =2) 
10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 
EAX Bits 04 - 00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to 
get the result. 
Bits 31 - 05: Reserved. 
EBX Bits 31 - 00: Bit-granular map of isolation/contention of allocation units. 
ECX Bits 31 - 00: Reserved. 
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Initial EAX 
Value Information Provided about the Processor 
EDX Bits 15 - OO: Highest COS number supported for this ResID. 
Bits 31 - 16: Reserved. 
Memory Bandwidth Allocation Enumeration Sub-leaf (EAX = 10H, ECX = Res/ID =3) 
10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 
EAX Bits 11 - 00: Reports the maximum MBA throttling value supported for the corresponding ResID. Add one 
to the return value to get the result. 
Bits 31 - 12: Reserved. 
EBX Bits 31 - 00: Reserved. 
ECX Bits 01 - 00: Reserved. 
Bit 02: Reports whether the response of the delay values is linear. 
Bits 31 - 03: Reserved. 
EDX Bits 15 - OO: Highest COS number supported for this ResID. 
Bits 31 - 16: Reserved. 
Intel SGX Capability Enumeration Leaf, sub-leaf O (EAX = 12H, ECX = 0) 
12H NOTES: 
Leaf 12H sub-leaf 0 (ECX = 0) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1. 
EAX Bit 00: SGX1. If 1, Indicates Intel SGX supports the collection of SGX1 leaf functions. 
Bit 01: SGX2. If 1, Indicates Intel SGX supports the collection of SGX2 leaf functions. 
Bits 04 - O02: Reserved. 
Bit 05: If 1, indicates Intel SGX supports ENCLV instruction leaves EINCVIRTCHILD, EDECVIRTCHILD, and 
ESETCONTEXT. 
Bit O6: If 1, indicates Intel SGX supports ENCLS instruction leaves ETRACKC, ERDINFO, ELDBC, and ELDUC. 
Bits 31 - 07: Reserved. 
EBX Bits 31 - OO: MISCSELECT. Bit vector of supported extended SGX features. 
ECX Bits 31 - OO: Reserved. 
EDX Bits 07 - OO: MaxEnclaveSize_Not64. The maximum supported enclave size in non-64-bit mode is 
2”~(EDX[7:0)). 
Bits 15 - 08: MaxEnclaveSize_64. The maximum supported enclave size in 64-bit mode is 2*(EDX[15:8)). 
Bits 31 - 16: Reserved. 
Intel SGX Attributes Enumeration Leaf, sub-leaf 1 (EAX = 12H, ECX = 1) 
12H NOTES: 
Leaf 12H sub-leaf 1 (ECX = 1) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1. 
EAX Bit 31 - OO: Reports the valid bits of SECS.ATTRIBUTES[31:0] that software can set with ECREATE. 
EBX Bit 31 - OO: Reports the valid bits of SECS.ATTRIBUTES[63:32] that software can set with ECREATE. 
ECX Bit 31 - OO: Reports the valid bits of SECS.ATTRIBUTES[95:64] that software can set with ECREATE. 
EDX Bit 31 - OO: Reports the valid bits of SECS.ATTRIBUTES[1 27:96] that software can set with ECREATE. 
Intel SGX EPC Enumeration Leaf, sub-leaves (EAX = 12H, ECX = 2 or higher) 
12H NOTES: 
Leaf 12H sub-leaf 2 or higher (ECX >= 2) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1. 
For sub-leaves (ECX = 2 or higher), definition of EDX,ECX,EBX,EAX[31:4] depends on the sub-leaf type 
listed below. 
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Information Provided about the Processor 


EAX 


Type 


Type 


Bit 03 - 00: Sub-leaf Type 
0000b: Indicates this sub-leaf is invalid. 
0001b: This sub-leaf enumerates an EPC section. EBX:EAX and EDX:ECX provide information on the 
Enclave Page Cache (EPC) section. 
All other type encodings are reserved. 


OOOOb. This sub-leaf is invalid. 
EDX:ECX:EBX:EAX return 0. 


0001b. This sub-leaf enumerates an EPC sections with EDX:ECX, EBX:EAX defined as follows. 


EAX[1 1:04]: Reserved (enumerate 0). 
EAX[31:12]: Bits 31:12 of the physical address of the base of the EPC section. 


EBX[1 9:00}: Bits 51:32 of the physical address of the base of the EPC section. 
EBX[31:20]: Reserved. 


ECX[03:00]: EPC section property encoding defined as follows: 
If ECX[3:0] = OOOO, then all bits of the EDX:ECX pair are enumerated as O. 
If ECX[3:0] = 00015, then this section has confidentiality and integrity protection. 
If ECX[3:0] = 0010b, then this section has confidentiality protection only. 
All other encodings are reserved. 
ECX[1 1:04]: Reserved (enumerate 0). 
ECX[31:12]: Bits 31:12 of the size of the corresponding EPC section within the Processor Reserved 
Memory. 


EDX[1 9:00}: Bits 51:32 of the size of the corresponding EPC section within the Processor Reserved 
Memory. 
EDX[31:20]: Reserved. 


Intel Processor Trace Enumeration Main Leaf (EAX = 14H, ECX = 0) 


14H 


EAX 
EBX 


NOTES: 
Leaf 14H main leaf (ECX = 0). 


Bits 31 - 00: Reports the maximum sub-leaf supported in leaf 14H. 


Bit 00: If 1, indicates that IA32_RTIT_CTL.CR3Filter can be set to 1, and that IA32_RTIT_CR3_MATCH 
MSR can be accessed. 

Bit 01: If 1, indicates support of Configurable PSB and Cycle-Accurate Mode. 

Bit O2: If 1, indicates support of IP Filtering, TraceStop filtering, and preservation of Intel PT MSRs across 
warm reset. 

Bit 03: If 1, indicates support of MTC timing packet and suppression of COFI-based packets. 

Bit 04: If 1, indicates support of PTWRITE. Writes can set IA32_RTIT_CTL[1 2] (PTWEn) and 
1A32_RTIT_CTL[5] (FUPonPTW), and PTWRITE can generate packets. 

Bit 05: If 1, indicates support of Power Event Trace. Writes can set IA32_RTIT_CTL[4] (PwrEvtEn), 
enabling Power Event Trace packet generation. 

Bit O6: If 1, indicates support for PSB and PMI preservation. Writes can set IA32_RTIT_CTL[56] (InjectPsb- 
PmiOnEnable), enabling the processor to set [A32_RTIT_STATUS[7] (PendTopaPMI) and/or 
1A32_RTIT_STATUS[6] (PendPSB) in order to preserve ToPA PMls and/or PSBs otherwise lost due to Intel 
PT disable. Writes can also set PendToPAPMI and PendPSB. 

Bit 31 - 07: Reserved. 
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Initial EAX 
Value Information Provided about the Processor 
ECX Bit OO: If 1, Tracing can be enabled with IA32_RTIT_CTL.ToPA = 1, hence utilizing the ToPA output 
scheme; |A32_RTIT_OUTPUT_BASE and IA32_RTIT_OUTPUT_MASK_PTRS MSRs can be accessed. 
Bit 01: If 1, ToPA tables can hold any number of output entries, up to the maximum allowed by the Mas- 
kOrTableOffset field of IA32_RTIT_OUTPUT_MASK_PTRS. 
Bit O2: If 1, indicates support of Single-Range Output scheme. 
Bit 03: If 1, indicates support of output to Trace Transport subsystem. 
Bit 30 - 04: Reserved. 
Bit 31: If 1, generated packets which contain IP payloads have LIP values, which include the CS base com- 
ponent. 
EDX Bits 31 - 00: Reserved. 
Intel Processor Trace Enumeration Sub-leaf (EAX = 14H, ECX = 1) 
14H EAX Bits O2 - OO: Number of configurable Address Ranges for filtering. 
Bits 15 - 03: Reserved. 
Bits 31 - 16: Bitmap of supported MTC period encodings. 
EBX Bits 15 - OO: Bitmap of supported Cycle Threshold value encodings. 
Bit 31 - 16: Bitmap of supported Configurable PSB frequency encodings. 
ECX Bits 31 - 00: Reserved. 
EDX Bits 31 - 00: Reserved. 
Time Stamp Counter and Nominal Core Crystal Clock Information Leaf 
15H NOTES: 
If EBX[31:0] is O, the TSC/"core crystal clock” ratio is not enumerated. 
EBX[31:0]/EAX[31:0] indicates the ratio of the TSC frequency and the core crystal clock frequency. 
If ECX is O, the nominal core crystal clock frequency is not enumerated. 
“TSC frequency” = “core crystal clock frequency” * EBX/EAX. 
The core crystal clock may differ from the reference clock, bus clock, or core clock frequencies. 
EAX Bits 31 - 00: An unsigned integer which is the denominator of the TSC/"core crystal clock” ratio. 
EBX Bits 31 - 00: An unsigned integer which is the numerator of the TSC/"core crystal clock” ratio. 
ECX Bits 31 - 00: An unsigned integer which is the nominal frequency of the core crystal clock in Hz. 
EDX Bits 31 - 00: Reserved = 0. 
Processor Frequency Information Leaf 
16H EAX Bits 15 - OO: Processor Base Frequency (in MHz). 
Bits 31 - 16: Reserved =0. 
EBX Bits 15 - 00: Maximum Frequency (in MHz). 
Bits 31 - 16: Reserved = 0. 
ECX Bits 15 - OO: Bus (Reference) Frequency (in MHz). 
Bits 31 - 16: Reserved = 0. 
EDX Reserved. 
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Value Information Provided about the Processor 


NOTES: 

* Data is returned from this interface in accordance with the processor's specification and does not reflect 
actual values. Suitable use of this data includes the display of processor information in like manner to the 
processor brand string and for determining the appropriate range to use when displaying processor 
information e.g. frequency history graphs. The returned information should not be used for any other 
purpose as the returned information does not accurately correlate to information / counters returned by 
other processor interfaces. 


While a processor may support the Processor Frequency Information leaf, fields that return a value of 
zero are not supported. 


System-On-Chip Vendor Attribute Enumeration Main Leaf (EAX = 17H, ECX = 0) 
17H NOTES: 

Leaf 17H main leaf (ECX = 0). 

Leaf 17H output depends on the initial value in ECX. 

Leaf 17H sub-leaves 1 through 3 reports SOC Vendor Brand String. 
Leaf 17H is valid if MaxSOCID_Index >= 3. 

Leaf 17H sub-leaves 4 and above are reserved. 


EAX Bits 31 - 00: MaxSOCID_Index. Reports the maximum input value of supported sub-leaf in leaf 17H. 


EBX Bits 15 - 00: SOC Vendor ID. 
Bit 16: IsVendorScheme. If 1, the SOC Vendor ID field is assigned via an industry standard enumeration 
scheme. Otherwise, the SOC Vendor ID field is assigned by Intel. 
Bits 31 - 17: Reserved = 0. 


ECX Bits 31 - 00: Project ID. A unique number an SOC vendor assigns to its SOC projects. 
EDX Bits 31 - 00: Stepping ID. A unique number within an SOC project that an SOC vendor assigns. 
System-On-Chip Vendor Attribute Enumeration Sub-leaf (EAX = 17H, ECX = 1..3) 
17H EAX Bit 31 - 00: SOC Vendor Brand String. UTF-8 encoded string. 
EBX Bit 31 - 00: SOC Vendor Brand String. UTF-8 encoded string. 
ECX Bit 31 - 00: SOC Vendor Brand String. UTF-8 encoded string. 
EDX Bit 31 - 00: SOC Vendor Brand String. UTF-8 encoded string. 
NOTES: 


Leaf 17H output depends on the initial value in ECX. 

SOC Vendor Brand String is a UTF-8 encoded string padded with trailing bytes of OOH. 

The complete SOC Vendor Brand String is constructed by concatenating in ascending order of 
EAX:EBX:ECX:EDX and from the sub-leaf 1 fragment towards sub-leaf 3. 


System-On-Chip Vendor Attribute Enumeration Sub-leaves (EAX = 17H, ECX > MaxSOCID_Index) 


17H NOTES: 
Leaf 17H output depends on the initial value in ECX. 


EAX Bits 31 - 00: Reserved = 0. 
EBX Bits 31 - 00: Reserved = 0. 
ECX Bits 31 - 00: Reserved = 0. 
EDX Bits 31 - 00: Reserved = 0. 
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Deterministic Address Translation Parameters Main Leaf (EAX = 18H, ECX = OQ) 
18H NOTES: 


EAX 
EBX 


ECX 
EDX 


Each sub-leaf enumerates a different address translation structure. 

If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf O returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns 0. 
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be ina 
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc- 
ture. 

* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches. 
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an 
instruction fetch) . Please see the Intel® 64 and IA-32 Architectures Optimization Reference Manual for 
details of a particular product. 


** Add one to the return value to get the result. 


Bits 31 - 00: Reports the maximum input value of supported sub-leaf in leaf 18H. 


Bit 00: 4K page size entries supported by this structure. 

Bit 01: 2MB page size entries supported by this structure. 

Bit 02: 4MB page size entries supported by this structure. 

Bit 03: 1 GB page size entries supported by this structure. 

Bits 07 - 04: Reserved. 

Bits 10 - 08: Partitioning (0: Soft partitioning between the logical processors sharing this structure). 
Bits 15 - 11: Reserved. 

Bits 31 - 16: W = Ways of associativity. 


Bits 31 - OO: S = Number of Sets. 


Bits 04 - OO: Translation cache type field. 
OQOOOOb: Null (indicates this sub-leaf is not valid). 
00001b: Data TLB. 
0001 0b: Instruction TLB. 
0001 1b: Unified TLB*. 
00100b: Load Only TLB. Hit on loads; fills on both loads and stores. 
00101b: Store Only TLB. Hit on stores; fill on stores. 
All other encodings are reserved. 
Bits 07 - 05: Translation cache level (starts at 1). 
Bit 08: Fully associative structure. 
Bits 13 - O09: Reserved. 
Bits 25- 14: Maximum number of addressable IDs for logical processors sharing this translation cache** 
Bits 31 - 26: Reserved. 
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Initial EAX 
Value 


Information Provided about the Processor 


Deterministic Address Translation Parameters Sub-leaf (EAX = 18H, ECX > 7) 


18H 


EAX 
EBX 


ECX 
EDX 


Key Locker Leaf (EAX = 19H) 


NOTES: 
Each sub-leaf enumerates a different address translation structure. 
If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf O returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns O. 
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be ina 
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc- 
ture. 
* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches. 
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an 
instruction fetch) . Please see the Intel® 64 and IA-32 Architectures Optimization Reference Manual for 
details of a particular product. 


** Add one to the return value to get the result. 


Bits 31 - 00: Reserved. 


Bit 00: 4K page size entries supported by this structure. 

Bit 01: 2MB page size entries supported by this structure. 

Bit 02: 4MB page size entries supported by this structure. 

Bit 03: 1 GB page size entries supported by this structure. 

Bits 07 - 04: Reserved. 

Bits 10 - 08: Partitioning (0: Soft partitioning between the logical processors sharing this structure). 
Bits 15 - 11: Reserved. 

Bits 31 - 16: W = Ways of associativity. 


Bits 31 - 00: S = Number of Sets. 


Bits 04 - OO: Translation cache type field. 
OOOOb: Null (indicates this sub-leaf is not valid). 
0001b: Data TLB. 
0010b: Instruction TLB. 
001 1b: Unified TLB*. 
All other encodings are reserved. 
Bits 07 - 05: Translation cache level (starts at 1). 
Bit 08: Fully associative structure. 
Bits 13 - 09: Reserved. 
Bits 25- 14: Maximum number of addressable IDs for logical processors sharing this translation cache** 
Bits 31 - 26: Reserved. 


19H 


EAX 


EBX 


Bit 00: Key Locker restriction of CPLO-only supported. 
Bit 01: Key Locker restriction of no-encrypt supported. 
Bit O2: Key Locker restriction of no-decrypt supported. 
Bits 31-03: Reserved. 


Bit O00: AESKLE. If 1, the AES Key Locker instructions are fully enabled. 

Bit 01: Reserved. 

Bit O2: If 1, the AES wide Key Locker instructions are supported. 

Bit 03: Reserved. 

Bit 04: If 1, the platform supports the Key Locker MSRs (IA32_COPY_LOCAL_TO_PLATFORM, 
IA23_COPY_PLATFORM_TO_LOCAL, IA32_COPY_STATUS, and IA32_IWKEYBACKUP_STATUS) and backing 
up the internal wrapping key. 

Bits 31-05: Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
ECX Bit OO: If 1, the NoBackup parameter to LOADIWKEY is supported. 
Bit 01: If 1, KeySource encoding of 1 (randomization of the internal wrapping key) is supported. 
Bits 31- 02: Reserved. 
EDX Reserved. 
Hybrid Information Enumeration Leaf (EAX = 1AH, ECX = 0) 
1AH EAX Enumerates the native model ID and core type. 
Bits 31-24: Core type 
10H: Reserved 
20H: Intel Atom® 
30H: Reserved 
40H: Intel® Core™ 
Bits 23-0: Native model ID of the core. The core-type and native mode ID can be used to uniquely identify 
the microarchitecture of the core. This native model ID is not unique across core types, and not related to 
the model ID reported in CPUID leaf 01H, and does not identify the SOC. 
EBX Reserved. 
ECX Reserved. 
EDX Reserved. 
PCONFIG Information Sub-leaf (EAX = 1BH, ECX > O) 
1BH For details on this sub-leaf, see “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-246. 
NOTE: 


Leaf 1BH is supported if CPUID.(EAX=07H, ECX=OH):EDX[1 8] = 1. 
V2 Extended Topology Enumeration Leaf 


1FH NOTES: 

CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence 
of Leaf 1FH and using this if available. 

Most of Leaf 1FH output depends on the initial value in ECX. 

The EDX output of leaf 1FH is always valid and does not vary with input value in ECX. 

Output value in ECX[7:0] always equals input value in ECX[7:0]. 

Sub-leaf index 0 enumerates SMT level. Gach subsequent higher sub-leaf index enumerates a higher- 
level topological entity in hierarchical order. 

For sub-leaves that return an invalid level-type of O in ECX[15:8]; EAX and EBX will return O. 


If an input value n in ECX returns the invalid level-type of O in ECX[15:8], other input values with ECX > 
nalso return O in ECX[1 5:8]. 


EAX Bits 04 - 00: Number of bits to shift right on x2APIC ID to get a unique topology ID of the next level type*. 
All logical processors with the same next level ID share current level. 
Bits 31 - 05: Reserved. 


EBX Bits 15 - 00: Number of logical processors at this level type. The number reflects configuration as shipped 
by Intel**. 
Bits 31- 16: Reserved. 

ECX Bits 07 - OO: Level number. Same value in ECX input. 


Bits 15 - 08: Level type***. 
Bits 31 - 16: Reserved. 


EDX Bits 31- 00: x2APIC ID the current logical processor. 


NOTES: 
* Software should use this field (EAX[4:0]) to enumerate processor topology of the system. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
** Software must not use EBX[15:0] to enumerate processor topology of the system. This value in this 
field (EBX[15:0]) is only intended for display/diagnostic purposes. The actual number of logical processors 
available to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software 
and platform hardware configurations. 
*** The value of the “level type” field is not related to level numbers in any way, higher “level type” val- 
ues do not mean higher levels. Level type field has the following encoding: 
0: Invalid. 
1: SMT. 
2: Core. 
3: Module. 
4 Tile. 
5: Die. 
6-255: Reserved. 
Unimplemented CPUID Leaf Functions 
21H Invalid. No existing or future CPU will return processor identification or feature information if the initial 
EAX value is 21H. If the value returned by CPUID.O:EAX (the maximum input value for basic CPUID 
information) is at least 21H, O is returned in the registers EAX, EBX, ECX, and EDX. Otherwise, the data 
for the highest basic information leaf is returned. 
40000000H Invalid. No existing or future CPU will return processor identification or feature information if the initial 
- EAX value is in the range 40000000H to 4FFFFFFFH. 
4FFFFFFFH 
Extended Function CPUID Information 
80000000H | EAX Maximum Input Value for Extended Function CPUID Information. 
EBX Reserved. 
ECX Reserved. 
EDX Reserved. 
80000001H | EAX Extended Processor Signature and Feature Bits. 
EBX Reserved. 
ECX Bit OO: LAHF/SAHF available in 64-bit mode.* 
Bits 04 - 01: Reserved. 
Bit 05: LZCNT. 
Bits 07 - O6: Reserved. 
Bit O08: PREFETCHW. 
Bits 31 - O09: Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


EDX 


Bits 10 - 00: Reserved. 

Bit 11: SYSCALL/SYSRET.** 

Bits 19 - 12: Reserved = 0. 

Bit 20: Execute Disable Bit available. 

Bits 25 - 21: Reserved = 0. 

Bit 26: 1-GByte pages are available if 1. 

Bit 27: RDTSCP and |A32_TSC_AUX are available if 1. 
Bit 28: Reserved = 0. 


Bit 29: Intel® 64 Architecture available if 1. 
Bits 31 - 30: Reserved = 0. 


NOTES: 
* LAHF and SAHF are always available in other modes, regardless of the enumeration of this feature flag. 


** Intel processors support SYSCALL and SYSRET only in 64-bit mode. This feature flag is always enumer- 
ated as O outside 64-bit mode. 


80000002H 


Processor Brand String. 

Processor Brand String Continued. 
Processor Brand String Continued. 
Processor Brand String Continued. 


80000003H 


Processor Brand String Continued. 
Processor Brand String Continued. 
Processor Brand String Continued. 
Processor Brand String Continued. 


80000004H 


Processor Brand String Continued. 
Processor Brand String Continued. 
Processor Brand String Continued. 
Processor Brand String Continued. 


80000005H 


Reserved = 0. 
Reserved = 0. 
Reserved = 0. 
Reserved = 0. 


80000006H 


EDX 


Reserved = 0. 
Reserved = 0. 


Bits 07 - OO: Cache Line size in bytes. 
Bits 11 - 08: Reserved. 

Bits 15 - 12: L2 Associativity field *. 
Bits 31 - 16: Cache size in 1K units. 
Reserved = 0. 


NOTES: 

* L2 associativity field encodings: 

OOH - Disabled 

01H - 1 way (direct mapped) 

O2H - 2 ways 

03H - Reserved 

O4H - 4 ways 

O5H - Reserved 

O6H - 8 ways 

07H - See CPUID leaf 04H, sub-leaf 2** 


O8H - 16 ways 

OSH - Reserved 

OAH - 32 ways 

OBH - 48 ways 

OCH - 64 ways 

ODH - 96 ways 

OEH - 128 ways 

OFH - Fully associative 


** CPUID leaf O4H provides details of deterministic cache parameters, including the L2 cache in sub-leaf 2 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
80000007H | EAX Reserved = 0. 
EBX Reserved = 0. 
ECX Reserved = 0. 
EDX Bits 07 - 00: Reserved = 0. 


Bit 08: Invariant TSC available if 1. 
Bits 31 - 09: Reserved = 0. 


80000008H | EAX Linear/Physical Address size. 

Bits 07 - OO: #Physical Address Bits*. 
Bits 15 - 08: #Linear Address Bits. 
Bits 31 - 16: Reserved = 0. 


EBX Bits 08-00: Reserved = 0. 
Bit 09: WBNOINVD is available if 1. 
Bits 31-10: Reserved = 0. 


ECX Reserved = 0. 
EDX Reserved = 0. 
NOTES: 


* If CPUID.B0000008H:EAX[7:0] is supported, the maximum physical address number supported should 
come from this field. 


INPUT EAX = 0: Returns CPUID’s Highest Value for Basic Processor Information and the Vendor Identification String 


When CPUID executes with EAX set to 0, the processor returns the highest value the CPUID recognizes for 
returning basic processor information. The value is returned in the EAX register and is processor specific. 


A vendor identification string is also returned in EBX, EDX, and ECX. For Intel processors, the string is “Genuin- 
elIntel” and is expressed: 


EBX := 756e6547h (* “Genu", with G in the low eight bits of BL *) 
EDX := 49656e69h (* “inel”, with i in the low eight bits of DL *) 
ECX := 6c65746eh (* “ntel”, with n in the low eight bits of CL *) 


INPUT EAX = 80000000H: Returns CPUID’s Highest Value for Extended Processor Information 


When CPUID executes with EAX set to 80000000H, the processor returns the highest value the processor recog- 
nizes for returning extended processor information. The value is returned in the EAX register and is processor 
specific. 


IA32_BIOS_SIGN_ID Returns Microcode Update Signature 


For processors that support the microcode update facility, the IA32_BIOS_SIGN_ID MSR is loaded with the update 
signature whenever CPUID executes. The signature is returned in the upper DWORD. For details, see Chapter 9 in 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


INPUT EAX = 01H: Returns Model, Family, Stepping Information 


When CPUID executes with EAX set to 01H, version information is returned in EAX (see Figure 3-6). For example: 
model, family, and processor type for the Intel Xeon processor 5100 series is as follows: 


© Model — 1111B 

¢ Family — 0101B 

¢ Processor Type — 00B 

See Table 3-9 for available processor type values. Stepping IDs are provided as needed. 
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31 28 27 20 19 16 15 14 13 12 11 8 


EAX Extended Extended Family 
Family ID Model ID ID 


Extended Family ID (0) 


Extended Model ID (0) 
Processor Type 
Family (OFH for the Pentium 4 Processor Family) 


7 4 3 0 
Stepping 


Model 
Reserved 
OM16525 
Figure 3-6. Version Information Returned by CPUID in EAX 
Table 3-9. Processor Type Field 
Type Encoding 
Original OEM Processor OOB 
Intel OverDrive Processor 01B 
Dual processor (not applicable to Intel486 processors) 10B 
Intel reserved 11B 


NOTE 


See Chapter 20 in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, 
for information on identifying earlier IA-32 processors. 


The Extended Family ID needs to be examined only when the Family ID is OFH. Integrate the fields into a display 
using the following rule: 


IF Family_ID # OFH 
THEN DisplayFamily = Family_ID; 
ELSE DisplayFamily = Extended_Family_ID + Family_ID; 
(* Right justify and zero-extend 4-bit field. *) 

Fl; 

(* Show DisplayFamily as HEX field. *) 


The Extended Model ID needs to be examined only when the Family ID is 06H or OFH. Integrate the field into a 
display using the following rule: 


IF (Family_ID = O6H or Family_ID = OFH) 
THEN DisplayModel = (Extended_Model_ID « 4) + Model_ID; 
(* Right justify and zero-extend 4-bit field; display Model_ID as HEX field.*) 
ELSE DisplayModel = Model_ID; 

Fl; 

(* Show DisplayModel as HEX field. *) 
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INPUT EAX = 01H: Returns Additional Information in EBX 


When CPUID executes with EAX set to 01H, additional information is returned to the EBX register: 


°¢ Brand index (low byte of EBX) — this number provides an entry into a brand string table that contains brand 
strings for IA-32 processors. More information about this field is provided later in this section. 


® CLFLUSH instruction cache line size (second byte of EBX) — this number indicates the size of the cache line 
flushed by the CLFLUSH and CLFLUSHOPT instructions in 8-byte increments. This field was introduced in the 
Pentium 4 processor. 


¢ Local APIC ID (high byte of EBX) — this number is the 8-bit ID that is assigned to the local APIC on the 


processor during power up. This field was introduced in the Pentium 4 processor. 


INPUT EAX = 01H: Returns Feature Information in ECX and EDX 


When CPUID executes with EAX set to 01H, feature information is returned in ECX and EDX. 


° Figure 3-7 and Table 3-10 show encodings for ECX. 
¢ Figure 3-8 and Table 3-11 show encodings for EDX. 


For all feature flags, a 1 indicates that the feature is supported. Use Intel to properly interpret feature flags. 


Software must confirm that a processor feature is present using feature flags returned by CPUID 
prior to using the feature. Software should not depend on future offerings retaining all features. 
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RDRAND 
F16C 
AVX 

OSXSAVE 
XSAVE 
AES 
TSC-Deadline 
POPCNT 
MOVBE 
x2APIC 


SSE4_2— SSE4.2 


SSE4_1— SSE4.1 


DCA — Direct Cache Access 


PCID — Process-context Identifiers 
PDCM — Perf/Debug Capability MSR 


xTPR Update Control 
CMPXCHG16B 


FMA — Fused Multiply Add 
SDBG 


CNXT-ID — L1 Context ID 


SSSE3 — SSSE3 Extensions 


TM2 — Thermal Monitor 2 


EIST — Enhanced Intel SpeedStep® Technology 


SMX — Safer Mode Extensions 
VMX — Virtual Machine Extensions 


DS-CPL — CPL Qualified Debug Store 


MONITOR — MONITOR/MWAIT 


DTES64 — 64-bit DS Area 


PCLMULQDQ — Carryless Multiplication 


SSE3 — SSE3 Extensions 


Reserved 


Figure 3-7. Feature Information Returned in the ECX Register 
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Table 3-10. Feature Information Returned in the ECX Register 


CPUID—CPU Identification 


Bit # Mnemonic Description 

0 SSE3 Streaming SIMD Extensions 3 (SSE3). A value of 1 indicates the processor supports this 
technology. 

1 PCLMULQDQ PCLMULQDQ. A value of 1 indicates the processor supports the PCLMULQDQ instruction. 

2 DTES64 64-bit DS Area. A value of 1 indicates the processor supports DS area using 64-bit layout. 

3 MONITOR MONITOR/MWAIT. A value of 1 indicates the processor supports this feature. 

4 DS-CPL CPL Qualified Debug Store. A value of 1 indicates the processor supports the extensions to the 
Debug Store feature to allow for branch message storage qualified by CPL. 

5 VMX Virtual Machine Extensions. A value of 1 indicates that the processor supports this technology. 

6 SMX Safer Mode Extensions. A value of 1 indicates that the processor supports this technology. See 
Chapter 6, “Safer Mode Extensions Reference”. 

7 EIST Enhanced Intel SpeedStep® technology. A value of 1 indicates that the processor supports this 
technology. 

8 T2 Thermal Monitor 2. A value of 1 indicates whether the processor supports this technology. 

9 SSSE3 A value of 1 indicates the presence of the Supplemental Streaming SIMD Extensions 3 (SSSE3). A 
value of O indicates the instruction extensions are not present in the processor. 

10 CNXT-ID L1 Context ID. A value of 1 indicates the L1 data cache mode can be set to either adaptive mode 
or shared mode. A value of 0 indicates this feature is not supported. See definition of the 
IA32_MISC_ENABLE MSR Bit 24 (L1 Data Cache Context Mode) for details. 

11 SDBG A value of 1 indicates the processor supports [A32_DEBUG_INTERFACE MSR for silicon debug. 

12 FMA A value of 1 indicates the processor supports FMA extensions using YMM state. 

13 CMPXCHG16B CMPXCHG16B Available. A value of 1 indicates that the feature is available. See the 
“CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes” section in this chapter for a 
description. 

14 xTPR Update XTPR Update Control. A value of 1 indicates that the processor supports changing 

Control IA32_MISC_ENABLE[bit 23]. 

15 PDCM Perfmon and Debug Capability: A value of 1 indicates the processor supports the performance 
and debug feature indication MSR IA32_PERF_CAPABILITIES. 

16 Reserved Reserved 

17 PCID Process-context identifiers. A value of 1 indicates that the processor supports PCIDs and that 
software may set CR4.PCIDE to 1. 

18 DCA A value of 1 indicates the processor supports the ability to prefetch data from a memory mapped 
device. 

19 SSE4_1 A value of 1 indicates that the processor supports SSE4.1. 

20 SSE4_2 A value of 1 indicates that the processor supports SSE4.2. 

21 X2APIC A value of 1 indicates that the processor supports x2APIC feature. 

22 MOVBE A value of 1 indicates that the processor supports MOVBE instruction. 

23 POPCNT A value of 1 indicates that the processor supports the POPCNT instruction. 

24 TSC-Deadline A value of 1 indicates that the processor's local APIC timer supports one-shot operation using a 
TSC deadline value. 

25 AESNI A value of 1 indicates that the processor supports the AESNI instruction extensions. 

26 XSAVE A value of 1 indicates that the processor supports the XSAVE/XRSTOR processor extended states 
feature, the XSETBV/XGETBV instructions, and XCRO. 

27 OSXSAVE A value of 1 indicates that the OS has set CR4.0SXSAVE[bit 18] to enable XSETBV/XGETBV 
instructions to access XCRO and to support processor extended state management using 
XSAVE/XRSTOR. 

28 AVX A value of 1 indicates the processor supports the AVX instruction extensions. 
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Table 3-10. Feature Information Returned in the ECX Register (Contd.) 


Bit # Mnemonic Description 

29 F16C A value of 1 indicates that processor supports 16-bit floating-point conversion instructions. 
30 RDRAND A value of 1 indicates that processor supports RDRAND instruction. 

31 Not Used Always returns 0. 
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EDX 


PBE-Pend. Brk. EN. 

TM-Therm. Monitor 

HTT—Multi-threading 

SS-—Self Snoop 

SSE2-SSE2 Extensions 

SSE-SSE Extensions 
FXSR-FXSAVE/FXRSTOR 

MMX-MMX Technology ———————— 
ACPI-Thermal Monitor and Clock Ctrl 
DS—Debug Store 


CLFSH-—CLFLUSH instruction 
PSN-Processor Serial Number 


PSE-36 — Page Size Extension 


PAT-Page Attribute Table 
CMOV-Conditional Move/Compare Instruction 
MCA-—Machine Check Architecture 


PGE-PTE Global Bit 


MTRR-—Memory Type Range Registers 


SEP-SYSENTER and SYSEXIT 
APIC-APIC on Chip 


CX8—CMPXCHG8B Inst. 


MCE-Machine Check Exception 


PAE-Physical Address Extensions 
MSR-RDMSR and WRMSR Support 


TSC-Time Stamp Counter 


PSE-Page Size Extensions 


DE-—Debugging Extensions 


VME-Virtual-8086 Mode Enhancement 
FPU-x87 FPU on Chip 


Reserved 
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Table 3-11. More on Feature Information Returned in the EDX Register 


Bit # | Mnemonic | Description 

0 FPU Floating Point Unit On-Chip. The processor contains an x87 FPU. 

1 VME Virtual 8086 Mode Enhancements. Virtual 8086 mode enhancements, including CR4.VME for controlling the 
feature, CR4.PVI for protected mode virtual interrupts, software interrupt indirection, expansion of the TSS 
with the software indirection bitmap, and EFLAGS.VIF and EFLAGS.VIP flags. 

2 DE Debugging Extensions. Support for I/O breakpoints, including CR4.DE for controlling the feature, and optional 
trapping of accesses to DR4 and DRS. 

3 PSE Page Size Extension. Large pages of size 4 MByte are supported, including CR4.PSE for controlling the 
feature, the defined dirty bit in PDE (Page Directory Entries), optional reserved bit trapping in CR3, PDEs, and 
PTEs. 

TSC Time Stamp Counter. The RDTSC instruction is supported, including CR4.TSD for controlling privilege. 
MSR Model Specific Registers RDMSR and WRMSR Instructions. The RDMSR and WRMSR instructions are 
supported. Some of the MSRs are implementation dependent. 

6 PAE Physical Address Extension. Physical addresses greater than 32 bits are supported: extended page table 
entry formats, an extra level in the page translation tables is defined, 2-MByte pages are supported instead of 
4 Mbyte pages if PAE bit is 1. 

7 MCE Machine Check Exception. Exception 18 is defined for Machine Checks, including CR4.MCE for controlling the 
feature. This feature does not define the model-specific implementations of machine-check error logging, 
reporting, and processor shutdowns. Machine Check exception handlers may have to depend on processor 
version to do model specific processing of the exception, or test for the presence of the Machine Check feature. 

8 CX8 CMPXCHG8B Instruction. The compare-and-exchange 8 bytes (64 bits) instruction is supported (implicitly 
locked and atomic). 

9 APIC APIC On-Chip. The processor contains an Advanced Programmable Interrupt Controller (APIC), responding to 
memory mapped commands in the physical address range FFFEQOOOH to FFFEOFFFH (by default - some 
processors permit the APIC to be relocated). 

10 |Reserved | Reserved 

11 SEP SYSENTER and SYSEXIT Instructions. The SYSENTER and SYSEXIT and associated MSRs are supported. 

12 |MTRR Memory Type Range Registers. MTRRs are supported. The MTRRcap MSR contains feature bits that describe 
what memory types are supported, how many variable MTRRs are supported, and whether fixed MTRRs are 
supported. 

13. | PGE Page Global Bit. The global bit is supported in paging-structure entries that map a page, indicating TLB entries 
that are common to different processes and need not be flushed. The CR4.PGE bit controls this feature. 

14 |MCA Machine Check Architecture. A value of 1 indicates the Machine Check Architecture of reporting machine 
errors is supported. The MCG_CAP MSR contains feature bits describing how many banks of error reporting 
MSRs are supported. 

15 | CMOV Conditional Move Instructions. The conditional move instruction CMOV is supported. In addition, if x87 FPU is 
present as indicated by the CPUID.FPU feature bit, then the FCOMI and FCMOV instructions are supported 

16 | PAT Page Attribute Table. Page Attribute Table is supported. This feature augments the Memory Type Range 
Registers (MTRRs), allowing an operating system to specify attributes of memory accessed through a linear 
address on a 4KB granularity. 

17 | PSE-36 36-Bit Page Size Extension. 4-MByte pages addressing physical memory beyond 4 GBytes are supported with 
32-bit paging. This feature indicates that upper bits of the physical address of a 4-MByte page are encoded in 
bits 20:13 of the page-directory entry. Such physical addresses are limited by MAXPHYADDR and may be up to 
40 bits in size. 

18 | PSN Processor Serial Number. The processor supports the 96-bit processor identification number feature and the 
feature is enabled. 

19 | CLFSH CLFLUSH Instruction. CLFLUSH Instruction is supported. 

20 | Reserved | Reserved 
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Table 3-11. More on Feature Information Returned in the EDX Register (Contd.) 


Bit # | Mnemonic | Description 

21 DS Debug Store. The processor supports the ability to write debug information into a memory resident buffer. 
This feature is used by the branch trace store (BTS) and processor event-based sampling (PEBS) facilities (see 
Chapter 22, “Introduction to Virtual-Machine Extensions,” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 3C). 

22 =| ACPI Thermal Monitor and Software Controlled Clock Facilities. The processor implements internal MSRs that 
allow processor temperature to be monitored and processor performance to be modulated in predefined duty 
cycles under software control. 

23 | MMX Intel MMX Technology. The processor supports the Intel MMX technology. 

24 | FXSR FXSAVE and FXRSTOR Instructions. The FXSAVE and FXRSTOR instructions are supported for fast save and 
restore of the floating point context. Presence of this bit also indicates that CR4.OSFXSR is available for an 
operating system to indicate that it supports the FXSAVE and FXRSTOR instructions. 

25 =| SSE SSE. The processor supports the SSE extensions. 

26 =| SSE2 SSE2. The processor supports the SSE2 extensions. 

27 ~|SS Self Snoop. The processor supports the management of conflicting memory types by performing a snoop of its 
own cache structure for transactions issued to the bus. 

28 «| HTT Max APIC IDs reserved field is Valid. A value of O for HTT indicates there is only a single logical processor in 
the package and software should assume only a single APIC ID is reserved. A value of 1 for HTT indicates the 
value in CPUID.1.EBX[23:16] (the Maximum number of addressable IDs for logical processors in this package) is 
valid for the package. 

29 =|TM Thermal Monitor. The processor implements the thermal monitor automatic thermal control circuitry (TCC). 

30 | Reserved | Reserved 

31 PBE Pending Break Enable. The processor supports the use of the FERR#/PBE# pin when the processor is in the 


stop-clock state (STPCLK# is asserted) to signal the processor that an interrupt is pending and that the 
processor should return to normal operation to handle the interrupt. 


INPUT EAX = 02H: TLB/Cache/Prefetch Information Returned in EAX, EBX, ECX, EDX 


When CPUID executes with EAX set to 02H, the processor returns information about the processor’s internal TLBs, 
cache and prefetch hardware in the EAX, EBX, ECX, and EDX registers. The information is reported in encoded form 
and fall into the following categories: 


° The least-significant byte in register EAX (register AL) will always return 01H. Software should ignore this value 
and not interpret it as an informational descriptor. 


¢ The most significant bit (bit 31) of each register indicates whether the register contains valid information (set 
to 0) or is reserved (set to 1). 


¢ If a register contains valid information, the information is contained in 1 byte descriptors. There are four types 
of encoding values for the byte descriptor, the encoding type is noted in the second column of Table 3-12. Table 
3-12 lists the encoding of these descriptors. Note that the order of descriptors in the EAX, EBX, ECX, and EDX 
registers is not defined; that is, specific bytes are not designated to contain descriptors for specific cache, 
prefetch, or TLB types. The descriptors may appear in any order. Note also a processor may report a general 
descriptor type (FFH) and not report any byte descriptor of “cache type” via CPUID leaf 2. 
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Table 3-12. Encoding of CPUID Leaf 2 Descriptors 


Value Type Description 

OOH General | Null descriptor, this byte contains no information 

01H TLB Instruction TLB: 4 KByte pages, 4-way set associative, 32 entries 

02H TLB Instruction TLB: 4 MByte pages, fully associative, 2 entries 

03H TLB Data TLB: 4 KByte pages, 4-way set associative, 64 entries 

04H TLB Data TLB: 4 MByte pages, 4-way set associative, 8 entries 

05H TLB Data TLB1: 4 MByte pages, 4-way set associative, 32 entries 

O6H Cache | 1st-level instruction cache: 8 KBytes, 4-way set associative, 32 byte line size 

08H Cache | 1st-level instruction cache: 16 KBytes, 4-way set associative, 32 byte line size 

09H Cache | 1st-level instruction cache: 32KBytes, 4-way set associative, 64 byte line size 

OAH Cache | 1st-level data cache: 8 KBytes, 2-way set associative, 32 byte line size 

OBH TLB Instruction TLB: 4 MByte pages, 4-way set associative, 4 entries 

OCH Cache | 1st-level data cache: 16 KBytes, 4-way set associative, 32 byte line size 

ODH Cache | 1st-level data cache: 16 KBytes, 4-way set associative, 64 byte line size 

OEH Cache | 1st-level data cache: 24 KBytes, 6-way set associative, 64 byte line size 

1DH Cache | 2nd-level cache: 128 KBytes, 2-way set associative, 64 byte line size 

21H Cache | 2nd-level cache: 256 KBytes, 8-way set associative, 64 byte line size 

22H Cache | 3rd-level cache: 512 KBytes, 4-way set associative, 64 byte line size, 2 lines per sector 
23H Cache | 3rd-level cache: 1 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector 
24H Cache | 2nd-level cache: 1 MBytes, 16-way set associative, 64 byte line size 

25H Cache | 3rd-level cache: 2 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector 
29H Cache | 3rd-level cache: 4 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector 
2CH Cache _ | 1st-level data cache: 32 KBytes, 8-way set associative, 64 byte line size 

30H Cache | 1st-level instruction cache: 32 KBytes, 8-way set associative, 64 byte line size 

40H Cache | No 2nd-level cache or, if processor contains a valid 2nd-level cache, no 3rd-level cache 
41H Cache | 2nd-level cache: 128 KBytes, 4-way set associative, 32 byte line size 

42H Cache | 2nd-level cache: 256 KBytes, 4-way set associative, 32 byte line size 

43H Cache | 2nd-level cache: 512 KBytes, 4-way set associative, 32 byte line size 

44H Cache | 2nd-level cache: 1 MByte, 4-way set associative, 32 byte line size 

45H Cache | 2nd-level cache: 2 MByte, 4-way set associative, 32 byte line size 

46H Cache | 3rd-level cache: 4 MByte, 4-way set associative, 64 byte line size 

47H Cache | 3rd-level cache: 8 MByte, 8-way set associative, 64 byte line size 

48H Cache | 2nd-level cache: 3MByte, 12-way set associative, 64 byte line size 

49H Cache | 3rd-level cache: 4MB, 16-way set associative, 64-byte line size (Intel Xeon processor MP, Family OFH, Model 

O6H); 
2nd-level cache: 4 MByte, 16-way set associative, 64 byte line size 

4AH Cache | 3rd-level cache: 6MByte, 12-way set associative, 64 byte line size 

4BH Cache | 3rd-level cache: 8MByte, 16-way set associative, 64 byte line size 

4CH Cache | 3rd-level cache: 12MByte, 12-way set associative, 64 byte line size 

4DH Cache | 3rd-level cache: 16MByte, 16-way set associative, 64 byte line size 

4€H Cache | 2nd-level cache: 6MByte, 24-way set associative, 64 byte line size 

4FH TLB Instruction TLB: 4 KByte pages, 32 entries 
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Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.) 


Value Type Description 

50H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 64 entries 

51H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 128 entries 

52H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 256 entries 

55H TLB Instruction TLB: 2-MByte or 4-MByte pages, fully associative, 7 entries 

56H TLB Data TLBO: 4 MByte pages, 4-way set associative, 16 entries 

57H TLB Data TLBO: 4 KByte pages, 4-way associative, 16 entries 

59H TLB Data TLBO: 4 KByte pages, fully associative, 16 entries 

5AH TLB Data TLBO: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries 

5BH TLB Data TLB: 4 KByte and 4 MByte pages, 64 entries 

5CH TLB Data TLB: 4 KByte and 4 MByte pages, 128 entries 

5DH TLB Data TLB: 4 KByte and 4 MByte pages,256 entries 

60H Cache | 1st-level data cache: 16 KByte, 8-way set associative, 64 byte line size 

61H TLB Instruction TLB: 4 KByte pages, fully associative, 48 entries 

63H TLB Data TLB: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries and a separate array with 1 GByte 

pages, 4-way set associative, 4 entries 

64H TLB Data TLB: 4 KByte pages, 4-way set associative, 512 entries 

66H Cache | 1st-level data cache: 8 KByte, 4-way set associative, 64 byte line size 

67H Cache _ | 1st-level data cache: 16 KByte, 4-way set associative, 64 byte line size 

68H Cache | 1st-level data cache: 32 KByte, 4-way set associative, 64 byte line size 

6AH Cache |uTLB: 4 KByte pages, 8-way set associative, 64 entries 

6BH Cache |DTLB: 4 KByte pages, 8-way set associative, 256 entries 

6CH Cache | DTLB: 2M/4M pages, 8-way set associative, 128 entries 

6DH Cache |DTLB: 1 GByte pages, fully associative, 16 entries 

70H Cache | Trace cache: 12 K-wop, 8-way set associative 

71H Cache | Trace cache: 16 K-op, 8-way set associative 

72H Cache | Trace cache: 32 K-yop, 8-way set associative 

76H TLB Instruction TLB: 2M/4M pages, fully associative, 8 entries 

78H Cache | 2nd-level cache: 1 MByte, 4-way set associative, 64byte line size 

79H Cache | 2nd-level cache: 128 KByte, 8-way set associative, 64 byte line size, 2 lines per sector 
7AH Cache | 2nd-level cache: 256 KByte, 8-way set associative, 64 byte line size, 2 lines per sector 
7BH Cache | 2nd-level cache: 512 KByte, 8-way set associative, 64 byte line size, 2 lines per sector 
7CH Cache | 2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size, 2 lines per sector 
7DH Cache | 2nd-level cache: 2 MByte, 8-way set associative, 64byte line size 

7FH Cache | 2nd-level cache: 512 KByte, 2-way set associative, 64-byte line size 

80H Cache | 2nd-level cache: 512 KByte, 8-way set associative, 64-byte line size 

82H Cache | 2nd-level cache: 256 KByte, 8-way set associative, 32 byte line size 

83H Cache | 2nd-level cache: 512 KByte, 8-way set associative, 32 byte line size 

84H Cache | 2nd-level cache: 1 MByte, 8-way set associative, 32 byte line size 

85H Cache | 2nd-level cache: 2 MByte, 8-way set associative, 32 byte line size 

86H Cache | 2nd-level cache: 512 KByte, 4-way set associative, 64 byte line size 

87H Cache | 2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size 
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Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.) 


Value Type Description 

AQH DTLB DTLB: 4k pages, fully associative, 32 entries 

BOH TLB Instruction TLB: 4 KByte pages, 4-way set associative, 128 entries 

B1H TLB Instruction TLB: 2M pages, 4-way, 8 entries or 4M pages, 4-way, 4 entries 

B2H TLB Instruction TLB: 4KByte pages, 4-way set associative, 64 entries 

B3H TLB Data TLB: 4 KByte pages, 4-way set associative, 128 entries 

B4H TLB Data TLB1: 4 KByte pages, 4-way associative, 256 entries 

B5H TLB Instruction TLB: 4KByte pages, 8-way set associative, 64 entries 

B6H TLB Instruction TLB: 4KByte pages, 8-way set associative, 128 entries 

BAH TLB Data TLB1: 4 KByte pages, 4-way associative, 64 entries 

COH TLB Data TLB: 4 KByte and 4 MByte pages, 4-way associative, 8 entries 

C1H STLB Shared 2nd-Level TLB: 4 KByte/2MByte pages, 8-way associative, 1024 entries 
C2H DTLB DTLB: 4 KByte/2 MByte pages, 4-way associative, 16 entries 

C3H STLB Shared 2nd-Level TLB: 4 KByte /2 MByte pages, 6-way associative, 1536 entries. Also 1GBbyte pages, 4-way, 

16 entries. 

C4H DTLB DTLB: 2M/4M Byte pages, 4-way associative, 32 entries 

CAH STLB Shared 2nd-Level TLB: 4 KByte pages, 4-way associative, 512 entries 

DOH Cache | 3rd-level cache: 512 KByte, 4-way set associative, 64 byte line size 

D1H Cache | 3rd-level cache: 1 MByte, 4-way set associative, 64 byte line size 

D2H Cache | 3rd-level cache: 2 MByte, 4-way set associative, 64 byte line size 

D6H Cache | 3rd-level cache: 1 MByte, 8-way set associative, 64 byte line size 

D7H Cache | 3rd-level cache: 2 MByte, 8-way set associative, 64 byte line size 

D8H Cache | 3rd-level cache: 4 MByte, 8-way set associative, 64 byte line size 

DCH Cache | 3rd-level cache: 1.5 MByte, 12-way set associative, 64 byte line size 

DDH Cache | 3rd-level cache: 3 MByte, 12-way set associative, 64 byte line size 

DEH Cache | 3rd-level cache: 6 MByte, 12-way set associative, 64 byte line size 

E2H Cache | 3rd-level cache: 2 MByte, 16-way set associative, 64 byte line size 

€3H Cache | 3rd-level cache: 4 MByte, 16-way set associative, 64 byte line size 

E4H Cache | 3rd-level cache: 8 MByte, 16-way set associative, 64 byte line size 

EAH Cache | 3rd-level cache: 12MByte, 24-way set associative, 64 byte line size 

EBH Cache | 3rd-level cache: 18MByte, 24-way set associative, 64 byte line size 

ECH Cache | 3rd-level cache: 24MByte, 24-way set associative, 64 byte line size 

FOH Prefetch | 64-Byte prefetching 

F1H Prefetch | 128-Byte prefetching 

FEH General | CPUID leaf 2 does not report TLB descriptor information; use CPUID leaf 18H to query TLB and other address 

translation parameters. 
FFH General | CPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters 
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Example 3-1. Example of Cache and TLB Interpretation 
The first member of the family of Pentium 4 processors returns the following information about caches and TLBs 
when the CPUID executes with an input value of 2: 


EAX 66 5B 50 01H 
EBX OH 
ECX OH 
EDX 00 7A 70 OOH 


Which means: 
° The least-significant byte (byte 0) of register EAX is set to 01H. This value should be ignored. 


¢ The most-significant bit of all four registers (EAX, EBX, ECX, and EDX) is set to 0, indicating that each register 
contains valid 1-byte descriptors. 


° Bytes 1, 2, and 3 of register EAX indicate that the processor has: 
— 50H - a 64-entry instruction TLB, for mapping 4-KByte and 2-MByte or 4-MByte pages. 
— 5BH - a 64-entry data TLB, for mapping 4-KByte and 4-MByte pages. 
— 66H - an 8-KByte ist level data cache, 4-way set associative, with a 64-Byte cache line size. 
¢ The descriptors in registers EBX and ECX are valid, but contain NULL descriptors. 
° Bytes 0, 1, 2, and 3 of register EDX indicate that the processor has: 
— OOH - NULL descriptor. 
— 70H - Trace cache: 12 K-uop, 8-way set associative. 
— 7AH - a 256-KByte 2nd level cache, 8-way set associative, with a sectored, 64-byte cache line size. 
— OOH - NULL descriptor. 


INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level 


When CPUID executes with EAX set to 04H and ECX contains an index value, the processor returns encoded data 
that describe a set of deterministic cache parameters (for the cache level associated with the input in ECX). Valid 
index values start from 0. 


Software can enumerate the deterministic cache parameters for each level of the cache hierarchy starting with an 
index value of 0, until the parameters report the value associated with the cache type field is 0. The architecturally 
defined fields reported by deterministic cache parameters are documented in Table 3-8. 


This Cache Size in Bytes 
= (Ways + 1) * (Partitions + 1) * (Line_Size + 1) * (Sets + 1) 
= (EBX[31:22] + 1) * (EBX[21:12] + 1) * (EBX[11:0] + 1) * (ECX + 1) 


The CPUID leaf 04H also reports data that can be used to derive the topology of processor cores in a physical 
package. This information is constant for all valid index values. Software can query the raw data reported by 
executing CPUID with EAX=04H and ECX=0 and use it as part of the topology enumeration algorithm described in 
Chapter 8, “Multiple-Processor Management,” in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3A. 


INPUT EAX = 05H: Returns MONITOR and MWAIT Features 


When CPUID executes with EAX set to 05H, the processor returns information about features available to 
MONITOR/MWAIT instructions. The MONITOR instruction is used for address-range monitoring in conjunction with 
MWAIT instruction. The MWAIT instruction optionally provides additional extensions for advanced power manage- 
ment. See Table 3-8. 


INPUT EAX = OGH: Returns Thermal and Power Management Features 


When CPUID executes with EAX set to 06H, the processor returns information about thermal and power manage- 
ment features. See Table 3-8. 
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INPUT EAX = 07H: Returns Structured Extended Feature Enumeration Information 


When CPUID executes with EAX set to 07H and ECX = 0, the processor returns information about the maximum 
input value for sub-leaves that contain extended feature flags. See Table 3-8. 


When CPUID executes with EAX set to 07H and the input value of ECX is invalid (see leaf 07H entry in Table 3-8), 
the processor returns 0 in EAX/EBX/ECX/EDX. In subleaf 0, EAX returns the maximum input value of the highest 
leaf 7 sub-leaf, and EBX, ECX & EDX contain information of extended feature flags. 


INPUT EAX = OSH: Returns Direct Cache Access Information 


When CPUID executes with EAX set to 09H, the processor returns information about Direct Cache Access capabili- 
ties. See Table 3-8. 


INPUT EAX = OAH: Returns Architectural Performance Monitoring Features 


When CPUID executes with EAX set to OAH, the processor returns information about support for architectural 
performance monitoring capabilities. Architectural performance monitoring is supported if the version ID (see 
Table 3-8) is greater than Pn 0. See Table 3-8. 


For each version of architectural performance monitoring capability, software must enumerate this leaf to discover 
the programming facilities and the architectural performance events available in the processor. The details are 
described in Chapter 22, “Introduction to Virtual-Machine Extensions,” in the Inte/® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3C. 


INPUT EAX = OBH: Returns Extended Topology Information 


CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence of Leaf 1FH 
before using leaf OBH. 


When CPUID executes with EAX set to OBH, the processor returns information about extended topology enumera- 
tion data. Software must detect the presence of CPUID leaf OBH by verifying (a) the highest leaf index supported 
by CPUID is >= OBH, and (b) CPUID.OBH:EBX[15:0] reports a non-zero value. See Table 3-8. 


INPUT EAX = ODH: Returns Processor Extended States Enumeration Information 


When CPUID executes with EAX set to ODH and ECX = 0, the processor returns information about the bit-vector 
representation of all processor state extensions that are supported in the processor and storage size requirements 
of the XSAVE/XRSTOR area. See Table 3-8. 


When CPUID executes with EAX set to ODH and ECX = n(n > 1, and is a valid sub-leaf index), the processor returns 
information about the size and offset of each processor extended state save area within the XSAVE/XRSTOR area. 
See Table 3-8. Software can use the forward-extendable technique depicted below to query the valid sub-leaves 
and obtain size and offset information for each processor extended state save area: 


For i = 2 to 62 // sub-leaf 1 is reserved 
IF (CPUID.(EAX=O0DH, ECX=0):VECTOR[I] = 1 ) // VECTOR is the 64-bit value of EDX:EAX 
Execute CPUID.(EAX=0DH, ECX = i) to examine size and offset for sub-leaf i; 
Fl; 


INPUT EAX = OFH: Returns Intel Resource Director Technology (Intel RDT) Monitoring Enumeration Information 


When CPUID executes with EAX set to OFH and ECX = 0, the processor returns information about the bit-vector 
representation of QoS monitoring resource types that are supported in the processor and maximum range of RMID 
values the processor can use to monitor of any supported resource types. Each bit, starting from bit 1, corresponds 
to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or ResID) that soft- 
ware must use to query QoS monitoring capability available for that type. See Table 3-8. 


When CPUID executes with EAX set to OFH and ECX = n(n >= 1, and is a valid ResID), the processor returns infor- 
mation software can use to program IA32_PQR_ASSOC, IA32_QM_EVTSEL MSRs before reading QoS data from the 
IA32_QM_CTR MSR. 
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INPUT EAX = 10H: Returns Intel Resource Director Technology (Intel RDT) Allocation Enumeration Information 


When CPUID executes with EAX set to 10H and ECX = 0, the processor returns information about the bit-vector 
representation of QoS Enforcement resource types that are supported in the processor. Each bit, starting from bit 
1, corresponds to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or 
ResID) that software must use to query QoS enforcement capability available for that type. See Table 3-8. 


When CPUID executes with EAX set to 10H and ECX = n (n >= 1, and is a valid ResID), the processor returns infor- 
mation about available classes of service and range of QoS mask MSRs that software can use to configure each 
class of services using capability bit masks in the QoS Mask registers, IA32_resourceType_Mask_n. 


INPUT EAX = 12H: Returns Intel SGX Enumeration Information 


When CPUID executes with EAX set to 12H and ECX = OH, the processor returns information about Intel SGX capa- 
bilities. See Table 3-8. 


When CPUID executes with EAX set to 12H and ECX = 1H, the processor returns information about Intel SGX attri- 
butes. See Table 3-8. 


When CPUID executes with EAX set to 12H and ECX = n(n > 1), the processor returns information about Intel SGX 
Enclave Page Cache. See Table 3-8. 


INPUT EAX = 14H: Returns Intel Processor Trace Enumeration Information 


When CPUID executes with EAX set to 14H and ECX = OH, the processor returns information about Intel Processor 
Trace extensions. See Table 3-8. 


When CPUID executes with EAX set to 14H and ECX = n (n > 0 and less than the number of non-zero bits in 
CPUID.(EAX=14H, ECX= OH).EAX), the processor returns information about packet generation in Intel Processor 
Trace. See Table 3-8. 

INPUT EAX = 15H: Returns Time Stamp Counter and Nominal Core Crystal Clock Information 

When CPUID executes with EAX set to 15H and ECX = OH, the processor returns information about Time Stamp 
Counter and Core Crystal Clock. See Table 3-8. 

INPUT EAX = 16H: Returns Processor Frequency Information 

When CPUID executes with EAX set to 16H, the processor returns information about Processor Frequency Informa- 
tion. See Table 3-8. 

INPUT EAX = 17H: Returns System-On-Chip Information 


When CPUID executes with EAX set to 17H, the processor returns information about the System-On-Chip Vendor 
Attribute Enumeration. See Table 3-8. 


INPUT EAX = 18H: Returns Deterministic Address Translation Parameters Information 


When CPUID executes with EAX set to 18H, the processor returns information about the Deterministic Address 
Translation Parameters. See Table 3-8. 


INPUT EAX = 19H: Returns Key Locker Information 
When CPUID executes with EAX set to 19H, the processor returns information about Key Locker. See Table 3-8. 


INPUT EAX = 1AH: Returns Hybrid Information 


When CPUID executes with EAX set to 1AH, the processor returns information about hybrid capabilities. See Table 
3-8. 


INPUT EAX = 1BH: Returns PCONFIG Information 


When CPUID executes with EAX set to 1BH, the processor returns information about PCONFIG capabilities. This 
information is enumerated in sub-leaves selected by the value of ECX (starting with 0). 
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Each sub-leaf of CPUID function 1BH enumerates its sub-leaf type in EAX. If a sub-leaf type is 0, the sub-leaf is 
invalid and zero is returned in EBX, ECX, and EDX. In this case, all subsequent sub-leaves (selected by larger input 
values of ECX) are also invalid. 


The only valid sub-leaf type currently defined is 1, meaning target identifier, indicating that the sub-leaf enumer- 
ates target identifiers for the PCONFIG instruction. Any non-zero value returned in EBX, ECX, or EDX indicates a 
valid target of the PCONFIG instruction (any value of zero should be ignored). The only target identifier currently 
defined is 1, indicating MKTME. See the “PCONFIG — Platform Configuration” instruction in Chapter 4 of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 2B for more information. 


INPUT EAX = 1FH: Returns V2 Extended Topology Information 


When CPUID executes with EAX set to 1FH, the processor returns information about extended topology enumera- 
tion data. Software must detect the presence of CPUID leaf 1FH by verifying (a) the highest leaf index supported 
by CPUID is >= 1FH, and (b) CPUID.1FH:EBX[15:0] reports a non-zero value. See Table 3-8. 


METHODS FOR RETURNING BRANDING INFORMATION 

Use the following techniques to access branding information: 

1. Processor brand string method. 

2. Processor brand index; this method uses a software supplied brand string table. 


These two methods are discussed in the following sections. For methods that are available in early processors, see 
Section: “Identification of Earlier IA-32 Processors” in Chapter 20 of the Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. 


The Processor Brand String Method 


Figure 3-9 describes the algorithm used for detection of the brand string. Processor brand identification software 
should execute this algorithm on all Intel 64 and IA-32 processors. 


This method (introduced with Pentium 4 processors) returns an ASCII brand identification string and the Processor 
Base frequency of the processor to the EAX, EBX, ECX, and EDX registers. 
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Input: EAX= 
0x80000000 


False Processor Brand 


IF (EAX & 0x80000000) 


String Not 
Supported 


Function | Tue 
Supported Extended 


EAX Return Value = 
Max. Extended CPUID 
Function Index 


IF (EAX Return Value True Processor Brand 


> 0x80000004) 


String Supported 


OM15194 


Figure 3-9. Determination of Support for the Processor Brand String 


How Brand Strings Work 


To use the brand string method, execute CPUID with EAX input of 8000002H through 80000004H. For each input 
value, CPUID returns 16 ASCII characters using EAX, EBX, ECX, and EDX. The returned string will be NULL-termi- 
nated. 


Table 3-13 shows the brand string that is returned by the first processor in the Pentium 4 processor family. 


Table 3-13. Processor Brand String Returned with Pentium 4 Processor 
EAX Input Value Return Values ASCII Equivalent 
80000002H EAX = 20202020H 7 
EBX = 20202020H 
ECX = 20202020H 


EDX = 6€492020H “nl " 
80000003H EAX = 286C6574H “(let" 
EBX = 50202952H “P)R" 
ECX = 69746E65H “tne” 
EDX = 52286D75H “R(mu" 
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Table 3-13. Processor Brand String Returned with Pentium 4 Processor (Contd.) 


EAX Input Value Return Values ASCII Equivalent 
80000004H EAX = 20342029H "4y 
EBX = 20555043H "UPC" 
ECX = 30303531H "0051" 
EDX = 007A484DH “\0ZHM" 


Extracting the Processor Frequency from Brand Strings 


Figure 3-10 provides an algorithm which software can use to extract the Processor Base frequency from the 
processor brand string. 


Scan "Brand String" in 
Reverse Byte Order 


"ZHM", or 
"ZHG", or 
"HT" 


Match 
Substring 


IF Substring Matched 


False 
Report Error 


If "ZHM" 
True Multiplier = 1 x 10° 


Multiplier = 1 x 10° 
Determine "Multiplier" 


If "ZHT" ae 7" 
Multiplier = 1 x 10 
Determine "Freq" 


Determine "Freq" 
and "Multiplier" 


Scan Digits 
Until Blank 


Reverse Digits 
To Decimal Value 


In Reverse Order 


Processor Base 
Frequency = 
"Freq" x "Multiplier" 


"Freq" = X.YZ if 
Digits = "ZY.X" 


Figure 3-10. Algorithm for Extracting Processor Frequency 


The Processor Brand Index Method 


The brand index method (introduced with Pentium® Ill Xeon® processors) provides an entry point into a brand 
identification table that is maintained in memory by system software and is accessible from system- and user-level 
code. In this table, each brand index is associate with an ASCII brand identification string that identifies the official 
Intel family and model number of a processor. 


When CPUID executes with EAX set to 1, the processor returns a brand index to the low byte in EBX. Software can 
then use this index to locate the brand identification string for the processor in the brand identification table. The 
first entry (brand index 0) in this table is reserved, allowing for backward compatibility with processors that do not 
support the brand identification feature. Starting with processor signature family ID = OFH, model = 03H, brand 
index method is no longer supported. Use brand string method instead. 


Table 3-14 shows brand indices that have identification strings associated with them. 


CPUID—CPU Identification Vol.2A 3-249 


INSTRUCTION SET REFERENCE, A-L 


Table 3-14. Mapping of Brand Indices; and Intel 64 and IA-32 Processor Brand Strings 


Brand Index Brand String 
OOH This processor does not support the brand identification feature 
01H Intel(R) Celeron(R) processor! 
02H Intel(R) Pentium(R) Ill processor! 
03H Intel(R) Pentium(R) Ill Xeon(R) processor; If processor signature = OO0006B1h, then Intel(R) Celeron(R) 
processor 
04H Intel(R) Pentium(R) Ill processor 
O6H Mobile Intel(R) Pentium(R) Ill processor-M 
07H Mobile Intel(R) Celeron(R) processor! 
08H Intel(R) Pentium(R) 4 processor 
OSH Intel(R) Pentium(R) 4 processor 
OAH Intel(R) Celeron(R) R) processor! 
OBH Intel(R) Xeon(R) processor; If processor signature = OOOOOF1 3h, then Intel(R) Xeon(R) processor MP 
OCH Intel(R) Xeon(R) processor MP 
OEH Mobile Intel(R) Pentium(R) 4 processor-M; If processor signature = OOOOOF1 3h, then Intel(R) Xeon(R) processor 
OFH Mobile Intel(R) Celeron(R) processor! 
11H Mobile Genuine Intel(R) processor 
12H Intel(R) Celeron(R) M processor 
13H Mobile Intel(R) Celeron(R) processor! 
14H Intel(R) Celeron(R) processor 
15H Mobile Genuine Intel(R) processor 
16H Intel(R) Pentium(R) M processor 
17H Mobile Intel(R) Celeron(R) processor! 
18H - OFFH RESERVED 


NOTES: 
1. Indicates versions of these processors that were introduced after the Pentium Ill 


IA-32 Architecture Compatibility 


CPUID is not supported in early models of the Intel486 processor or in any IA-32 processor earlier than the 
Intel486 processor. 


Operation 
IA32_BlOS_SIGN_ID MSR := Update with installed microcode revision number; 


CASE (EAX) OF 

EAX = 0: 
EAX := Highest basic function input value understood by CPUID; 
EBX := Vendor identification string; 
EDX := Vendor identification string; 
ECX := Vendor identification string; 

BREAK; 

EAX = 1H: 
EAX[3:0] := Stepping ID; 
EAX[7:4] := Model; 
EAX[1 1:8] := Family; 


3-250 Vol. 2A CPUID—CPU Identification 


INSTRUCTION SET REFERENCE, A-L 


EAX[13:12] := Processor type; 
EAX[15:14] := Reserved; 
EAX[19:16] := Extended Model; 
EAX[27:20] := Extended Family; 
EAX[31:28] := Reserved; 
EBX[7:0] := Brand Index; (* Reserved if the value is zero. *) 
EBX[15:8] := CLFLUSH Line Size; 
EBX[16:23] := Reserved; (* Number of threads enabled = 2 if MT enable fuse set. *) 
EBX[24:31] := Initial APIC ID; 
ECX != Feature flags; (* See Figure 3-7. *) 
EDX := Feature flags; (* See Figure 3-8. *) 
BREAK; 
EAX = 2H: 
EAX := Cache and TLB information; 
EBX := Cache and TLB information; 
ECX != Cache and TLB information; 
EDX := Cache and TLB information; 
BREAK; 
EAX = 3H: 
EAX := Reserved; 
EBX := Reserved; 
ECX := ProcessorSerialNumber[3 1:0]; 
(* Pentium Ill processors only, otherwise reserved. *) 
EDX := ProcessorSerialNumber[63:32]; 
(* Pentium Ill processors only, otherwise reserved. * 
BREAK 
EAX = 4H: 
EAX := Deterministic Cache Parameters Leaf; (* See Table 3-8. *) 
EBX := Deterministic Cache Parameters Leaf; 
ECX != Deterministic Cache Parameters Leaf; 
EDX := Deterministic Cache Parameters Leaf; 
BREAK; 
EAX = 5H: 
EAX := MONITOR/MWAIT Leaf; (* See Table 3-8. *) 
EBX := MONITOR/MWAIT Leaf; 
ECX := MONITOR/MWAIT Leaf; 
EDX := MONITOR/MWAIT Leaf; 
BREAK; 
EAX = 6H: 
EAX := Thermal and Power Management Leaf; (* See Table 3-8. *) 
EBX := Thermal and Power Management Leaf; 
ECX := Thermal and Power Management Leaf; 
EDX := Thermal and Power Management Leaf; 
BREAK; 
EAX = 7H: 
EAX := Structured Extended Feature Flags Enumeration Leaf; (* See Table 3-8. *) 
EBX := Structured Extended Feature Flags Enumeration Leaf; 
ECX := Structured Extended Feature Flags Enumeration Leaf; 
EDX := Structured Extended Feature Flags Enumeration Leaf; 
BREAK; 
EAX = 8H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
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EDX := Reserved = 0; 
BREAK; 
EAX = SH: 
EAX := Direct Cache Access Information Leaf; (* See Table 3-8. *) 
EBX := Direct Cache Access Information Leaf; 
ECX := Direct Cache Access Information Leaf; 
EDX := Direct Cache Access Information Leaf; 
BREAK; 
EAX = AH: 
EAX := Architectural Performance Monitoring Leaf; (* See Table 3-8. *) 
EBX := Architectural Performance Monitoring Leaf; 
ECX := Architectural Performance Monitoring Leaf; 
EDX := Architectural Performance Monitoring Leaf; 
BREAK 
EAX = BH: 
EAX := Extended Topology Enumeration Leaf; (* See Table 3-8. *) 
EBX := Extended Topology Enumeration Leaf; 
ECX := Extended Topology Enumeration Leaf; 
EDX := Extended Topology Enumeration Leaf; 
BREAK; 
EAX = CH: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = DH: 
EAX := Processor Extended State Enumeration Leaf; (* See Table 3-8. *) 
EBX := Processor Extended State Enumeration Leaf; 
ECX := Processor Extended State Enumeration Leaf; 
EDX := Processor Extended State Enumeration Leaf; 
BREAK; 
EAX = EH: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = FH: 
EAX := Intel Resource Director Technology Monitoring Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
ECX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
EDX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
BREAK; 
EAX = 10H: 
EAX := Intel Resource Director Technology Allocation Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Resource Director Technology Allocation Enumeration Leaf; 
ECX := Intel Resource Director Technology Allocation Enumeration Leaf; 
EDX := Intel Resource Director Technology Allocation Enumeration Leaf; 
BREAK; 
EAX = 12H: 
EAX := Intel SGX Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel SGX Enumeration Leaf; 
ECX := Intel SGX Enumeration Leaf; 
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EDX := Intel SGX Enumeration Leaf; 
BREAK; 
EAX = 14H: 
EAX := Intel Processor Trace Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Processor Trace Enumeration Leaf; 
ECX := Intel Processor Trace Enumeration Leaf; 
EDX := Intel Processor Trace Enumeration Leaf; 
BREAK; 
EAX = 15H: 
EAX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; (* See Table 3-8. *) 
EBX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
ECX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
EDX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
BREAK; 
EAX = 16H: 
EAX := Processor Frequency Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := Processor Frequency Information Enumeration Leaf; 
ECX := Processor Frequency Information Enumeration Leaf; 
EDX := Processor Frequency Information Enumeration Leaf; 
BREAK; 
EAX = 17H: 
EAX := System-On-Chip Vendor Attribute Enumeration Leaf; (* See Table 3-8. *) 
EBX := System-On-Chip Vendor Attribute Enumeration Leaf; 
ECX := System-On-Chip Vendor Attribute Enumeration Leaf; 
EDX := System-On-Chip Vendor Attribute Enumeration Leaf; 
BREAK; 
EAX = 18H: 
EAX := Deterministic Address Translation Parameters Enumeration Leaf; (* See Table 3-8. *) 
EBX := Deterministic Address Translation Parameters Enumeration Leaf; 
ECX != Deterministic Address Translation Parameters Enumeration Leaf; 
EDX := Deterministic Address Translation Parameters Enumeration Leaf; 
BREAK; 
EAX = 19H: 
EAX := Key Locker Enumeration Leaf; (* See Table 3-8. *) 
EBX != Key Locker Enumeration Leaf; 
ECX := Key Locker Enumeration Leaf; 
EDX := Key Locker Enumeration Leaf; 
BREAK; 
EAX = 1AH: 
EAX := Hybrid Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := Hybrid Information Enumeration Leaf; 
ECX := Hybrid Information Enumeration Leaf; 
EDX := Hybrid Information Enumeration Leaf; 
BREAK; 
EAX = 1BH: 
EAX := PCONFIG Information Enumeration Leaf; (* See “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-246. *) 
EBX := PCONFIG Information Enumeration Leaf; 
ECX := PCONFIG Information Enumeration Leaf; 
EDX := PCONFIG Information Enumeration Leaf; 
BREAK; 
EAX = 1FH: 
EAX := V2 Extended Topology Enumeration Leaf; (* See Table 3-8. *) 
EBX := V2 Extended Topology Enumeration Leaf; 
ECX := V2 Extended Topology Enumeration Leaf; 
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EDX := V2 Extended Topology Enumeration Leaf; 
BREAK; 
EAX = 80000000H: 
EAX := Highest extended function input value understood by CPUID; 
EBX := Reserved; 
ECX := Reserved; 
EDX := Reserved; 
BREAK; 
EAX = 80000001H: 
EAX := Reserved; 
EBX := Reserved; 
ECX := Extended Feature Bits (* See Table 3-8.*); 
EDX := Extended Feature Bits (* See Table 3-8. *); 
BREAK; 
EAX = 80000002H: 
EAX := Processor Brand String; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000003H: 
EAX := Processor Brand String, continued; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000004H: 
EAX := Processor Brand String, continued; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000005H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = 80000006H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Cache information; 
EDX := Reserved = 0; 
BREAK; 
EAX = 80000007H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = Misc Feature Flags; 
BREAK; 
EAX = 80000008H: 
EAX := Reserved = Physical Address Size Information; 
EBX := Reserved = Virtual Address Size Information; 
ECX := Reserved = 0; 
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EDX := Reserved = 0; 

BREAK; 

EAX >= 40000000H and EAX <= 4FFFFFFFH: 

DEFAULT: (* EAX = Value outside of recognized range for CPUID. *) 
(* If the highest basic information leaf data depend on ECX input value, ECX is honored.*) 
EAX := Reserved; (* Information returned for highest basic information leaf. *) 
EBX := Reserved; (* Information returned for highest basic information leaf. *) 
ECX != Reserved; (* Information returned for highest basic information leaf. *) 
EDX := Reserved; (* Information returned for highest basic information leaf. *) 

BREAK; 

ESAC; 


Flags Affected 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 


In earlier IA-32 processors that do not support the CPUID instruction, execution of the instruc- 
tion results in an invalid opcode (#UD) exception being generated. 
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CRC32 — Accumulate CRC32 Value 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

F2 OF 38 FO /r RM | Valid Valid Accumulate CRC32 on r/m8. 
CRC32 r32, r/m8 

F2 REX OF 38 FO /r RM | Valid N.E. Accumulate CRC32 on r/mé. 
CRC32 r32, r/m8* 

F2 OF 38 F1 /r RM | Valid Valid Accumulate CRC32 on r/m16. 
CRC32 r32, r/m16 

F2 OF 38 F1 /r RM | Valid Valid Accumulate CRC32 on r/m32. 
CRC32 r32, r/m32 

F2 REX.W OF 38 FO /r RM _ | Valid N.E. Accumulate CRC32 on r/mé. 
CRC32 164, r/m8 

F2 REX.W OF 38 F1 /r RM | Valid N.E. Accumulate CRC32 on r/m64. 
CRC32 164, r/m64 

NOTES: 


*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Starting with an initial value in the first operand (destination operand), accumulates a CRC32 (polynomial 
11EDC6F41H) value for the second operand (source operand) and stores the result in the destination operand. The 
source operand can be a register or a memory location. The destination operand must be an r32 or r64 register. If 
the destination is an r64 register, then the 32-bit result is stored in the least significant double word and 
OOOOOOOOH is stored in the most significant double word of the r64 register. 


The initial value supplied in the destination operand is a double word integer stored in the r32 register or the least 
significant double word of the r64 register. To incrementally accumulate a CRC32 value, software retains the result 
of the previous CRC32 operation in the destination operand, then executes the CRC32 instruction again with new 
input data in the source operand. Data contained in the source operand is processed in reflected bit order. This 
means that the most significant bit of the source operand is treated as the least significant bit of the quotient, and 
so on, for all the bits of the source operand. Likewise, the result of the CRC operation is stored in the destination 
operand in reflected bit order. This means that the most significant bit of the resulting CRC (bit 31) is stored in the 
least significant bit of the destination operand (bit 0), and so on, for all the bits of the CRC. 


Operation 


Notes: 


BIT_REFLECT64: DST[63-0] = SRC[0-63] 
BIT_REFLECT32: DST[31-0] = SRC[O-31] 
BIT_REFLECT 16: DST[15-0] = SRC[O-15] 
BIT_REFLECTS8: DST[7-0] = SRC[O-7] 

MOD2: Remainder from Polynomial division modulus 2 
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CRC32 instruction for 64-bit source operand and 64-bit destination operand: 


TEMP1[63-0] := BIT_REFLECT64 (SRC[63-0]) 
TEMP2[31-0] = BIT_REFLECT32 (DEST[31-0]) 
TEMP3[95-0] := TEMP1 [63-0] « 32 

TEMP4[95-0] := TEMP2[31-0] « 64 

TEMP5[95-0] := TEMP3[95-0] XOR TEMP4[95-0] 
TEMP6[31-0] := TEMP5[95-0] MOD2 11E€DC6F41H 
DEST[31-0] := BIT_REFLECT (TEMP6[31-0]) 
DEST[63-32] := 00000000H 


CRC32 instruction for 32-bit source operand and 32-bit destination operand: 


TEMP1[31-0] = BIT_REFLECT32 (SRC[31-0]) 
TEMP2[31-0] = BIT_REFLECT32 (DEST[31-0]) 
TEMP3[63-0] := TEMP1[31-0] « 32 

TEMP4[63-0] := TEMP2[31-0] « 32 

TEMP5[63-0] := TEMP3[63-0] XOR TEMP4[63-0] 
TEMP6[31-0] := TEMP5[63-0] MOD2 11EDC6F41H 
DEST[31-0] := BIT_REFLECT (TEMP6[31-0]) 


CRC32 instruction for 16-bit source operand and 32-bit destination operand: 


TEMP1[15-0] = BIT_REFLECT16 (SRC[15-0]) 
TEMP2[31-0] = BIT_REFLECT32 (DEST[31-0]) 
TEMP3[47-0] := TEMP1[15-0] « 32 

TEMP4[47-0] := TEMP2[31-0] « 16 

TEMPS [47-0] := TEMP3[47-0] XOR TEMP4[47-0] 
TEMP6[31-0] := TEMP5[47-0] MOD2 11EDC6F41H 
DEST[31-0] := BIT_REFLECT (TEMP6[31-0]) 


CRC32 instruction for 8-bit source operand and 64-bit destination operand: 


TEMP1[7-0] := BIT_REFLECTS(SRC[7-0]) 
TEMP2[31-0] = BIT_REFLECT32 (DEST[31-0]) 
TEMP3[39-0] := TEMP1[7-0] « 32 

TEMP4[39-0] := TEMP2[31-0] « 8 

TEMPS5[39-0] := TEMP3[39-0] XOR TEMP4[39-0] 
TEMP6[31-0] := TEMP5[39-0] MOD2 11EDC6F41H 
DEST[31-0] := BIT_REFLECT (TEMP6[31-0]) 
DEST[63-32] := O0000000H 


CRC32 instruction for 8-bit source operand and 32-bit destination operand: 


TEMP1[7-0] := BIT_REFLECT8(SRC[7-0]) 
TEMP2[31-0] = BIT_REFLECT32 (DEST[31-0]) 
TEMP3[39-0] := TEMP1[7-0] « 32 

TEMP4[39-0] := TEMP2[31-0] « 8 

TEMP5[39-0] := TEMP3[39-0] XOR TEMP4[39-0] 
TEMP6[31-0] := TEMP5[39-0] MOD2 11EDC6F41H 
DEST[31-0] := BIT_REFLECT (TEMP6[31-0]) 


Flags Affected 
None 
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Intel C/C++ Compiler Intrinsic Equivalent 


unsigned int _mm_crc32_u8( unsigned int crc, unsigned char data ) 

unsigned int __mm_crc32_u16( unsigned int crc, unsigned short data ) 

unsigned int _mm_crc32_u32( unsigned int crc, unsigned int data ) 

unsigned __int64_mm_crc32_u64( unsigned __int64 crc, unsigned __int64 data ) 


SIMD Floating Point Exceptions 


None 


Protected Mode Exceptions 


#GP(0) 
#SS(0) 
#PF (fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS or GS segments. 
If a memory operand effective address is outside the SS segment limit. 
For a page fault. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If CPUID.01H:ECX.SSE4_2 [Bit 20] = 0. 
If LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) 
#SS(0) 
#UD 


If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
If a memory operand effective address is outside the SS segment limit. 

If CPUID.01H:ECX.SSE4_2 [Bit 20] = 0. 

If LOCK prefix is used. 


Virtual 8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#PF (fault-code) 
#AC(0) 

#UD 


If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
If a memory operand effective address is outside the SS segment limit. 

For a page fault. 

If alignment checking is enabled and an unaligned memory reference is made. 

If CPUID.01H:ECX.SSE4_2 [Bit 20] = 0. 

If LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in Protected Mode. 


64-Bit Mode Exceptions 


#GP(0) 
#SS(0) 
#PF (fault-code) 
#AC(0) 


#UD 


3-258 Vol. 2A 


If the memory address is in a non-canonical form. 
If a memory address referencing the SS segment is in a non-canonical form. 
For a page fault. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If CPUID.01H:ECX.SSE4_2 [Bit 20] = 0. 
If LOCK prefix is used. 
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CVTDQ2PD—Convert Packed Doubleword Integers to Packed Double-Precision Floating-Point 


Values 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF E6 /r A VIV SSE2 Convert two packed signed doubleword integers from 
CVTDQ2PD xmm1, xmm2/m64 xmm2/mem to two packed double-precision floating- 
point values in xmm1. 
VEX.128.F3.0F.WIG E6 /r A VIV AVX Convert two packed signed doubleword integers from 
VCVTDQ2PD xmm1, xmm2/m64 xmm2/mem to two packed double-precision floating- 
point values in xmm1. 
VEX.256.F3.0F.WIG E6 /r A VIV AVX Convert four packed signed doubleword integers from 
VCVTDQ2PD ymm1, xmm2/m128 xmm2/mem to four packed double-precision floating- 
point values in ymm1. 
EVEX.128.F3.0F.WO E6 /r B VIV AVX512VL | Convert 2 packed signed doubleword integers from 
VCVTDQ2PD xmm1 {k1}{Z}, AVX512F xmm2/m64/m32bcst to eight packed double-precision 
xmm2/m64/m32bcst floating-point values in xmm1 with writemask k1. 
EVEX.256.F3.0F.WO0 E6 /r B VIV AVX512VL | Convert 4 packed signed doubleword integers from 
VCVTDQ2PD ymm1 {k1}{2}, AVX512F xmm2/m128/m32bcst to 4 packed double-precision 
xmm2/m128/m32bcst floating-point values in ymm1 with writemask k1. 
EVEX.512.F3.0F.WO0 E6 /r B VIV AVX512F Convert eight packed signed doubleword integers from 
VCVTDQ2PD zmm1 {k1}{Z}, ymm2/m256/m32bcst to eight packed double-precision 
ymm2/m256/m32bcst floating-point values in zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two, four or eight packed signed doubleword integers in the source operand (the second operand) to two, 
four or eight packed double-precision floating-point values in the destination operand (the first operand). 


EVEX encoded versions: The source operand can be a YMM/XMM/XMM (low 64 bits) register, a 256/128/64-bit 
memory location or a 256/128/64-bit vector broadcasted from a 32-bit memory location. The destination operand 
is aZMM/YMM/XMM register conditionally updated with writemask k1. Attempt to encode this instruction with EVEX 
embedded rounding is ignored. 

VEX.256 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a YMM register. 


VEX.128 encoded version: The source operand is an XMM register or 64- bit memory location. The destination 
operand is a XMM register. The upper Bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 64- bit memory location. The destination 
operand is an XMM register. The upper Bits (MAXVL-1:128) of the corresponding ZMM register destination are 
unmodified. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 
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SRC X3 X2 x1 


XO 


DEST X3 X2 x1 


XO 


Figure 3-11. CVTDQ2PD (VEX.256 encoded version) 


Operation 


VCVTDQ2PD (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 

i:=j* 64 

k:=j* 32 

IF k1[j] OR *no writemask* 

THEN DEST[i+63:i] := 
Convert_Integer_To_Double_Precision_Floating_Point(SRC[k+31:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VCVTDQ2PD (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
Convert_Integer_To_Double_Precision_Floating_Point(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Integer_To_Double_Precision_Floating_Point(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VCVTDQ2PD (VEX.256 encoded version) 

DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[31:0]) 
DEST[1 27:64] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[191:128] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[95:64]) 
DEST[255:192] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[1 27:96) 
DEST[MAXVL-1:256] := 0 


VCVTDQ2PD (VEX.128 encoded version) 

DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[31:0)) 
DEST[1 27:64] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[MAXVL-1:128] := 0 


CVTDQ2PD (128-bit Legacy SSE version) 

DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[31:0]) 
DEST[1 27:64] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[MAXVL-1:128] (unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 

VCVTDQ2PD __m512d_mm512_cvtepi32_pd( __m256i a); 

VCVTDQ2PD __m512d_mm512_mask_cvtepi32_pd(_m512ds,___mmask8 k, __m256i a); 
VCVTDQ2PD __m512d_mm512_maskz_cvtepi32_pd(__mmask8 k, __m256i a); 
VCVTDQ2PD __m256d _mm256_cvtepi32_pd (__m128i src); 

VCVTDQ2PD __m256d_mm256_mask_cvtepi32_pd(__m256d s,___ mmask8 k, 
VCVTDQ2PD __m256d __mm256_maskz_cvtepi32_pd(__mmask8 k, __m256i a); 
VCVTDQ2PD __m128d_mm_mask_cvtepi32_pd(__m128d s, __mmask8 k, __m128i a); 
VCVTDQ2PD __m128d __mm_maskz_cvtepi32_pd( ___mmask8 k, __m128i a); 
CVTDQ2PD __m128d __mm_cvtepi32_pd (__m128i src) 


m256i a); 
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INSTRUCTION SET REFERENCE, A-L 


Other Exceptions 

VEX-encoded instructions, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-51, “Type E5 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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CVTDQ2PS—Convert Packed Doubleword Integers to Packed Single-Precision Floating-Point 


Values 
Opcode Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 5B /r A VIV SSE2 Convert four packed signed doubleword integers from 
CVTDQ2PS xmm1, xmm2/m128 xmm2/mem to four packed single-precision floating- 
point values in xmm1. 
VEX.128.0F.WIG 5B /r A VIV AVX Convert four packed signed doubleword integers from 
VCVTDQ2PS xmm1, xmm2/m128 xmm2/mem to four packed single-precision floating- 
point values in xmm1. 
VEX.256.0F.WIG 5B /r A VIN AVX Convert eight packed signed doubleword integers from 
VCVTDQ2PS ymm1, ymm2/m256 ymm2/mem to eight packed single-precision floating- 
point values in ymm1. 
EVEX.128.0F.WO 5B /r B VIV AVX512VL | Convert four packed signed doubleword integers from 
VCVTDQ2PS xmm1 {k1}{Z}, AVX512F xmm2/m128/m32bcst to four packed single-precision 
xmme2/m128/m32bcst floating-point values in xmm1 with writemask k1. 
EVEX.256.0F.WO 5B /r B VIV AVX512VL | Convert eight packed signed doubleword integers from 
VCVTDQ2PS ymm1 {k1}{2Z}, AVX512F ymm2/m256/m32bcst to eight packed single-precision 
ymm2/m256/m32bcst floating-point values in ymm1 with writemask k1. 
EVEX.512.0F.WO 5B /r B VIV AVX512F Convert sixteen packed signed doubleword integers 
VCVTDQ2PS zmm1 {k1}{Z}, from zmm2/m512/m32bcst to sixteen packed single- 
zmm2/m512/m32bcst{er} precision floating-point values in zmm1 with writemask 
k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts four, eight or sixteen packed signed doubleword integers in the source operand to four, eight or sixteen 
packed single-precision floating-point values in the destination operand. 


EVEX encoded versions: The source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register conditionally updated with writemask k1. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is a YMM register. Bits (MAXVL-1:256) of the corresponding register destination are zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:128) of the corresponding register destination are zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. The upper Bits (MAXVL-1:128) of the corresponding register destination are unmodi- 
fied. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 
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Operation 


VCVTDQ2PS (EVEX encoded versions) when SRC operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); ; refer to Table 15-4 in the Intel® 64 and IA-32 Architectures 
Software Developer's Manual, Volume 1 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); ; refer to Table 15-4 in the Intel® 64 and IA-32 Architectures 
Software Developer's Manual, Volume 1 
Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
Convert_Integer_To_Single_Precision_Floating_Point(SRC[i+31:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTDQ2PS (EVEX encoded versions) when SRC operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Integer_To_Single_Precision_Floating_Point(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VCVTDQ2PS (VEX.256 encoded version) 

DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0]) 
DEST[63:32] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:32]) 
DEST[95:64] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[95:64]) 
DEST[1 27:96] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[1 27:96) 
DEST[159:1 28] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[159:128]) 
DEST[191:160] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[191:160]) 
DEST[223:192] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[223:192]) 
DEST[255:224] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[255:224) 
DEST[MAXVL-1:256] := 0 


VCVTDQ2PS (VEX.128 encoded version) 

DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0]) 
DEST[63:32] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:32]) 
DEST[95:64] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[95:64]) 
DEST[1 27:96] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[127z:96) 
DEST[MAXVL-1:128] := 0 


CVTDQ2PS (128-bit Legacy SSE version) 

DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0]) 
DEST[63:32] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:32]) 
DEST[95:64] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[95:64]) 
DEST[1 27:96] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[127z:96) 
DEST[MAXVL-1:128] (unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTDQ2PS __m512 _mm512_cvtepi32_ps(__m512i a); 

VCVTDQ2PS __m512 _mm512_mask_cvtepi32_ps(__m512 s,__ mmask16 k,___m512i a); 
VCVTDQ2PS __m512 _mm512_maskz_cvtepi32_ps(_mmask16 k, __m512i a); 
VCVTDQ2PS __m512_mm512_cvt_roundepi32_ps(_m512i a, int r); 

VCVTDQ2PS __m512 __mm512_mask_cvt_roundepi_ps(__m512 s,__mmask16 k,___m512i a, int r); 
VCVTDQ2PS __m512 _mm512_maskz_cvt_roundepi32_ps(_mmask16 k,___m512ia, int r); 
VCVTDQ2PS __m256 __mm256_mask_cvtepi32_ps(__m256 s,__mmask8 k, __m256i a); 
VCVTDQ2PS __m256 __mm256_maskz_cvtepi32_ps(___mmask8 k, __m256i a); 
VCVTDQ2PS __m128_mm_mask_cvtepi32_ps(__m128 s,___mmask8 k, __m128i a); 
VCVTDQ2PS __m128 _mm_maskz_cvtepi32_ps(_mmask8 k, __m128i a); 

CVTDQ2PS __m256 __mm256_cvtepi32_ps (__m256i src) 

CVTDQ2PS __m128 _mm_cvtepi32_ps (__m128i src) 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 

VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvwv != 1111B. 
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CVTPD2DQ—Convert Packed Double-Precision Floating-Point Values to Packed Doubleword 


Integers 
Opcode Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F2 OF E6 /r A VIV SSE2 Convert two packed double-precision floating-point 
CVTPD2DQ xmm1, xmm2/m128 values in xmm2/mem to two signed doubleword 
integers in xmm1. 
VEX.128.F2.0F.WIG E6 /r A VIV AVX Convert two packed double-precision floating-point 
VCVTPD2DQ xmm1, xmm2/m128 values in xmm2/mem to two signed doubleword 
integers in xmm1. 
VEX.256.F2.0F.WIG E6 /r A VIV AVX Convert four packed double-precision floating-point 
VCVTPD2DQ xmm1, ymm2/m256 values in ymm2/mem to four signed doubleword 
integers in xmm1. 
EVEX.128.F2.0F.W1 E6 /r B VIV AVX512VL | Convert two packed double-precision floating-point 
VCVTPD2DQ xmm1 {k1}{Z}, AVX512F values in xmm2/m128/m64bcst to two signed 
xmm2/m1 28/m64bcst doubleword integers in xmm1 subject to writemask k1. 
EVEX.256.F2.0F.W1 E6 /r B VIV AVX512VL | Convert four packed double-precision floating-point 
VCVTPD2DQ xmm1 {k1}{Z}, AVX512F values in ymm2/m256/m64bcst to four signed 
ymm2/m256/m64bcst doubleword integers in xmm1 subject to writemask k1. 
EVEX.512.F2.0F.W1 E6 /r B VIV AVX512F Convert eight packed double-precision floating-point 
VCVTPD2DQ ymm1 {k1}{Z}, values in zmm2/m512/m64bcst to eight signed 
zmm2/m512/m64bcst{er} doubleword integers in ymm1 subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed double-precision floating-point values in the source operand (second operand) to packed signed 
doubleword integers in the destination operand (first operand). 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the indefinite integer value 
(2“-1, where w represents the number of bits in the destination format) is returned. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512-bit memory location, or a 512-bit 
vector broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register condi- 
tionally updated with writemask k1. The upper bits (MAXVL-1:256/128/64) of the corresponding destination are 
zeroed. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:64) of the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. Bits[127:64] of the destination XMM register are zeroed. However, the upper bits 
(MAXVL-1:128) of the corresponding ZMM register destination are unmodified. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 
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SRC X3 X2 x1 XO 


DEST 0 X3 X2 X1 XO 


Figure 3-12. VCVTPD2DQ (VEX.256 encoded version) 


Operation 


VCVTPD2DQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
Convert_Double_Precision_Floating_Point_To_Integer(SRC[k+63:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 
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VCVTPD2DQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:=0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Integer(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTPD2DQ (VEX.256 encoded version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[127:64]) 
DEST[95:64] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[191:128]) 
DEST[1 27:96] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[255:192) 
DEST[MAXVL-1:128] := 0 


VCVTPD2DQ (VEX.128 encoded version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[127:64]) 
DEST[MAXVL-1:64] := 0 


CVTPD2DQ (128-bit Legacy SSE version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[127:64]) 
DEST[127:64] := 0 

DEST[MAXVL-1:128] (unmodified) 
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VCVTPD2DQ 


m256i 


mm512 


cvtpd_epi32( 


VCVTPD2DQ 


m256i 


mm512 


mask_cvtpd_epi32( 


VCVTPD2DQ 


m256i 


mm512 


maskz_cvtpd_epi32( 


m512d a); 
m256is, 


VCVTPD2DQ 


m256i 


mm512 


cvt_roundpd_epi32( 


m512d a, int r); 


VCVTPD2DQ 


m256i 


mm512 


mask_cvt_roundpd_epi32( 


VCVTPD2DQ 


m256i 


mm512 


maskz_cvt_roundpd_epi32( 


VCVTPD2DQ 


m128i 


mm256 


mask_cvtpd_epi32( 


VCVTPD2DQ 


m128i 


mm256 


maskz_cvtpd_epi32( 


VCVTPD2DQ 


m128i 


mm_mask_cvtpd_epi32( 


VCVTPD2DQ 


m128i 


mm_maskz_cvtpd_epi32( 


VCVTPD2DQ 


m1 28i 


mm256_cvtpd_epi32 (__m256d src) 


CVTPD2DQ __m128i__mm_cvtpd_epi32 ( 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 


EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


Additionally: 
#UD 


m128d src) 


mmask8 k, 
mmask8 k,__m512d a); 


m128d a); 


m512d a); 


m256is,__ mmask8 k,__m512d a, int r); 
mmask8 k, 
m128is,__mmask8 k,__ m256d a); 
mmask8 k,___m256d a); 
m128is,__mmask8 k,__m128d a); 
mmask8 k, 


m512d a, int r); 


If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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CVTPD2PI—Convert Packed Double-Precision FP Values to Packed Dword Integers 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
66 OF 2D /r RM VIV SSE2 Convert two packed double-precision floating- 
CVTPD2PI mm, xmm/m128 point values from xmm/m128 to two packed 
signed doubleword integers in mm. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two packed double-precision floating-point values in the source operand (second operand) to two packed 
signed doubleword integers in the destination operand (first operand). 


The source operand can be an XMM register or a 128-bit memory location. The destination operand is an MMX tech- 
nology register. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register. If a converted result is larger than the maximum signed doubleword integer, the floating-point invalid 
exception is raised, and if this exception is masked, the indefinite integer value (80000000H) is returned. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the CVTPD2PI instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
Operation 


DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer32(SRC[63:0)); 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer32(SRC[127:64)); 


Intel C/C++ Compiler Intrinsic Equivalent 
CVTPD1PI: m64 _mm_cvtpd_pi32(__m128d a) 


SIMD Floating-Point Exceptions 
Invalid, Precision. 


Other Exceptions 


See Table 21-4, “Exception Conditions for Legacy SIMD/MMX Instructions with FP Exception and 16-Byte Align- 
ment” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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CVTPD2PS—Convert Packed Double-Precision Floating-Point Values to Packed Single-Precision 
Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

66 OF 5A /r A VIV SSE2 Convert two packed double-precision floating-point 

CVTPD2PS xmm1, xmm2/m128 values in xmm2/mem to two single-precision 
floating-point values in xmm1. 

VEX.128.66.0F.WIG 5A /r A VIV AVX Convert two packed double-precision floating-point 

VCVTPD2PS xmm1, xmm2/m128 values in xmm2/mem to two single-precision 
floating-point values in xmm1. 

VEX.256.66.0F.WIG 5A /r A VIV AVX Convert four packed double-precision floating-point 

VCVTPD2PS xmm1, ymm2/m256 values in ymm2/mem to four single-precision 
floating-point values in xmm1. 

EVEX.128.66.0F.W1 5A /r B VIV AVX512VL | Convert two packed double-precision floating-point 

VCVTPD2PS xmm1 {k1}{Z}, AVX512F values in xmm2/m128/m64bcst to two single- 

xmm2/m128/m64bcst precision floating-point values in xmm1 with 
writemask k1. 

EVEX.256.66.0F.W1 5A /r B VIV AVX512VL | Convert four packed double-precision floating-point 

VCVTPD2PS xmm1 {k1}{Z}, AVX512F values in ymm2/m256/m64bcst to four single- 

ymm2/m256/m64bcst precision floating-point values in xmm1 with 
writemask k1. 

EVEX.512.66.0F.W1 5A /r B VIV AVX512F Convert eight packed double-precision floating-point 

VCVTPD2PS ymm1 {k1}{Z}, values in zmm2/m512/m64bcst to eight single- 

zmm2/m512/m64bcst{er} precision floating-point values in ymm1 with 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two, four or eight packed double-precision floating-point values in the source operand (second operand) 
to two, four or eight packed single-precision floating-point values in the destination operand (first operand). 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MXCSR 
register or the embedded rounding control bits. 


EVEX encoded versions: The source operand is aZMM/YMM/XMM register, a 512/256/128-bit memory location, or 
a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is a 
YMM/XMM/XMM (low 64-bits) register conditionally updated with writemask k1. The upper bits (MAXVL- 
1:256/128/64) of the corresponding destination are zeroed. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:64) of the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. Bits[127:64] of the destination XMM register are zeroed. However, the upper Bits 
(MAXVL-1:128) of the corresponding ZMM register destination are unmodified. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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SRC X3 X2 x1 x0 


DEST 0 X3 X2 X1 X0 


Figure 3-13. VCVTPD2PS (VEX.256 encoded version) 


Operation 


VCVTPD2PS (EVEX encoded version) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+31:i] := Convert_Double_Precision_Floating_Point_To_Single_Precision_Floating_Point(SRC[k+63:k]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL/2] := 0 
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VCVTPD2PS (EVEX encoded version) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


INSTRUCTION SET REFERENCE, A-L 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] :=Convert_Double_Precision_Floating_Point_To_Single_Precision_Floating_Point(SRC[63:0]) 
ELSE 
DEST[i+31:i] := Convert_Double_Precision_Floating_Point_To_Single_Precision_Floating_Point(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTPD2PS (VEX.256 encoded version) 

DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[1 27:64]) 
DEST[95:64] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[191:128)) 
DEST[1 27:96] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[255:192) 
DEST[MAXVL-1:128] := 0 


VCVTPD2PS (VEX.128 encoded version) 

DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[1 27:64) 
DEST[MAXVL-1:64] := 0 


CVTPD2PS (128-bit Legacy SSE version) 

DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[1 27:64}]) 
DEST[127:64] := 0 

DEST[MAXVL-1:128] (unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


mmask8 k,___m512d a); 


mm512_mask_cvt_roundpd_ps(__m256 s,__mmask8 k,___m512d a, int r); 


m512d a, int r); 


mm256_mask_cvtpd_ps(__m128s,__mmask8 k,__ m256d a); 


m256d a); 


mm_mask_cvtpd_ps(__m128s,__mmask8 k,__m128d a); 


VCVTPD2PS __m256_mm512_cvtpd_ps(__m512d a); 

VCVTPD2PS __m256 _mm512_mask_cvtpd_ps(__m256 s, 
VCVTPD2PS __m256 _mm512_maskz_cvtpd_ps(__ mmask8 k,___m512d a); 
VCVTPD2PS __m256 _mm512_cvt_roundpd_ps(_m512d a, int r); 
VCVTPD2PS __m256 

VCVTPD2PS __m256 _mm512_maskz_cvt_roundpd_ps(__mmask8 k, 
VCVTPD2PS __m128 

VCVTPD2PS __m128 _mm256_maskz_cvtpd_ps(__mmask8 k, 
VCVTPD2PS __m128 

VCVTPD2PS __m128 _mm_maskz_cvtpd_ps(___mmask8 k,___m128d a); 
VCVTPD2PS __m128 _mm256_cvtpd_ps (__m256d a) 


CVTPD2PS __m128_mm_cvtpd_ps (__m128d a) 


SIMD Floating-Point Exceptions 
Invalid, Precision, Underflow, Overflow, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 


EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


Additionally: 
#UD 
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If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 


CVTPD2PS—Convert Packed Double-Precision Floating-Point Values to Packed Single-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, A-L 


CVTPI2PD—Convert Packed Dword Integers to Packed Double-Precision FP Values 


Opcode/ Op/ | 64-Bit Compat/ |Description 
Instruction En |Mode Leg Mode 
66 OF 2A /r RM_ | Valid Valid Convert two packed signed doubleword 


integers from mm/mem64 to two packed 


CVTPI2PD xmm, mm/m64* 
double-precision floating-point values in xmm. 


NOTES: 
*Operation is different for different operand sets; see the Description section. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two packed signed doubleword integers in the source operand (second operand) to two packed double- 
precision floating-point values in the destination operand (first operand). 


The source operand can be an MMX technology register or a 64-bit memory location. The destination operand is an 
XMM register. In addition, depending on the operand configuration: 


¢ For operands xmm, mm: the instruction causes a transition from x87 FPU to MMX technology operation (that 
is, the x87 FPU top-of-stack pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this 
instruction is executed while an x87 FPU floating-point exception is pending, the exception is handled before 
the CVTPI2PD instruction is executed. 

¢ For operands xmm, m64: the instruction does not cause a transition to MMX technology and does not take 
x87 FPU exceptions. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 


DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[3 1:0)); 
DEST[1 27:64] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[63:32)); 


Intel C/C++ Compiler Intrinsic Equivalent 
CVTPI2PD: m128d_mm_cvtpi32_pd(__m64 a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 21-6, “Exception Conditions for Legacy SIMD/MMxX Instructions with XMM and without FP Exception” in 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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INSTRUCTION SET REFERENCE, A-L 


CVTPIZ2PS—Convert Packed Dword Integers to Packed Single-Precision FP Values 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF 2A /r RM_ | Valid Valid Convert two signed doubleword integers 

CVTPIZ2PS xmm, mm/m64 from mm/m64 to two single-precision 
floating-point values in xmm. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Converts two packed signed doubleword integers in the source operand (second operand) to two packed single- 
precision floating-point values in the destination operand (first operand). 


The source operand can be an MMX technology register or a 64-bit memory location. The destination operand is an 
XMM register. The results are stored in the low quadword of the destination operand, and the high quadword 
remains unchanged. When a conversion is inexact, the value returned is rounded according to the rounding control 
bits in the MXCSR register. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the CVTPI2PS instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 


DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0)); 
DEST[63:32] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:32]); 
(* High quadword of destination unchanged *) 


Intel C/C++ Compiler Intrinsic Equivalent 


CVTPI2PS: m128_mm_cvtpi32_ps(__m128 a,__m64 b) 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 


See Table 21-5, “Exception Conditions for Legacy SIMD/MMX Instructions with XMM and FP Exception” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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INSTRUCTION SET REFERENCE, A-L 


CVTPS2DQ—Convert Packed Single-Precision Floating-Point Values to Packed Signed 
Doubleword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 5B /r A VIV SSE2 Convert four packed single-precision floating-point values 
CVTPS2DQ xmm1, xmm2/m128 from xmm2/mem to four packed signed doubleword 
values in xmm1. 
VEX.128.66.0F.WIG 5B /r A VIV AVX Convert four packed single-precision floating-point values 
VCVTPS2DQ xmm1, xmm2/m128 from xmm2/mem to four packed signed doubleword 
values in xmm1. 
VEX.256.66.0F.WIG 5B /r A VIV AVX Convert eight packed single-precision floating-point values 
VCVTPS2DQ ymm1, ymm2/m256 from ymm2/mem to eight packed signed doubleword 
values in ymm1. 
EVEX.128.66.0F.WO 5B /r B VIV AVX512VL | Convert four packed single precision floating-point values 
VCVTPS2DQ xmm1 {k1}{Z}, AVX512F from xmm2/m128/m32bcst to four packed signed 
xmme2/m128/m32bcst doubleword values in xmm1 subject to writemask k1. 
EVEX.256.66.0F.WO 5B /r B VIV AVX512VL | Convert eight packed single precision floating-point values 
VCVTPS2DQ ymm1 {k1}{2}, AVX512F from ymm2/m256/m32bcst to eight packed signed 
ymm2/m256/m32bcst doubleword values in ymm1 subject to writemask k1. 
EVEX.512.66.0F.WO 5B /r B VIV AVX512F Convert sixteen packed single-precision floating-point 
VCVTPS2DQ zmm1 {k1}{Z}, values from zmm2/m512/m32bcst to sixteen packed 
zmm2/m51 2/m32bcst{er} signed doubleword values in zmm1 subject to writemask 
k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts four, eight or sixteen packed single-precision floating-point values in the source operand to four, eight or 
sixteen signed doubleword integers in the destination operand. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the indefinite integer value 
(2-1, where w represents the number of bits in the destination format) is returned. 


EVEX encoded versions: The source operand is a ZMM register, a 512-bit memory location or a 512-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are 
zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
unmodified. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, A-L 


Operation 


VCVTPS2DQ (encoded versions) when src operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer(SRC[i+31 :i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2DQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j:=0TO15 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer(SRC[3 1:0) 
ELSE 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer(SRC[i+31 :i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, A-L 


VCVTPS2DQ (VEX.256 encoded version) 

DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0]) 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[95:64]) 
DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[1 27:96) 
DEST[159:1 28] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[159:128] 
DEST[191:160] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[191:160] 
DEST[223:192] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[223:192] 
DEST[255:224] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[255:224] 


a) 


VCVTPS2DQ (VEX.128 encoded version) 

DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0]) 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[95:64]) 
DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[127:96]) 
DEST[MAXVL-1:128] := 0 


CVTPS2DQ (128-bit Legacy SSE version) 

DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0]) 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[95:64]) 
DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[127:96]) 
DEST[MAXVL-1:128] (unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPS2DQ __m512i_mm512_cvtps_epi32(__m512 a); 

VCVTPS2DQ __m512i_mm512_mask_cvtps_epi32(__m512is,__mmask16 k, 
VCVTPS2DQ __m512i__mm512_maskz_cvtps_epi32(__mmask16 k,___m512 a); 

VCVTPS2DQ __m512i__mm512_cvt_roundps_epi32(__m512 a, int r); 

VCVTPS2DQ __m512i __mm512_mask_cvt_roundps_epi32(__m512i s,__ mmask16 k,__m512 a, int r); 
VCVTPS2DQ __m512i__mm512_maskz_cvt_roundps_epi32(__mmask16 k,__m512 a, int r); 
VCVTPS2DQ __m256i _mm256_mask_cvtps_epi32(__m256i s, __ mmask8 k, __m256 a); 
VCVTPS2DQ __m256i __mm256_maskz_cvtps_epi32(__mmask8 k, __m256 a); 

VCVTPS2DQ __m128i _mm_mask_cvtps_epi32(__m128i s,__mmask8 k, __m128 a); 

VCVTPS2DQ __m128i _mm_maskz_cvtps_epi32(__mmask8 k, __m128 a); 

VCVTPS2DQ __ m256i __mm256_cvtps_epi32 (__m256 a) 

CVTPS2DQ __m128i __mm_cvtps_epi32 (__m128 a) 


m512 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 

VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvwv != 11118. 
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INSTRUCTION SET REFERENCE, A-L 


CVTPS2PD—Convert Packed Single-Precision Floating-Point Values to Packed Double-Precision 
Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 5A /r A VIV SSE2 Convert two packed single-precision floating-point values in 
CVTPS2PD xmm1, xmm2/m64 xmm2/m64 to two packed double-precision floating-point 
values in xmm1. 
VEX.128.0F.WIG 5A /r A VIV AVX Convert two packed single-precision floating-point values in 
VCVTPS2PD xmm1, xmm2/m64 xmm2/m64 to two packed double-precision floating-point 
values in xmm1. 
VEX.256.0F.WIG 5A /r A VIV AVX Convert four packed single-precision floating-point values 
VCVTPS2PD ymm1, xmm2/m128 in xmm2/m128 to four packed double-precision floating- 
point values in ymm1. 
EVEX.128.0F.WO 5A /r B VV AVX512VL_ | Convert two packed single-precision floating-point values in 
VCVTPS2PD xmm1 {k1}{Z}, AVX512F xmm2/m64/m32bcst to packed double-precision floating- 
xmm2/m64/m32bcst point values in xmm1 with writemask k1. 
EVEX.256.0F.WO 5A /r B VIV AVX512VL_ | Convert four packed single-precision floating-point values 
VCVTPS2PD ymm1 {k1}{Z}, in xmm2/m128/m32bcst to packed double-precision 
xmme2/m1 28/m32bcst floating-point values in ymm1 with writemask k1. 
EVEX.512.0F.WO 5A /r B VIV AVX512F Convert eight packed single-precision floating-point values 
VCVTPS2PD zmm1 {k1}{z}, in ymm2/m256/b32bcst to eight packed double-precision 
ymm2/m256/m3 2bcst{sae} floating-point values in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two, four or eight packed single-precision floating-point values in the source operand (second operand) to 
two, four or eight packed double-precision floating-point values in the destination operand (first operand). 

EVEX encoded versions: The source operand is a YMM/XMM/XMM (low 64-bits) register, a 256/128/64-bit memory 
location or a 256/128/64-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register conditionally updated with writemask k1. 


VEX.256 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a YMM register. Bits (MAXVL-1:256) of the corresponding destination ZMM register are zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 64- bit memory location. The destination 
operand is a XMM register. The upper Bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 

128-bit Legacy SSE version: The source operand is an XMM register or 64- bit memory location. The destination 
operand is an XMM register. The upper Bits (MAXVL-1:128) of the corresponding ZMM register destination are 
unmodified. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, A-L 


SRC X3 X2 x1 XO 


DEST X3 X2 x1 XO 


Figure 3-14. CVTPS2PD (VEX.256 encoded version) 


Operation 


VCVTPS2PD (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 

i:=j* 64 

k:=j* 32 

IF k1[j] OR *no writemask* 

THEN DEST[i+63:i] := 
Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[k+31:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2PD (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[k+31:k]) 
Fl; 
ELSE 
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IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2PD (VEX.256 encoded version) 

DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[31:0]) 
DEST[1 27:64] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[191:128] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[95:64})) 
DEST[255:192] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[1 27:96) 
DEST[MAXVL-1:256] := 0 


VCVTPS2PD (VEX.128 encoded version) 

DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[3 1:0]) 
DEST[1 27:64] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[MAXVL-1:128] := 0 


CVTPS2PD (128-bit Legacy SSE version) 

DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[31:0]) 
DEST[127:64] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[63:32]) 
DEST[MAXVL-1:1 28] (unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPS2PD __m512d_mm512_cvtps_pd(__m256 a); 

VCVTPS2PD __m512d_mm512_mask_cvtps_pd(__m512ds,__ mmask8 k, 
VCVTPS2PD __m512d_mm512_maskz_cvtps_pd(__mmask8 k,___m256 a); 

VCVTPS2PD __m512d_mm512_cvt_roundps_pd(__m256 a, int sae); 

VCVTPS2PD __m512d_mm512_mask_cvt_roundps_pd(__m512ds,__mmask8 k,___m256 a, int sae); 
VCVTPS2PD __m512d_mm512_maskz_cvt_roundps_pd(__mmask8 k, __m256 a, int sae); 
VCVTPS2PD __m256d __mm256_mask_cvtps_pd(__m256d s,__ mmask8 k,___m128 a); 

VCVTPS2PD __m256d _mm256_maskz_cvtps_pd(__mmask8 k, __m128a); 

VCVTPS2PD __m128d_mm_mask_cvtps_pd(__m128ds,__ mmask8 k,___m128 a); 

VCVTPS2PD __m128d _mm_maskz_cvtps_pd(__mmask8 k, __m128 a); 

VCVTPS2PD __m256d_mm256_cvtps_pd (__m128 a) 

CVTPS2PD __m128d_mm_cvtps_pd (__m128 a) 


m256 a); 


SIMD Floating-Point Exceptions 
Invalid, Denormal 


Other Exceptions 

VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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CVTPS2PI—Convert Packed Single-Precision FP Values to Packed Dword Integers 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF 2D /r RM | Valid Valid Convert two packed single-precision floating- 

CVTPS2PI mm, xmm/m64 point values from xmm/m64 to two packed 
signed doubleword integers in mm. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two packed single-precision floating-point values in the source operand (second operand) to two packed 
signed doubleword integers in the destination operand (first operand). 


The source operand can be an XMM register or a 128-bit memory location. The destination operand is an MMX tech- 
nology register. When the source operand is an XMM register, the two single-precision floating-point values are 
contained in the low quadword of the register. When a conversion is inexact, the value returned is rounded 
according to the rounding control bits in the MXCSR register. If a converted result is larger than the maximum 
signed doubleword integer, the floating-point invalid exception is raised, and if this exception is masked, the indef- 
inite integer value (8O000000H) is returned. 


CVTPS2PI causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack pointer 
is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU floating- 
point exception is pending, the exception is handled before the CVTPS2PI instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 


DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0)); 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[63:32)); 


Intel C/C++ Compiler Intrinsic Equivalent 
CVTPS2PI: m64 _mm_cvtps_pi32(__m128 a) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 


See Table 21-5, “Exception Conditions for Legacy SIMD/MMX Instructions with XMM and FP Exception” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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CVTSD2SI—Convert Scalar Double-Precision Floating-Point Value to Doubleword Integer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F2 OF 2D /r A VV SSE2 Convert one double-precision floating-point value from 
CVTSD2SI r32, xmm1/m64 xmm1/m64 to one signed doubleword integer r32. 
F2 REX.W OF 2D /r A VIN.E. SSE2 Convert one double-precision floating-point value from 
CVTSD2SI r64, xmm1/m64 xmm1/m64 to one signed quadword integer sign- 
extended into r64. 
VEX.LIG.F2.0F.WO 2D /r A VV AVX Convert one double-precision floating-point value from 
VCVTSD2SI r32, xmm1/m64 xmm1/m64 to one signed doubleword integer r32. 
VEX.LIG.F2.0F.W1 2D /r A VIN.E.2 AVX Convert one double-precision floating-point value from 
VCVTSD2SI r64, xmm1/m64 xmm1/m64 to one signed quadword integer sign- 
extended into r64. 
EVEX.LLIG.F2.0F.WO 2D /r B VIV AVX512F Convert one double-precision floating-point value from 
VCVTSD2SI r32, xmm1/m64{er} xmm1/m64 to one signed doubleword integer r32. 
EVEX.LUIG.F2.0F.W1 2D /r B VINE.2 AVX512F Convert one double-precision floating-point value from 
VCVTSD2SI r64, xmm1/m64{er} xmm1/m64 to one signed quadword integer sign- 
extended into r64. 


NOTES: 


1. Software should ensure VCVTSD2SI is encoded with VEX.L=0. Encoding VCVTSD2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 


2. VEX.W1/EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a double-precision floating-point value in the source operand (the second operand) to a signed double- 
word integer in the destination operand (first operand). The source operand can be an XMM register or a 64-bit 
memory location. The destination operand is a general-purpose register. When the source operand is an XMM 
register, the double-precision floating-point value is contained in the low quadword of the register. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 


register. 


If a converted result exceeds the range limits of signed doubleword integer (in non-64-bit modes or 64-bit mode 
with REX.W/VEX.W/EVEX.W=0), the floating-point invalid exception is raised, and if this exception is masked, the 
indefinite integer value (80000000H) is returned. 


If a converted result exceeds the range limits of signed quadword integer (in 64-bit mode and 
REX.W/VEX.W/EVEX.W = 1), the floating-point invalid exception is raised, and if this exception is masked, the 
indefinite integer value (80000000_00000000H) is returned. 


Legacy SSE instruction: Use of the REX.W prefix promotes the instruction to produce 64-bit data in 64-bit mode. 
See the summary chart at the beginning of this section for encoding data and limits. 


Note: VEX.vvvv and EVEX.vvvwv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCVTSD2SI is encoded with VEX.L=0. Encoding VCVTSD2SI with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VCVTSD2SI (EVEX encoded version) 
IF SRC *is register* AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF 64-Bit Mode and OperandSize = 64 
THEN DEST[63:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0)); 
ELSE DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0)); 


Fl 


(V)CVTSD2SI 
IF 64-Bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0)); 
ELSE 
DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer(SRC[63:0)); 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSD2SI int __mm_cvtsd_i32(__m1 28d); 

VCVTSD2SI int __mm_cvt_roundsd_i32(__m1 28d, int r); 
VCVTSD2SI __int64 __mm_cvtsd_i64(__m128d); 
VCVTSD2SI __int64 _mm_cvt_roundsd_i64(__m128d, int r); 
CVTSD2SI __int64 __mm_cvtsd_si64(__m128d); 

CVTSD2SI int __mm_cvtsd_si32(__m128d a) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 


Additionally: 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, A-L 


Ui 


EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions” 
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CVTSD2SS—Convert Scalar Double-Precision Floating-Point Value to Scalar Single-Precision 
Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F2 OF SA/r A VIV SSE2 Convert one double-precision floating-point value in 
CVTSD2SS xmm1, xmm2/m64 xmm2/m64 to one single-precision floating-point value 
inxmm1. 
VEX.LIG.F2.0F.WIG 5A /r B VIV AVX Convert one double-precision floating-point value in 
VCVTSD2SS xmm1,xmme2, xmm3/m64 to one single-precision floating-point value 
xmm3/m64 and merge with high bits in xmme. 
EVEX.LLIG.F2.0F.W1 5A /r C VIV AVX512F Convert one double-precision floating-point value in 
VCVTSD2SS xmm1 {k1}{z}, xmm2, xmm3/m64 to one single-precision floating-point value 
xmm3/m64{er} and merge with high bits in xmm2 under writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 


Description 


Converts a double-precision floating-point value in the “convert-from” source operand (the second operand in SSE2 
version, otherwise the third operand) to a single-precision floating-point value in the destination operand. 


When the “convert-from” operand is an XMM register, the double-precision floating-point value is contained in the 
low quadword of the register. The result is stored in the low doubleword of the destination operand. When the 
conversion is inexact, the value returned is rounded according to the rounding control bits in the MXCSR register. 


128-bit Legacy SSE version: The “convert-from” source operand (the second operand) is an XMM register or 
memory location. Bits (MAXVL-1:32) of the corresponding destination register remain unchanged. The destination 
operand is an XMM register. 


VEX.128 and EVEX encoded versions: The “convert-from” source operand (the third operand) can be an XMM 
register or a 64-bit memory location. The first source and destination operands are XMM registers. Bits (127:32) of 
the XMM register destination are copied from the corresponding bits in the first source operand. Bits (MAXVL- 
1:128) of the destination register are zeroed. 


EVEX encoded version: the converted result in written to the low doubleword element of the destination under the 
writemask. 


Software should ensure VCVTSD2SS is encoded with VEX.L=0. Encoding VCVTSD2SS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VCVTSD2SS (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 

Fl; 

DEST[1 27:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


VCVTSD2SS (VEX.128 encoded version) 

DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC2[63:0)); 
DEST[1 27:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


CVTSD2SS (128-bit Legacy SSE version) 
DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC[63:0)); 
(* DEST[MAXVL-1:32] Unmodified *) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSD2SS __m128 _mm_mask_cvtsd_ss(__m128s,__mmask8 k,__m128 a,__m128d b); 
VCVTSD2SS __m128 _mm_maskz_cvtsd_ss(__ mmask8 k,___m128 a,__m128d b); 
VCVTSD2SS __m128 _mm_cvt_roundsd_ss(__m128 a,__m128d 5, int r); 

VCVTSD2SS __m128 __mm_mask_cvt_roundsd_ss( 
VCVTSD2SS __m128 __mm_maskz_cvt_roundsd_ss(__mmask8 k, 
CVTSD2SS __m128_mm_cvtsd_ss(__m128 a,___m128d b) 


m128 a, 


m1 28d b, int r); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, A-L 


DEST[31:0] := Convert_Double_Precision_To_Single_Precision_Floating_Point(SRC2[63:0)); 


mi28s,__mmask8 k,__m128 a,__m128db, int r); 
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CVTSI2SD—Convert Doubleword Integer to Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F2 OF 2A/r A VV SSE2 Convert one signed doubleword integer from 


CVTSI2SD xmm1, r32/m32 r32/m32 to one double-precision floating-point 


value in xmm1. 

Convert one signed quadword integer from r/m64 
to one double-precision floating-point value in 
xmm1. 

Convert one signed doubleword integer from 
r/m32 to one double-precision floating-point 
value in xmm1. 


F2 REX.W OF 2A /r A VIN.E. SSE2 
CVTSI2SD xmm1, r/m64 


VEX.LIG.F2.0F.WO 2A /r B VIV AVX 
VCVTSI2SD xmm1, xmm2z, r/m32 


VEX.LIG.F2.0F.W1 2A /r B VINE." AVX Convert one signed quadword integer from r/m64 

VCVTSI2SD xmm1, xmm2, r/m64 to one double-precision floating-point value in 
xmm1. 

EVEX.LLIG.F2.0F.WO 2A /r C VIV AVX512F Convert one signed doubleword integer from 

VCVTSI2SD xmm1, xmm2z, r/m32 r/m32 to one double-precision floating-point 
value in xmm1. 

EVEX.LLIG.F2.0F.W1 2A /r C V/N.E. AVX512F Convert one signed quadword integer from r/m64 

VCVTSI2SD xmm1, xmm2, r/m64{er} to one double-precision floating-point value in 
xmm1. 


NOTES: 
1. VEX.W1/EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts a signed doubleword integer (or signed quadword integer if operand size is 64 bits) in the “convert-from” 
source operand to a double-precision floating-point value in the destination operand. The result is stored in the low 
quadword of the destination operand, and the high quadword left unchanged. When conversion is inexact, the 
value returned is rounded according to the rounding control bits in the MXCSR register. 


The second source operand can be a general-purpose register or a 32/64-bit memory location. The first source and 
destination operands are XMM registers. 


128-bit Legacy SSE version: Use of the REX.W prefix promotes the instruction to 64-bit operands. The “convert- 
from” source operand (the second operand) is a general-purpose register or memory location. The destination is an 
XMM register Bits (MAXVL-1:64) of the corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded versions: The “convert-from” source operand (the third operand) can be a general- 
purpose register or a memory location. The first source and destination operands are XMM registers. Bits (127:64) 
of the XMM register destination are copied from the corresponding bits in the first source operand. Bits (MAXVL- 
1:128) of the destination register are zeroed. 


EVEX.W0O version: attempt to encode this instruction with EVEX embedded rounding is ignored. 
VEX.W1 and EVEX.W1 versions: promotes the instruction to use 64-bit input value in 64-bit mode. 


Software should ensure VCVTSI2SD is encoded with VEX.L=0. Encoding VCVTSI2SD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VCVTSI2SD (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC2[63:0)); 
ELSE 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC2[31:0]); 


Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VCVTSI2SD (VEX.128 encoded version) 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC2[63:0)); 
ELSE 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC2[31:0]); 


Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


CVTSI2SD 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[63:0)); 
ELSE 
DEST[63:0] := Convert_Integer_To_Double_Precision_Floating_Point(SRC[31:0)); 


Fl; 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
VCVTSI2SD __m128d_mm_cvti32_sd(__m128ds;, int a); 


VCVTSI2SD __m128d_mm_cvti64_sd(__m128d s, __int64 a); 
VCVTSI2SD __m128d __mm_cvt_roundi64_sd(__m128ds, __int64 a, intr); 
CVTSI2SD___m128d _mm_cvtsi64_sd(__m128ds,__int64 a); 


CVTSI2SD __m128d_mm_cvtsi32_sd(__m128d a, int b) 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 


VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions” if W1; else see Table 2-22, “Type 
5 Class Exception Conditions”. 


EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions” if W1; else see Table 2-59, 
“Type E10NF Class Exception Conditions”. 
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CVTSI2SS—Convert Doubleword Integer to Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 2A /r A VIV SSE Convert one signed doubleword integer from r/m32 
CVTSI2SS xmm1, r/m32 to one single-precision floating-point value in xmm1. 
F3 REX.W OF 2A /r A V/N.E. SSE Convert one signed quadword integer from r/m64 
CVTSI2SS xmm1, r/m64 to one single-precision floating-point value in xmm1. 
VEX.LIG.F3.0F.WO 2A /r B VIV AVX Convert one signed doubleword integer from r/m32 
VCVTSI2SS xmm1, xmm2, r/m32 to one single-precision floating-point value in xmm1. 
VEX.LIG.F3.0F.W1 2A /r B VINE. AVX Convert one signed quadword integer from r/m64 
VCVTSI2SS xmm1, xmm_2, r/m64 to one single-precision floating-point value in xmm1. 
EVEX.LLIG.F3.0F.WO 2A /r C VIV AVX512F | Convert one signed doubleword integer from r/m32 
VCVTSI2SS xmm1, xmm2, r/m32{er} to one single-precision floating-point value in xmm1. 
EVEX.LLIG.F3.0F.W1 2A /r C VINE. AVX512F | Convert one signed quadword integer from r/m64 
VCVTSI2SS xmm1, xmm_2, r/m64{er} to one single-precision floating-point value in xmm1. 
NOTES: 


1. VEX.W1/EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


” 


Converts a signed doubleword integer (or signed quadword integer if operand size is 64 bits) in the “convert-from 
source operand to a single-precision floating-point value in the destination operand (first operand). The “convert- 
from” source operand can be a general-purpose register or a memory location. The destination operand is an XMM 
register. The result is stored in the low doubleword of the destination operand, and the upper three doublewords 
are left unchanged. When a conversion is inexact, the value returned is rounded according to the rounding control 
bits in the MXCSR register or the embedded rounding control bits. 


128-bit Legacy SSE version: In 64-bit mode, Use of the REX.W prefix promotes the instruction to use 64-bit input 
value. The “convert-from” source operand (the second operand) is a general-purpose register or memory location. 
Bits (MAXVL-1:32) of the corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded versions: The “convert-from” source operand (the third operand) can be a general- 
purpose register or a memory location. The first source and destination operands are XMM registers. Bits (127:32) 
of the XMM register destination are copied from corresponding bits in the first source operand. Bits (MAXVL-1:128) 
of the destination register are zeroed. 


EVEX encoded version: the converted result in written to the low doubleword element of the destination under the 
writemask. 


Software should ensure VCVTSI2SS is encoded with VEX.L=0. Encoding VCVTSI2SS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VCVTSI2SS (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:0)); 
ELSE 
DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0)); 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VCVTSI2SS (VEX.128 encoded version) 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:0)); 
ELSE 
DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[31:0)); 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


CVTSI2SS (128-bit Legacy SSE version) 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[31:0] := Convert_Integer_To_Single_Precision_Floating_Point(SRC[63:0)); 
ELSE 
DEST[31:0] :=Convert_Integer_To_Single_Precision_Floating_Point(SRC[3 1:0); 


Fl; 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSI2SS___m128 _mm_cvti32_ss(__m128 s, int a); 

VCVTSI2SS ___m128 _mm_cvt_roundi32_ss(__m128s, int a, int r); 
VCVTSI2SS ___m128 _mm_cvti64_ss(__m128s, __int64 a); 
VCVTSI2SS ___m128 __mm_cvt_roundi64_ss(__m128s,__int64 a, intr); 
CVTSI2SS___m128_mm_cvtsi64_ss(__m128s, __int64 a); 
CVTSI2SS___m128_mm_cvtsi32_ss(__m128 a, int b); 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, A-L 


CVTSS2SD—Convert Scalar Single-Precision Floating-Point Value to Scalar Double-Precision 
Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F3 OF 5SA/r A VV SSE2 Convert one single-precision floating-point value in 
CVTSS2SD xmm1, xmm2/m32 xmm2/m32 to one double-precision floating-point value 

inxmm1. 

VEX.LIG.F3.0F.WIG 5A /r B VV AVX Convert one single-precision floating-point value in 
VCVTSS2SD xmm1, xmm_2, xmm3/m32 to one double-precision floating-point value 
xmm3/m32 and merge with high bits of xmm2. 
EVEX.LLIG.F3.0F.WO 5A /r C VIN AVX512F | Convert one single-precision floating-point value in 
VCVTSS2SD xmm1 {k1}{z}, xmm_2, xmm3/m32 to one double-precision floating-point value 
xmm3/m32{sae} and merge with high bits of xmm2 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts a single-precision floating-point value in the “convert-from” source operand to a double-precision 
floating-point value in the destination operand. When the “convert-from” source operand is an XMM register, the 
single-precision floating-point value is contained in the low doubleword of the register. The result is stored in the 
low quadword of the destination operand. 

128-bit Legacy SSE version: The “convert-from” source operand (the second operand) is an XMM register or 
memory location. Bits (MAXVL-1:64) of the corresponding destination register remain unchanged. The destination 
operand is an XMM register. 

VEX.128 and EVEX encoded versions: The “convert-from” source operand (the third operand) can be an XMM 
register or a 32-bit memory location. The first source and destination operands are XMM registers. Bits (127:64) of 
the XMM register destination are copied from the corresponding bits in the first source operand. Bits (MAXVL- 
1:128) of the destination register are zeroed. 


Software should ensure VCVTSS2SD is encoded with VEX.L=0. Encoding VCVTSS2SD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 


VCVTSS2SD (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC2[31:0]); 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] = 0 
Fl; 
Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 
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VCVTSS2SD (VEX.128 encoded version) 

DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC2[31:0]) 
DEST[1 27:64] := SRC1[127:64] 

DEST[MAXVL-1:128] := 0 


CVTSS2SD (128-bit Legacy SSE version) 
DEST[63:0] := Convert_Single_Precision_To_Double_Precision_Floating_Point(SRC[31:0)); 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 

VCVTSS2SD __m128d_mm_cvt_roundss_sd(__m128da,___m128 5, intr); 

VCVTSS2SD __m128d__mm_mask_cvt_roundss_sd(__m128d s,__ mmask8 m,___m128d a,__m128 }, int r); 
VCVTSS2SD __m128d __mm_maskz_cvt_roundss_sd(__mmask8 k,__m128da,__m128 a, int r); 
VCVTSS2SD __m128d_mm_mask_cvtss_sd(__m128ds,__ mmask8 m,___m128d a,__m128 b); 
VCVTSS2SD __m128d __mm_maskz_cvtss_sd(__mmask8 m, __m128d a,__m128 b); 

CVTSS2SD __m128d_mm_cvtss_sd(__m128d a,__m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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CVTSS2SI—Convert Scalar Single-Precision Floating-Point Value to Doubleword Integer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 2D /r A VIV SSE Convert one single-precision floating-point value from 
CVTSS2SI r32, xmm1/m32 xmm1/m32 to one signed doubleword integer in r32. 
F3 REX.W OF 2D /r A V/N.E. SSE Convert one single-precision floating-point value from 
CVTSS2SI r64, xmm1/m32 xmm1/m32 to one signed quadword integer in r64. 
VEX.LIG.F3.0F.WO 2D /r ! A VIV AVX Convert one single-precision floating-point value from 
VCVTSS2SI r32, xmm1/m32 xmm1/m32 to one signed doubleword integer in r32. 
VEX.LIG.F3.0F.W1 2D /r! A VIN.E2 AVX Convert one single-precision floating-point value from 
VCVTSS2SI r64, xmm1/m32 xmm1/m32 to one signed quadword integer in r64. 
EVEX.LLIG.F3.0F.WO 2D /r B VIV AVX512F | Convert one single-precision floating-point value from 
VCVTSS2SI r32, xmm1/m32{er} xmm1/m32 to one signed doubleword integer in r32. 
EVEX.LLIG.F3.0F.W1 2D /r B VIN.E2 AVX512F | Convert one single-precision floating-point value from 
VCVTSS2SI r64, xmm1/m32{er} xmm1/m32 to one signed quadword integer in r64. 
NOTES: 


1. Software should ensure VCVTSS2SI is encoded with VEX.L=0. Encoding VCVTSS2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 


2. VEX.W1/EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a single-precision floating-point value in the source operand (the second operand) to a signed doubleword 
integer (or signed quadword integer if operand size is 64 bits) in the destination operand (the first operand). The 
source operand can be an XMM register or a memory location. The destination operand is a general-purpose 
register. When the source operand is an XMM register, the single-precision floating-point value is contained in the 
low doubleword of the register. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the indefinite integer value 
(2-1, where w represents the number of bits in the destination format) is returned. 


Legacy SSE instructions: In 64-bit mode, Use of the REX.W prefix promotes the instruction to produce 64-bit data. 
See the summary chart at the beginning of this section for encoding data and limits. 


VEX.W1 and EVEX.W1 versions: promotes the instruction to produce 64-bit data in 64-bit mode. 
Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCVTSS2SI is encoded with VEX.L=0. Encoding VCVTSS2SI with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VCVTSS2SI (EVEX encoded version) 
IF (SRC *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF 64-bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0)); 
ELSE 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0)); 


Fl; 


(V)CVTSS2SI (Legacy and VEX.128 encoded version) 
IF 64-bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0)); 
ELSE 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer(SRC[31:0)); 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSS2SI int__mm_cvtss_i32(__m128 a); 

VCVTSS2SI int __mm_cvt_roundss_i32(__m128 a, int r); 
VCVTSS2SI__int64_mm_cvtss_i64(__m128 a); 
VCVTSS2SI!___int64 __mm_cvt_roundss_i64(__m128 a, int r); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 


VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv != 1111B. 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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CVTTPD2DQ—Convert with Truncation Packed Double-Precision Floating-Point Values to 
Packed Doubleword Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support Flag 
66 OF E6 /r A VIV SSE2 Convert two packed double-precision floating-point 
CVTTPD2DQ xmm1, xmm2/m128 values in xmm2/mem to two signed doubleword 
integers in xmm1 using truncation. 
VEX.128.66.0F.WIG E6 /r A VV AVX Convert two packed double-precision floating-point 
VCVTTPD2DQ xmm1, xmm2/m128 values in xmm2/mem to two signed doubleword 
integers in xmm1 using truncation. 
VEX.256.66.0F.WIG E6 /r A VV AVX Convert four packed double-precision floating-point 
VCVTTPD2DQ xmm1, ymm2/m256 values in ymm2/mem to four signed doubleword 
integers in xmm1 using truncation. 
EVEX.128.66.0F.W1 €6 /r B VV AVX512VL_ | Convert two packed double-precision floating-point 
VCVTTPD2DQ xmm1 {k1}{Z}, AVX512F values in xmm2/m128/m64bcst to two signed 
xmm2/m1 28/m64bcst doubleword integers in xmm1 using truncation subject 
to writemask k1. 
EVEX.256.66.0F.W1 E6 /r B VV AVX512VL | Convert four packed double-precision floating-point 
VCVTTPD2DQ xmm1 {k1}{Z}, AVX512F values in ymm2/m256/m64bcst to four signed 
ymm2/m256/m64bcst doubleword integers in xmm1 using truncation subject 
to writemask k1. 
EVEX.512.66.0F.W1 €6 /r B VIV AVX512F Convert eight packed double-precision floating-point 
VCVTTPD2DQ ymm1 {k1}{z}, values in zmm2/m512/m64bcst to eight signed 
zmm2/m512/m64bcst{sae} doubleword integers in ymm1 using truncation subject 
to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two, four or eight packed double-precision floating-point values in the source operand (second operand) 
to two, four or eight packed signed doubleword integers in the destination operand (first operand). 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result is larger than 
the maximum signed doubleword integer, the floating-point invalid exception is raised, and if this exception is 
masked, the indefinite integer value (8OO00000H) is returned. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or 
a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is a 
YMM/XMM/XMM (low 64 bits) register conditionally updated with writemask k1. The upper bits (MAXVL-1:256) of 
the corresponding destination are zeroed. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 

VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:64) of the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
unmodified. 


Note: VEX.vvvv and EVEX.vvvwv are reserved and must be 1111b, otherwise instructions will #UD. 
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SRC X3 X2 x1 XO 


DEST 0 X3 X2 x1 XO 


Figure 3-15. VCVTTPD2DQ (VEX.256 encoded version) 


Operation 


VCVTTPD2DQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[k+63:k]) 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 
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VCVTTPD2DQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTTPD2DQ (VEX.256 encoded version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[127:64}) 
DEST[95:64] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[191:128]) 
DEST[1 27:96] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[255:192) 
DEST[MAXVL-1:128] := 0 


VCVTTPD2DQ (VEX.128 encoded version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[127:64}) 
DEST[MAXVL-1:64] := 0 


CVTTPD2DQ (128-bit Legacy SSE version) 

DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0]) 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[127:64}) 
DEST[127:64] := 0 

DEST[MAXVL-1:1 28] (unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPD2DQ __m256i __mm512_cvttpd_epi32(__m512d a); 

VCVTTPD2DQ __m256i __mm512_mask_cvttpd_epi32(__m256i s, __mmask8 k, __m512d a); 
VCVTTPD2DQ __m256i __mm512_maskz_cvttpd_epi32(__mmask8 k, __m512d a); 
VCVTTPD2DQ __m256i __mm512_cvtt_roundpd_epi32(__m512d a, int sae); 


VCVTTPD2DQ __m256i__mm512_mask_cvtt_roundpd_epi32(__m256i s,___mmask8 k, __m512d 4, int sae); 


VCVTTPD2DQ __m256i __mm512_maskz_cvtt_roundpd_epi32(__mmask8 k, __m512d a, int sae); 
VCVTTPD2DQ __m128i __mm256_mask_cvttpd_epi32(__m128i s, __mmask8 k, __m256d a); 
VCVTTPD2DQ __m128i__mm256_maskz_cvttpd_epi32(__mmask8 k, __m256d a); 
VCVTTPD2DQ __m128i_mm_mask_cvttpd_epi32(__m128is,__ mmask8 k,___m128d a); 
VCVTTPD2DQ __m128i __mm_maskz_cvttpd_epi32(__mmask8 k, __m128d a); 

VCVTTPD2DQ __m128i __mm256_cvttpd_epi32 (__m256d src); 

CVTTPD2DQ __m128i __mm_cvttpd_epi32 (__m128d src); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 

VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
Additionally: 


#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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CVTTPD2PI—Convert with Truncation Packed Double-Precision FP Values to Packed Dword 


Integers 
Opcode/ Op/ | 64-Bit Compat/ |Description 
Instruction En |Mode Leg Mode 
66 OF 2C /r RM_ | Valid Valid Convert two packer double-precision floating- 
CVTTPD2PI mm, xmm/m128 point values from xmm/m128 to two packed 
signed doubleword integers in mm using 
truncation. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two packed double-precision floating-point values in the source operand (second operand) to two packed 
signed doubleword integers in the destination operand (first operand). The source operand can be an XMM register 
or a 128-bit memory location. The destination operand is an MMX technology register. 


When a conversion is inexact, a truncated (round toward zero) result is returned. If a converted result is larger than 
the maximum signed doubleword integer, the floating-point invalid exception is raised, and if this exception is 
masked, the indefinite integer value (80000000H) is returned. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the CVTTPD2PI instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 


DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer32_Truncate(SRC[63:0)); 
DEST[63:32] := Convert_Double_Precision_Floating_Point_To_Integer32_ 
Truncate(SRC[127:64)); 


Intel C/C++ Compiler Intrinsic Equivalent 
CVTTPD1PI: m64 _mm_cvttpd_pi32(__m128d a) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Mode Exceptions 


See Table 21-4, “Exception Conditions for Legacy SIMD/MMX Instructions with FP Exception and 16-Byte Align- 
ment” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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CVTTPS2DQ—Convert with Truncation Packed Single-Precision Floating-Point Values to Packed 
Signed Doubleword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF 5B /r A VIV SSE2 Convert four packed single-precision floating-point 
CVTTPS2DQ xmm1, xmm2/m128 values from xmm2/mem to four packed signed 
doubleword values in xmm1 using truncation. 
VEX.128.F3.0F.WIG 5B /r A VIV AVX Convert four packed single-precision floating-point 
VCVTTPS2DQ xmm1, xmm2/m128 values from xmm2/mem to four packed signed 
doubleword values in xmm1 using truncation. 
VEX.256.F3.0F.WIG 5B /r A VIV AVX Convert eight packed single-precision floating-point 
VCVTTPS2DQ ymm1, ymm2/m256 values from ymm2/mem to eight packed signed 
doubleword values in ymm1 using truncation. 
EVEX.128.F3.0F.WO 5B /r B VIV AVX512VL_ | Convert four packed single precision floating-point 
VCVTTPS2DQ xmm1 {k1}{2}, AVX512F values from xmm2/m128/m32bcst to four packed 
xmm2/m128/m32bcst signed doubleword values in xmm1 using truncation 
subject to writemask k1. 
EVEX.256.F3.0F.WO 5B /r B VIV AVX512VL_ | Convert eight packed single precision floating-point 
VCVTTPS2DQ ymm1 {k1}{z}, AVX512F values from ymm2/m256/m32bcst to eight packed 
ymm2/m256/m32bcst signed doubleword values in ymm1 using truncation 
subject to writemask k1. 
EVEX.512.F3.0F.WO0 5B /r B VIV AVX512F Convert sixteen packed single-precision floating-point 
VCVTTPS2DQ zmm1 {k1}{z}, values from zmm2/m512/m32bcst to sixteen packed 
zmm2/m512/m32bcst {sae} signed doubleword values in zmm1 using truncation 
subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts four, eight or sixteen packed single-precision floating-point values in the source operand to four, eight or 
sixteen signed doubleword integers in the destination operand. 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result is larger than 
the maximum signed doubleword integer, the floating-point invalid exception is raised, and if this exception is 
masked, the indefinite integer value (8O000000H) is returned. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location or 
a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register conditionally updated with writemask k1. 


VEX.256 encoded version: The source operand is a YMM register or 256- bit memory location. The destination 
operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are 
zeroed. 


VEX.128 encoded version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is a XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


128-bit Legacy SSE version: The source operand is an XMM register or 128- bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
unmodified. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VCVTTPS2DQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[i+31:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTTPS2DQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j:=0T0O15 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTTPS2DQ (VEX.256 encoded version) 

DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]) 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[95:64}) 
DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[1 27:96) 
DEST[159:1 28] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[159:1 28] 
DEST[191:160] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[191:160] 
DEST[223:192] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[223:192] 
DEST[255:224] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[255:224] 


a) 
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VCVTTPS2DQ (VEX.128 encoded version) 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]) 

DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[95:64}) 


DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[127:96]) 
DEST[MAXVL-1:128] := 0 


CVTTPS2DQ (128-bit Legacy SSE version) 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]) 

DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[63:32]) 
DEST[95:64] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[95:64}]) 


DEST[1 27:96] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[127:96]) 
DEST[MAXVL-1:128] (unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPS2DQ 


m512i 


mm512 


cvttps_epi32( 


VCVTTPS2DQ 


m512i 


mm512 


mask_cvttps_epi32( 


m512 a); 


VCVTTPS2DQ 


m512i 


mm512 


maskz_cvttps_epi32( 


VCVTTPS2DQ 


m512i 


mm512 


cvtt_roundps_epi32( 


VCVTTPS2DQ 


m512i 


mm512 


mask_cvtt_roundps_epi32( 


VCVTTPS2DQ 


m512i 


mm512 


maskz_cvtt_roundps_epi32( 


m512is, 
mmask16 k,__m512 a); 
m512 a, int sae); 
m512is,__mmask16 k,__m512 a, int sae); 
mmask16 k,__m512 a, int sae); 


mmask16 k, 


VCVTTPS2DQ 


m256i 


mm256 


mask_cvttps_epi32( 


VCVTTPS2DQ 


m256i 


mm256 


maskz_cvttps_epi32( 


VCVTTPS2DQ 


m128i 


mm_mask_cvttps_epi32( 


VCVTTPS2DQ 


m128i 


mm_maskz_cvttps_epi32( 


mmask8 k, 


VCVTTPS2DQ 


m256i 


mm256_cvttps_epi32 (__m256 a) 


CVTTPS2DQ __m128i_mm_cvttps_epi32 ( 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


Additionally: 
#UD 
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m128 a) 


m256 a); 


m128 a); 


If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 


m512 a); 


m256is,__ mmask8 k,___m256 a); 
mmask8 k, 
m128is,__mmask8 k,__m128 a); 
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CVTTPS2PI—Convert with Truncation Packed Single-Precision FP Values to Packed Dword 


Integers 
Opcode/ Op/ | 64-Bit Compat/ |Description 
Instruction En |Mode Leg Mode 
NP OF 2C /r RM _ | Valid Valid Convert two single-precision floating-point 
CVTTPS2PI mm, xmm/m64 values from xmm/m64 to two signed 
doubleword signed integers in mm using 
truncation. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts two packed single-precision floating-point values in the source operand (second operand) to two packed 
signed doubleword integers in the destination operand (first operand). The source operand can be an XMM register 
or a 64-bit memory location. The destination operand is an MMX technology register. When the source operand is 
an XMM register, the two single-precision floating-point values are contained in the low quadword of the register. 


When a conversion is inexact, a truncated (round toward zero) result is returned. If a converted result is larger than 
the maximum signed doubleword integer, the floating-point invalid exception is raised, and if this exception is 
masked, the indefinite integer value (80000000H) is returned. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the CVTTPS2PI instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
Operation 


DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]); 
DEST[63:32] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[63:32]); 


Intel C/C++ Compiler Intrinsic Equivalent 
CVTTPS2PI: m64_mm_cvttps_pi32(__m128 a) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 


See Table 21-5, “Exception Conditions for Legacy SIMD/MMX Instructions with XMM and FP Exception” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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CVTTSD2SI—Convert with Truncation Scalar Double-Precision Floating-Point Value to Signed 


Integer 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

F2 OF 2C /r A VIN SSE2 Convert one double-precision floating-point value from 

CVTTSD2SI r32, xmm1/m64 xmm1/m64 to one signed doubleword integer in r32 
using truncation. 

F2 REX.W OF 2C /r A V/N.E. SSE2 Convert one double-precision floating-point value from 

CVTTSD2SI r64, xmm1/m64 xmm1/m64 to one signed quadword integer in r64 
using truncation. 

VEX.LIG.F2.0F.WO 2C /r A VIV AVX Convert one double-precision floating-point value from 

VCVTTSD2SI r32, xmm1/m64 xmm1/m64 to one signed doubleword integer in r32 
using truncation. 

VEX.LIGF2.0F.W1 2C /r B VIN.E2 AVX Convert one double-precision floating-point value from 

VCVTTSD2SI r64, xmm1/m64 xmm1/m64 to one signed quadword integer in r64 
using truncation. 

EVEX.LLIG.F2.0F.WO 2C /r B VIV AVX512F | Convert one double-precision floating-point value from 

VCVTTSD2SI r32, xmm1/m64{sae} xmm1/m64 to one signed doubleword integer in r32 
using truncation. 

EVEX.LLIG.F2.0F.W1 2C /r B VIN.E2 AVX512F | Convert one double-precision floating-point value from 

VCVTTSD2SI r64, xmm1/m64{sae} xmm1/m64 to one signed quadword integer in r64 
using truncation. 


NOTES: 


1. Software should ensure VCVTTSD2SI is encoded with VEX.L=0. Encoding VCVTTSD2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 
2. For this specific instruction, VEX.W/EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO ver- 


sion is used. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 


Description 


Converts a double-precision floating-point value in the source operand (the second operand) to a signed double- 
word integer (or signed quadword integer if operand size is 64 bits) in the destination operand (the first operand). 
The source operand can be an XMM register or a 64-bit memory location. The destination operand is a general 
purpose register. When the source operand is an XMM register, the double-precision floating-point value is 
contained in the low quadword of the register. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register. 

If a converted result exceeds the range limits of signed doubleword integer (in non-64-bit modes or 64-bit mode 
with REX.W/VEX.W/EVEX.W=0), the floating-point invalid exception is raised, and if this exception is masked, the 
indefinite integer value (8OOO0000H) is returned. 

If a converted result exceeds the range limits of signed quadword integer (in 64-bit mode and 
REX.W/VEX.W/EVEX.W = 1), the floating-point invalid exception is raised, and if this exception is masked, the 
indefinite integer value (80000000_00000000H) is returned. 


Legacy SSE instructions: In 64-bit mode, Use of the REX.W prefix promotes the instruction to 64-bit operation. See 
the summary chart at the beginning of this section for encoding data and limits. 


VEX.W1 and EVEX.W1 versions: promotes the instruction to produce 64-bit data in 64-bit mode. 
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Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCVTTSD2SI is encoded with VEX.L=0. Encoding VCVTTSD2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 


Operation 


(V)CVTTSD2SI (All versions) 
IF 64-Bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0)); 
ELSE 
DEST[31:0] := Convert_Double_Precision_Floating_Point_To_Integer_Truncate(SRC[63:0)); 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTSD2SI int__mm_cvttsd_i32(__m128d a); 

VCVTTSD2SI int __mm_cvtt_roundsd_i32(__m128d a, int sae); 
VCVTTSD2SI __int64 __mm_cvttsd_i64(__m128d a); 

VCVTTSD2SI __int64__mm_cvtt_roundsd_i64(__m128d a, int sae); 
CVTTSD2SI int__mm_cvttsd_si32(__m128d a); 
CVTTSD2S!__int64_mm_cvttsd_si64(__m128d a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 

VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv != 1111B. 

EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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CVTTSS2SI—Convert with Truncation Scalar Single-Precision Floating-Point Value to Integer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

F3 OF 2C /r A VV SSE Convert one single-precision floating-point value from 

CVTTSS2SI r32, xmm1/m32 xmm1/m32 to one signed doubleword integer in r32 
using truncation. 

F3 REX.W OF 2C /r A V/N.E. SSE Convert one single-precision floating-point value from 

CVTTSS2SI r64, xmm1/m32 xmm1/m32 to one signed quadword integer in r64 
using truncation. 

VEX.LIG.F3.0F.WO 2C /r A VIV AVX Convert one single-precision floating-point value from 

VCVTTSS2SI r32, xmm1/m32 xmm1/m32 to one signed doubleword integer in r32 
using truncation. 

VEX.LIG.F3.0F.W1 2C /r A VIN.E2 AVX Convert one single-precision floating-point value from 

VCVTTSS2SI r64, xmm1/m32 xmm1/m32 to one signed quadword integer in r64 
using truncation. 

EVEX.LLIG.F3.0F.WO 2C /r B VV AVX512F | Convert one single-precision floating-point value from 

VCVTTSS2SI r32, xmm1/m32{sae} xmm1/m32 to one signed doubleword integer in r32 
using truncation. 

EVEX.LLIG.F3.0F.W1 2C /r B VIN.E.2 AVX512F | Convert one single-precision floating-point value from 

VCVTTSS2SI r64, xmm1/m32{sae} xmm1/m32 to one signed quadword integer in r64 
using truncation. 


NOTES: 


1. Software should ensure VCVTTSS2SI is encoded with VEX.L=0. Encoding VCVTTSS2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 


2. For this specific instruction, VEX.W/EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO ver- 
sion is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a single-precision floating-point value in the source operand (the second operand) to a signed double- 
word integer (or signed quadword integer if operand size is 64 bits) in the destination operand (the first operand). 
The source operand can be an XMM register or a 32-bit memory location. The destination operand is a general 
purpose register. When the source operand is an XMM register, the single-precision floating-point value is 
contained in the low doubleword of the register. 


When a conversion is inexact, a truncated (round toward zero) result is returned. If a converted result is larger 
than the maximum signed doubleword integer, the floating-point invalid exception is raised. If this exception is 
masked, the indefinite integer value (8OO00000H or 80000000_OQO0O00000H if operand size is 64 bits) is returned. 


Legacy SSE instructions: In 64-bit mode, Use of the REX.W prefix promotes the instruction to 64-bit operation. See 
the summary chart at the beginning of this section for encoding data and limits. 


VEX.W1 and EVEX.W1 versions: promotes the instruction to produce 64-bit data in 64-bit mode. 
Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCVTTSS2SI is encoded with VEX.L=0. Encoding VCVTTSS2SI with VEX.L=1 may 
encounter unpredictable behavior across different processor generations. 
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Operation 
(V)CVTTSS2SI (All versions) 
IF 64-Bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0}); 
ELSE 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Integer_Truncate(SRC[31:0]); 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTSS2SI int _mm_cvttss_i32(__m128 a); 

VCVTTSS2SI int __mm_cvtt_roundss_i32(__m128 a, int sae); 
VCVTTSS2SI___int64_mm_cvttss_i64(__m128 a); 
VCVTTSS2SI___int64__mm_cvtt_roundss_i64(__m128 a, int sae); 
CVTTSS2SI int __mm_cvttss_si32(__m128 a); 
CVTTSS2SI__int64 _mm_cvttss_si64(__m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 

See Table 2-20, “Type 3 Class Exception Conditions”; additionally: 

#UD If VEX.vvvv != 1111B. 

EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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CWD/CDQ/CQO—Convert Word to Doubleword/Convert Doubleword to Quadword 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
99 CwD ZO ‘| Valid Valid DX:AX := sign-extend of AX. 
99 CDQ ZO ‘| Valid Valid EDX:EAX := sign-extend of EAX. 
REX.W + 99 CQO ZO ‘| Valid N.E. RDX:RAX:= sign-extend of RAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Doubles the size of the operand in register AX, EAX, or RAX (depending on the operand size) by means of sign 
extension and stores the result in registers DX:AX, EDX:EAX, or RDX:RAX, respectively. The CWD instruction 
copies the sign (bit 15) of the value in the AX register into every bit position in the DX register. The CDQ instruction 
copies the sign (bit 31) of the value in the EAX register into every bit position in the EDX register. The CQO instruc- 
tion (available in 64-bit mode only) copies the sign (bit 63) of the value in the RAX register into every bit position 
in the RDX register. 


The CWD instruction can be used to produce a doubleword dividend from a word before word division. The CDQ 
instruction can be used to produce a quadword dividend from a doubleword before doubleword division. The CQO 
instruction can be used to produce a double quadword dividend from a quadword before a quadword division. 


The CWD and CDQ mnemonics reference the same opcode. The CWD instruction is intended for use when the 
operand-size attribute is 16 and the CDQ instruction for when the operand-size attribute is 32. Some assemblers 
may force the operand size to 16 when CWD is used and to 32 when CDQ is used. Others may treat these 
mnemonics as synonyms (CWD/CDQ) and use the current setting of the operand-size attribute to determine the 
size of values to be converted, regardless of the mnemonic used. 


In 64-bit mode, use of the REX.W prefix promotes operation to 64 bits. The CQO mnemonics reference the same 
opcode as CWD/CDQ. See the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF OperandSize = 16 (* CWD instruction *) 
THEN 
DX := SignExtend(AX); 
ELSE IF OperandSize = 32 (* CDQ instruction *) 
EDX := SignExtend(EAX); Fl; 
ELSE IF 64-Bit Mode and OperandSize = 64 (* CQO instruction*) 
RDX := SignExtend(RAX); Fl; 
FI; 


Flags Affected 
None 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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DAA—Decimal Adjust AL after Addition 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
27 DAA ZO _ ‘| Invalid Valid Decimal adjust AL after addition. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts the sum of two packed BCD values to create a packed BCD result. The AL register is the implied source and 
destination operand. The DAA instruction is only useful when it follows an ADD instruction that adds (binary addi- 
tion) two 2-digit, packed BCD values and stores a byte result in the AL register. The DAA instruction then adjusts 

the contents of the AL register to contain the correct 2-digit, packed BCD result. If a decimal carry is detected, the 
CF and AF flags are set accordingly. 


This instruction executes as described above in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 


IF 64-Bit Mode 
THEN 


#UD; 


ELSE 


old_AL := AL; 
old_CF := CF; 
CF := 0; 
IF (((AL AND OFH) > 9) or AF = 1) 
THEN 
AL:=AL+6; 


CF := old_CF or (Carry from AL: 


AF := 1; 
ELSE 


Fi; 
IF ((old_AL > 99H) or (old_CF = 1)) 
THEN 


= AL + 6); 


AL:= AL + 60H; 
CF := 1; 
ELSE 
CF := 0; 
Fl; 
Fl; 
Example 
ADD AL,BL_ Before: AL=79H BL=35H EFLAGS(OSZAPC)=XXXXXX 
After: AL=AEH BL=35H EFLAGS(OSZAPC)=1 10000 
DAA Before: AL=AEH BL=35H EFLAGS(OSZAPC)=1 10000 
After: AL=14H BL=35H EFLAGS(OSZAPC)=X00111 
DAA Before: AL=2EH BL=35H EFLAGS(OSZAPC)=1 10000 


After: AL=34H BL=35H EFLAGS(OSZAPC)=X00101 
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The CF and AF flags are set if the adjustment of the value results in a decimal carry in either digit of the result (see 
the “Operation” section above). The SF, ZF, and PF flags are set according to the result. The OF flag is undefined. 


Protected Mode Exceptions 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 


#UD If the LOCK prefix is used. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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DAS—Decimal Adjust AL after Subtraction 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En | Mode Leg Mode 
2F DAS ZO ‘| Invalid Valid Decimal adjust AL after subtraction. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Adjusts the result of the subtraction of two packed BCD values to create a packed BCD result. The AL register is the 
implied source and destination operand. The DAS instruction is only useful when it follows a SUB instruction that 
subtracts (binary subtraction) one 2-digit, packed BCD value from another and stores a byte result in the AL 
register. The DAS instruction then adjusts the contents of the AL register to contain the correct 2-digit, packed BCD 
result. If a decimal borrow is detected, the CF and AF flags are set accordingly. 


This instruction executes as described above in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 


IF 64-Bit Mode 
THEN 
#UD; 
ELSE 
old_AL := AL; 
old_CF := CF; 
CF := 0; 
IF (((AL AND OFH) > 9) or AF = 1) 
THEN 
AL := AL - 6; 
CF := old_CF or (Borrow from AL := AL — 6); 
AF := 1; 
ELSE 


Fl; 
IF ((old_AL > 99H) or (old_CF = 1)) 
THEN 
AL := AL— 60H; 
CF := 1; 
Fl; 
Fl; 


Example 


SUB AL,BL Before: AL = 35H, BL = 47H, EFLAGS(OSZAPC) = XXXXXX 
After: AL = EEH, BL = 47H, EFLAGS(OSZAPC) = 010111 

DAA Before: AL = EEH, BL = 47H, EFLAGS(OSZAPC) = 010111 
After: AL = 88H, BL = 47H, EFLAGS(OSZAPC) = X10111 


Flags Affected 


The CF and AF flags are set if the adjustment of the value results in a decimal borrow in either digit of the result 
(see the “Operation” section above). The SF, ZF, and PF flags are set according to the result. The OF flag is unde- 
fined. 
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Protected Mode Exceptions 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 


#UD If the LOCK prefix is used. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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DEC—Decrement by 1 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
FE /1 DEC r/m8 M Valid Valid Decrement r/m8 by 1. 
REX + FE /1 DEC r/m8 M Valid N.E. Decrement r/m8 by 1. 
FF /1 DEC r/m16 M Valid Valid Decrement r/m16 by 1. 
FF /1 DEC r/m32 M Valid Valid Decrement r/m32 by 1. 
REX.W + FF /1 DEC r/m64 M Valid N.E. Decrement r/m64 by 1. 
48+rw DEC r16 6) N.E. Valid Decrement r76 by 1. 
48+rd DEC r32 0 N.E. Valid Decrement r32 by 1. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
0) opcode + rd (r, w) NA NA NA 
Description 


Subtracts 1 from the destination operand, while preserving the state of the CF flag. The destination operand can be 
a register or a memory location. This instruction allows a loop counter to be updated without disturbing the CF flag. 
(To perform a decrement operation that updates the CF flag, use a SUB instruction with an immediate operand of 
1.) 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, DEC r16 and DEC r32 are not encodable (because opcodes 48H through 4FH are REX prefixes). 
Otherwise, the instruction’s 64-bit mode default operation size is 32 bits. Use of the REX.R prefix permits access to 
additional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. 


See the summary chart at the beginning of this section for encoding data and limits. 


Operation 


DEST := DEST - 1; 


Flags Affected 
The CF flag is not affected. The OF, SF, ZF, AF, and PF flags are set according to the result. 


Protected Mode Exceptions 


#GP(0) If the destination operand is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 

3-314 Vol. 2A DEC—Decrement by 1 


INSTRUCTION SET REFERENCE, A-L 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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DiV—Unsigned Divide 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

F6 /6 DIV r/m8 M Valid Valid Unsigned divide AX by r/m8, with result 
stored in AL := Quotient, AH := Remainder. 

REX + F6 /6 DIV r/mS" M Valid N.E. Unsigned divide AX by r/m8, with result 
stored in AL := Quotient, AH := Remainder. 

F7 /6 DIV r/m16 M Valid Valid Unsigned divide DX:AX by r/m76, with result 
stored in AX := Quotient, DX := Remainder. 

F7 /6 DIV r/m32 M Valid Valid Unsigned divide EDX:EAX by r/m32, with 
result stored in EAX := Quotient, EDX := 
Remainder. 

REX.W + F7 /6 DIV r/m64 M Valid N.E. Unsigned divide RDX:RAX by r/m64, with 
result stored in RAX := Quotient, RDX := 
Remainder. 

NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Divides unsigned the value in the AX, DX:AX, EDX:EAX, or RDX:RAX registers (dividend) by the source operand 
(divisor) and stores the result in the AX (AH:AL), DX:AX, EDX:EAX, or RDX:RAX registers. The source operand can 
be a general-purpose register or a memory location. The action of this instruction depends on the operand size 
(dividend/divisor). Division using 64-bit operand is available only in 64-bit mode. 


Non-integral results are truncated (chopped) towards 0. The remainder is always less than the divisor in magni- 


tude. Overflow is indicated with the #DE (divide error) exception rather than with the CF flag. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. In 64-bit mode when REX.W is 
applied, the instruction divides the unsigned value in RDX:RAX by the source operand and stores the quotient in 
RAX, the remainder in RDX. 


See the summary chart at the beginning of this section for encoding data and limits. See Table 3-15. 
Table 3-15. DIV Action 


Maximum 

Operand Size Dividend Divisor Quotient Remainder Quotient 
Word/byte AX r/m8 AL AH 255 
Doubleword/word DX:AX r/m16 AX DX 65,535 
Quadword/doubleword EDX:EAX r/m32 EAX EDX 234] 
Doublequadword/ RDX:RAX r/m64 RAX RDX 254 _ | 
quadword 
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Operation 


IF SRC =0 
THEN #DE; FI; (* Divide Error *) 
IF OperandSize = 8 (* Word/Byte Operation *) 


THEN 
temp := AX / SRC; 
IF temp > FFH 
THEN #DE; (* Divide error *) 
ELSE 
AL := temp; 
AH := AX MOD SRC; 
Fl; 
ELSE IF OperandSize = 16 (* Doubleword/word operation *) 
THEN 
temp := DX:AX / SRC; 
IF temp > FFFFH 
THEN #DE; (* Divide error *) 
ELSE 
AX := temp; 
DX := DX:AX MOD SRC; 
Fl; 
Fl; 
ELSE IF Operandsize = 32 (* Quadword/doubleword operation *) 
THEN 
temp := EDX:EAX / SRC; 
IF temp > FFFFFFFFH 
THEN #DE; (* Divide error *) 
ELSE 
EAX := temp; 
EDX := EDX:EAX MOD SRC; 
Fl; 
Fl; 
ELSE IF 64-Bit Mode and Operandsize = 64 (* Doublequadword/quadword operation *) 
THEN 
temp := RDX:RAX / SRC; 
IF temp > FFFFFFFFFFFFFFFFH 
THEN #DE; (* Divide error *) 
ELSE 
RAX := temp; 
RDX := RDX:RAX MOD SRC; 
Fl; 
Fl; 
Fl; 
Flags Affected 


The CF, OF, SF, ZF, AF, and PF flags are undefined. 
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Protected Mode Exceptions 


#DE If the source operand (divisor) is 0 
If the quotient is too large for the designated register. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#DE If the source operand (divisor) is 0. 
If the quotient is too large for the designated register. 

#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#DE If the source operand (divisor) is 0. 
If the quotient is too large for the designated register. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
#DE If the source operand (divisor) is 0 


If the quotient is too large for the designated register. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 
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DIVPD—Divide Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

66 OF 5E /r A VIV SSE2 Divide packed double-precision floating-point values 

DIVPD xmm1, xmm2/m128 in xmm1 by packed double-precision floating-point 
values in xmm2/mem. 

VEX.128.66.0F.WIG 5E /r B VIV AVX Divide packed double-precision floating-point values 

VDIVPD xmm1, xmm2, xmm3/m128 in xmm2 by packed double-precision floating-point 
values in xmm3/mem. 

VEX.256.66.0F.WIG 5E /r B VIV AVX Divide packed double-precision floating-point values 

VDIVPD ymm1, ymm2, ymm3/m256 in ymm2 by packed double-precision floating-point 
values in ymm3/mem. 

EVEX.128.66.0F.W1 5E /r C VIV AVX512VL | Divide packed double-precision floating-point values 

VDIVPD xmm1 {k1}{z}, xmm2, AVX512F in xmm2 by packed double-precision floating-point 

xmm3/m128/m64bcst values in xmm3/m128/m64bcst and write results to 
xmm1 subject to writemask k1. 

EVEX.256.66.0F.W1 5E /r C VIV AVX512VL | Divide packed double-precision floating-point values 

VDIVPD ymm1 {k1}{z}, ymm2, AVX512F in ymm2 by packed double-precision floating-point 

ymm3/m256/m64bcst values in ymnm3/m256/m64bcst and write results to 
ymm1 subject to writemask k1. 

EVEX.512.66.0F.W1 5E /r C VIV AVX512F Divide packed double-precision floating-point values 

VDIVPD zmm1 {k1}{z}, zmm2, in zmm2 by packed double-precision FP values in 

zmm3/m512/m64bcst{er} zmm3/m512/m64bcst and write results to zmm1 
subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD divide of the double-precision floating-point values in the first source operand by the floating- 
point values in the second source operand (the third operand). Results are written to the destination operand (the 
first operand). 


EVEX encoded versions: The first source operand (the second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand (the second operand) is a YMM register. The second source 
operand can be a YMM register or a 256-bit memory location. The destination operand is a YMM register. The upper 
bits (MAXVL-1:256) of the corresponding destination are zeroed. 


VEX.128 encoded version: The first source operand (the second operand) is a XMM register. The second source 
operand can be a XMM register or a 128-bit memory location. The destination operand is a XMM register. The upper 
bits (MAXVL-1:128) of the corresponding destination are zeroed. 

128-bit Legacy SSE version: The second source operand (the second operand) can be an XMM register or an 128- 
bit memory location. The destination is the same as the first source operand. The upper bits (MAXVL-1:128) of the 
corresponding destination are unmodified. 
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Operation 


VDIVPD (EVEX encoded versions) 

(KL, VL) = (2, 128), (4, 256), (8, 512) 

IF (VL = 512) AND (EVEX.b = 1) AND SRC2 *is a register* 
THEN 


SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); ; refer to Table 15-4 in the Intel? 64 and IA-32 Architectures 


Software Developer's Manual, Volume 1 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+63:i] = SRC1[i+63:i] / SRC2[63:0] 
ELSE 
DEST[i+63:i] = SRC1[i+63:i] / SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VDIVPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] / SRC2[63:0] 
DEST[127:64] := SRC1[127:64] / SRC2[127:64] 
DEST[191:128] := SRC1[191:128] / SRC2[191:128] 
DEST[255:192] := SRC1[255:192] / SRC2[255:192] 
DEST[MAXVL-1:256] := 0; 


VDIVPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] / SRC2[63:0] 
DEST[127:64] := SRC1[127:64] / SRC2[127:64] 
DEST[MAXVL-1:128] := 0; 


DIVPD (128-bit Legacy SSE version) 
DEST[63:0] := SRC1[63:0] / SRC2[63:0] 
DEST[127:64] := SRC1[127:64] / SRC2[127:64] 
DEST[MAXVL-1:128] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VDIVPD __m512d_mm512_div_pd(__m512d a,_m512d b); 

VDIVPD __m512d_mm512_mask_div_pd(__m512ds,__mmask8 k,__m512da,__m512d b); 
VDIVPD __m512d_mm512_maskz_div_pd(__mmask8 k,__m512d a,___m512d b); 

VDIVPD __m256d __mm256_mask_div_pd(__m256ds,__ mmask8 k,__m256d a, __ m256d b); 
VDIVPD __m256d __mm256_maskz_div_pd(__mmask8 k,__ m256d a, __m256d b); 

VDIVPD __m128d_mm_mask_div_pd(__m128ds,__ mmask8 k,__m128da,__m128d b); 
VDIVPD __m128d _mm_maskz_div_pd(__mmask8 k,__m128d a, ___m128d b); 
VDIVPD __m512d_mm512_div_round_pd(__m512da,__m512db, int); 

VDIVPD __m512d_mm512_mask_div_round_pd(__m512ds,__ mmask8 k,__m512da, 
VDIVPD __m512d_mm512_maskz_div_round_pd(__mmask8 k,__m512da,_m512d, int); 
VDIVPD __m256d _mm256_div_pd (__m256d a, __m256d b); 

DIVPD __m128d _mm_div_pd (__m128d a, __m128d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Divide-by-Zero, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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DIVPS—Divide Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

NP OF 5E /r A VIV SSE Divide packed single-precision floating-point values 

DIVPS xmm1, xmm2/m128 in xmm1 by packed single-precision floating-point 
values in xmm2/mem. 

VEX.128.0F.WIG 5E /r B VIV AVX Divide packed single-precision floating-point values 

VDIVPS xmm1, xmm2, xmm3/m128 in xmm2 by packed single-precision floating-point 
values in xmm3/mem. 

VEX.256.0F.WIG 5E /r B VIV AVX Divide packed single-precision floating-point values 

VDIVPS ymm1, ymm2, ymm3/m256 in ymm2 by packed single-precision floating-point 
values in ymm3/mem. 

EVEX.128.0F.WO 5E /r C VIV AVX512VL | Divide packed single-precision floating-point values 

VDIVPS xmm1 {k1}{z}, xmm2, AVX512F in xmm2 by packed single-precision floating-point 

xmm3/m128/m32bcst values in xmm3/m128/m32bcst and write results to 
xmm1 subject to writemask k1. 

EVEX.256.0F.WO 5E /r C VIV AVX512VL | Divide packed single-precision floating-point values 

VDIVPS ymm1 {k1}{z}, ymm2, AVX512F in ymm2 by packed single-precision floating-point 

ymm3/m256/m32bcst values in ymnm3/m256/m32bcst and write results to 
ymm1 subject to writemask k1. 

EVEX.512.0F.WO 5E /r C VIV AVX512F Divide packed single-precision floating-point values 

VDIVPS zmm1 {k1}{z}, zmm2, in zmm_2 by packed single-precision floating-point 

zmm3/m512/m32bcst{er} values in zmm3/m512/m32bcst and write results to 
zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD divide of the four, eight or sixteen packed single-precision floating-point values in the first source 
operand (the second operand) by the four, eight or sixteen packed single-precision floating-point values in the 
second source operand (the third operand). Results are written to the destination operand (the first operand). 


EVEX encoded versions: The first source operand (the second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VDIVPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+31:i] = SRC1[i+31:i] / SRC2[31:0] 
ELSE 
DEST[i+31:i] = SRC1[i+31:i] / SRC2[i+3 1:1] 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VDIVPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] / SRC2[31:0] 
DEST[63:32] := SRC1[63:32] / SRC2[63:32] 
DEST[95:64] := SRC1[95:64] / SRC2[95:64] 
DEST[127:96] := SRC1[127:96] / SRC2[127:96] 
DEST[159:1 28] := SRC1[159:128] / SRC2[159:1 28] 
DEST[191:160] := SRC1[191:160] / SRC2[191:160] 
DEST[223:192] := SRC1[223:192] / SRC2[223:192] 
DEST[255:224] := SRC1[255:224] / SRC2[255:224]. 
DEST[MAXVL-1:256] := 0; 


VDIVPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] / SRC2[31:0] 
DEST[63:32] := SRC1[63:32] / SRC2[63:32] 
DEST[95:64] := SRC1[95:64] / SRC2[95:64] 
DEST[127:96] := SRC1[127:96] / SRC2[127:96] 
DEST[MAXVL-1:128] := 0 
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DIVPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] / SRC2[31:0] 
DEST[63:32] := SRC1[63:32] / SRC2[63:32] 
DEST[95:64] := SRC1[95:64] / SRC2[95:64] 
DEST[127:96] := SRC1[127:96] / SRC2[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 

VDIVPS __m512_mm512_div_ps(__m512 a,__m512 b); 

VDIVPS __m512_mm512_mask_div_ps(__m512s,__mmask16 k,__m512 a,__m512 b); 
VDIVPS __m512 _mm512_maskz_div_ps(__mmask16 k,__m512 a,__m512 b); 

VDIVPD __m256d__mm256_mask_div_pd(__m256ds,__ mmask8 k,__m256d a, __m256d b); 
VDIVPD __m256d __mm256_maskz_div_pd(__mmask8 k,___m256d a, __ m256d b); 

VDIVPD __m128d __mm_mask_div_pd(__m128ds,__ mmask8 k,__m128d a,__m128d b); 
VDIVPD __m128d __mm_maskz_div_pd(__mmask8 k,__m128d a, __m128d b); 

VDIVPS __m512 _mm512_div_round_ps(__m512 a,__m512 5, int); 

VDIVPS __m512 _mm512_mask_div_round_ps(__m512s,__ mmask16 k,__m512 a,__m512 5, int); 
VDIVPS __m512_mm512_maskz_div_round_ps(__mmask16 k,__m512 a,__m512 5, int); 
VDIVPS __m256 __mm256_div_ps (__m256 a,__ m256 b); 

DIVPS __m128_mm_div_ps (_m128 a,__m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Divide-by-Zero, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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DIVSD—Divide Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F2 OF 5E /r A VIV SSE2 Divide low double-precision floating-point value in 
DIVSD xmm1, xmm2/m64 xmm1 by low double-precision floating-point value 
in xmm2/m64. 
VEX.LIG.F2.0F.WIG 5E /r B VIV AVX Divide low double-precision floating-point value in 
VDIVSD xmm1, xmm2, xmm3/m64 xmm_2 by low double-precision floating-point value 
in xmm3/m64. 
EVEX.LLIG.F2.0F.W1 5E /r C VIV AVX512F Divide low double-precision floating-point value in 
VDIVSD xmm1 {k1}{z}, xmm2, xmm2z by low double-precision floating-point value 
xmm3/m64{er} in xmm3/m64. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Divides the low double-precision floating-point value in the first source operand by the low double-precision 
floating-point value in the second source operand, and stores the double-precision floating-point result in the desti- 
nation operand. The second source operand can be an XMM register or a 64-bit memory location. The first source 
and destination are XMM registers. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:64) of the corresponding ZMM destination register remain unchanged. 


VEX.128 encoded version: The first source operand is an xmm register encoded by VEX.vvvv. The quadword at bits 
127:64 of the destination operand is copied from the corresponding quadword of the first source operand. Bits 
(MAXVL-1:128) of the destination register are zeroed. 


EVEX.128 encoded version: The first source operand is an xmm register encoded by EVEX.vvvv. The quadword 
element of the destination operand at bits 127:64 are copied from the first source operand. Bits (MAXVL-1:128) of 
the destination register are zeroed. 


EVEX version: The low quadword element of the destination is updated according to the writemask. 


Software should ensure VDIVSD is encoded with VEX.L=0. Encoding VDIVSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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INSTRUCTION SET REFERENCE, A-L 


Operation 


VDIVSD (EVEX encoded version) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := SRC1[63:0] / SRC2[63:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VDIVSD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] / SRC2[63:0] 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


DIVSD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] / SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VDIVSD __m128d _mm_mask_div_sd(__m128ds,__ mmask8 k,___m128d a, 
VDIVSD __m128d _mm_maskz_div_sd(__mmask8 k,___m128d a, ___m128d b); 

VDIVSD __m128d_mm_div_round_sd(__m128da,__m128d, int); 

VDIVSD __m128d _mm_mask_div_round_sd(__m128ds,__ mmask8 k,___m128d a,___m128d, int); 
VDIVSD __m128d _mm_maskz_div_round_sd(__mmask8 k,__m128d a, _m128d , int); 

DIVSD __m128d __mm_div_sd (__m128d a, ___m128d b); 


m128d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Divide-by-Zero, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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DIVSS—Divide Scalar Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 5E /r A VIV SSE Divide low single-precision floating-point value in 
DIVSS xmm1, xmm2/m32 xmm1 by low single-precision floating-point value in 
xmm2/m32. 
VEX.LIG.F3.0F.WIG 5E /r B VIV AVX Divide low single-precision floating-point value in 
VDIVSS xmm1, xmm2, xmm3/m32 xmmc2 by low single-precision floating-point value in 
xmm3/m32. 
EVEX.LLIG.F3.0F.WO 5E /r C VIV AVX512F | Divide low single-precision floating-point value in 
VDIVSS xmm1 {k1}{z}, xmm2, xmmcz by low single-precision floating-point value in 
xmm3/m32{er} xmm3/m32. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Divides the low single-precision floating-point value in the first source operand by the low single-precision floating- 
point value in the second source operand, and stores the single-precision floating-point result in the destination 
operand. The second source operand can be an XMM register or a 32-bit memory location. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: The first source operand is an xmm register encoded by VEX.vvvv. The three high-order 
doublewords of the destination operand are copied from the first source operand. Bits (MAXVL-1:128) of the desti- 
nation register are zeroed. 


EVEX.128 encoded version: The first source operand is an xmm register encoded by EVEX.vvvv. The doubleword 
elements of the destination operand at bits 127:32 are copied from the first source operand. Bits (MAXVL-1:128) 
of the destination register are zeroed. 


EVEX version: The low doubleword element of the destination is updated according to the writemask. 


Software should ensure VDIVSS is encoded with VEX.L=0. Encoding VDIVSS with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


VDIVSS (EVEX encoded version) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := SRC1[31:0] / SRC2[31:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VDIVSS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] / SRC2[31:0] 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


DIVSS (128-bit Legacy SSE version) 
DEST[31:0] := DEST[31:0] / SRC[31:0] 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VDIVSS __m128 _mm_mask_div_ss(__m128s,__ mmask8 k,___m128 a, 
VDIVSS __m128 _mm_maskz_div_ss(__mmask8 k,__m128a,__m128 b); 

VDIVSS __m128_mm_div_round_ss(__m128 a,__m128, int); 

VDIVSS __m128 _mm_mask_div_round_ss(__m128 s,__ mmask8 k,__m128 a,__m128 b, int); 
VDIVSS __m128 _mm_maskz_div_round_ss(__mmask8 k,__m128 a,__m128 5, int); 

DIVSS __m128 _mm_div_ss(__m128 a,__m128 b); 


m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Divide-by-Zero, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, A-L 


DPPD — Dot Product of Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En Mode Feature 
Flag 
66 OF 3A 41 /r ib RMI | V/V SSE4_1 Selectively multiply packed DP floating-point 
DPPD xmm1, xmm2/m128, imm8 values from xmm17 with packed DP floating- 


point values from xmm2, add and selectively 
store the packed DP floating-point values to 


xmm1. 
VEX.128.66.0F3A.WIG 41 /r ib RVMI | V/V AVX Selectively multiply packed DP floating-point 
VDPPD xmm1,xmm2, xmm3/m128, imm8 values from xmm2 with packed DP floating- 


point values from xmm3, add and selectively 
store the packed DP floating-point values to 


xmm1. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 


Description 


Conditionally multiplies the packed double-precision floating-point values in the destination operand (first 
operand) with the packed double-precision floating-point values in the source (second operand) depending ona 
mask extracted from bits [5:4] of the immediate operand (third operand). If a condition mask bit is zero, the corre- 
sponding multiplication is replaced by a value of 0.0 in the manner described by Section 12.8.4 of Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1. 


The two resulting double-precision values are summed into an intermediate result. The intermediate result is 
conditionally broadcasted to the destination using a broadcast mask specified by bits [1:0] of the immediate byte. 


If a broadcast mask bit is “1”, the intermediate result is copied to the corresponding qword element in the destina- 
tion operand. If a broadcast mask bit is zero, the corresponding element in the destination is set to zero. 


DPPD follows the NaN forwarding rules stated in the Software Developer’s Manual, vol. 1, table 4.7. These rules do 
not cover horizontal prioritization of NaNs. Horizontal propagation of NaNs to the destination and the positioning of 
those NaNs in the destination is implementation dependent. NaNs on the input sources or computationally gener- 
ated NaNs will have at least one NaN propagated to the destination. 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

If VDPPD is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an 
#UD exception. 
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Operation 
DP_primitive (SRC1, SRC2) 
IF (imm8[4] = 1) 
THEN Temp1[63:0] := DEST[63:0] * SRC[63:0]; // update SIMD exception flags 
ELSE Temp1[63:0] := +0.0; Fl; 
IF (imm8[5] = 1) 
THEN Temp1[127:64] := DEST[127:64] * SRC[127:64]; // update SIMD exception flags 
ELSE Temp1[127:64] := +0.0; Fl; 
/* if unmasked exception reported, execute exception handler*/ 


Temp2[63:0] := Temp1[63:0] + Temp1[127:64]; // update SIMD exception flags 
/* if unmasked exception reported, execute exception handler*/ 


IF (imm8[0] = 1) 
THEN DEST[63:0] := Temp2[63:0]; 
ELSE DEST[63:0] = +0.0; Fl; 

IF (imm8[1] = 1) 

THEN DEST[127:64] := Temp2[63:0]; 
ELSE DEST[127:64] := +0.0; Fl; 


DPPD (128-bit Legacy SSE version) 
DEST[127:0] := DP_Primitive(SRC1[127:0], SRC2[127:0)); 
DEST[MAXVL-1:128] (Unmodified) 


VDPPD (VEX.128 encoded version) 
DEST[127:0] := DP_Primitive(SRC1[127:0], SRC2[127:0]); 
DEST[MAXVL-1:128] := 0 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 


DPPD: m128d _mm_dp_pd (__m128d a,__m128d b, const int mask); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Exceptions are determined separately for each add and multiply operation. Unmasked exceptions will leave the 
destination untouched. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”; additionally: 
#UD If VEX.L= 1. 
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DPPS — Dot Product of Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 3A 40 /r ib RMI | V/V SSE4_1 Selectively multiply packed SP floating-point 
DPPS xmm1, xmm2/m128, imm8 values from xmm1 with packed SP floating- 


point values from xmm2, add and selectively 
store the packed SP floating-point values or 
zero values to xmm1. 


VEX.128.66.0F3A.WIG 40 /r ib RVMI | V/V AVX Multiply packed SP floating point values from 

VDPPS xmm1,xmm2, xmm3/m128, imm8 xmm_1 with packed SP floating point values 
from xmm2/mem selectively add and store to 
xmm1. 

VEX.256.66.0F3A.WIG 40 /r ib RVMI | V/V AVX Multiply packed single-precision floating-point 

VDPPS ymm1, ymm2, ymm3/m256, imm8 values from ymm_2 with packed SP floating 


point values from ymm3/mem, selectively add 
pairs of elements and store to ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


Conditionally multiplies the packed single precision floating-point values in the destination operand (first operand) 
with the packed single-precision floats in the source (second operand) depending on a mask extracted from the 
high 4 bits of the immediate byte (third operand). If a condition mask bit in Imm8[7:4] is zero, the corresponding 
multiplication is replaced by a value of 0.0 in the manner described by Section 12.8.4 of Inte!/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 1. 


The four resulting single-precision values are summed into an intermediate result. The intermediate result is condi- 
tionally broadcasted to the destination using a broadcast mask specified by bits [3:0] of the immediate byte. 


If a broadcast mask bit is “1”, the intermediate result is copied to the corresponding dword element in the destina- 
tion operand. If a broadcast mask bit is zero, the corresponding element in the destination is set to zero. 


DPPS follows the NaN forwarding rules stated in the Software Developer’s Manual, vol. 1, table 4.7. These rules do 
not cover horizontal prioritization of NaNs. Horizontal propagation of NaNs to the destination and the positioning of 
those NaNs in the destination is implementation dependent. NaNs on the input sources or computationally gener- 
ated NaNs will have at least one NaN propagated to the destination. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 


VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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Operation 

DP_primitive (SRC1, SRC2) 

IF (imm8[4] = 1) 
THEN Temp1[31:0] := DEST[31:0] * SRC[31:0]; // update SIMD exception flags 
ELSE Temp1[31:0] := +0.0; Fl; 

IF (imm8[5] = 1) 
THEN Temp1[63:32] := DEST[63:32] * SRC[63:32]; // update SIMD exception flags 
ELSE Temp1[63:32] := +0.0; Fl; 

IF (imm8[6] = 1) 
THEN Temp1[95:64] := DEST[95:64] * SRC[95:64]; // update SIMD exception flags 
ELSE Temp1[95:64] := +0.0; Fl; 

IF (imm8[7] = 1) 
THEN Temp1[1 27:96] := DEST[127:96] * SRC[127:96]; // update SIMD exception flags 
ELSE Temp1[127:96] := +0.0; Fl; 


Temp2[31:0] := Temp1[31:0] + Temp1[63:32]; // update SIMD exception flags 

/* if unmasked exception reported, execute exception handler*/ 

Temp3[31:0] := Temp1[95:64] + Temp1[127:96]; // update SIMD exception flags 
/* if unmasked exception reported, execute exception handler*/ 

Temp4[31:0] := Temp2[31:0] + Temp3[31:0]; // update SIMD exception flags 

/* if unmasked exception reported, execute exception handler*/ 


IF (imm8[0] = 1) 
THEN DEST[31:0] := Temp4{31:0); 
ELSE DEST[31:0] = +0.0; Fl; 

IF (imm8[1] = 1) 
THEN DEST[63:32] := Temp4[31:0]; 
ELSE DEST[63:32] := +0.0; Fl; 

IF (imm8[2] = 1) 
THEN DEST[95:64] := Temp4[31:0]; 
ELSE DEST[95:64] := +0.0; Fl; 

IF (imm8[3] = 1) 
THEN DEST[127:96] := Temp4[31:0]; 
ELSE DEST[127:96] := +0.0; Fl; 


DPPS (128-bit Legacy SSE version) 
DEST[127:0] := DP_Primitive(SRC1[127:0], SRC2[127:0)); 
DEST[MAXVL-1:128] (Unmodified) 


VDPPS (VEX.128 encoded version) 
DEST[127:0] := DP_Primitive(SRC1[127:0], SRC2[127:0]); 
DEST[MAXVL-1:128] := 0 


VDPPS (VEX.256 encoded version) 
DEST[127:0] := DP_Primitive(SRC1[127:0], SRC2[127:0]); 
DEST[255:128] := DP_Primitive(SRC1[255:128], SRC2[255:128)); 


Flags Affected 
None 
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Intel C/C++ Compiler Intrinsic Equivalent 


(V)DPPS: m128_mm_dp_ps (__m128 a,__m128b, const int mask); 


VDPPS: m256 __mm256_dp_ps (__m256 a,__m256 b, const int mask); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Exceptions are determined separately for each add and multiply operation, in the order of their execution. 
Unmasked exceptions will leave the destination operands unchanged. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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EMMS—Empty MMX Technology State 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
NP OF 77 EMMS ZO | Valid Valid Set the x87 FPU tag word to empty. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Sets the values of all the tags in the x87 FPU tag word to empty (all 1s). This operation marks the x87 FPU data 
registers (which are aliased to the MMX technology registers) as available for use by x87 FPU floating-point instruc- 
tions. (See Figure 8-7 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for the 
format of the x87 FPU tag word.) All other MMX instructions (other than the EMMS instruction) set all the tags in 
x87 FPU tag word to valid (all Os). 


The EMMS instruction must be used to clear the MMX technology state at the end of all MMX technology procedures 
or subroutines and before calling other procedures or subroutines that may execute x87 floating-point instructions. 
If a floating-point instruction loads one of the registers in the x87 FPU data register stack before the x87 FPU tag 
word has been reset by the EMMS instruction, an x87 floating-point register stack overflow can occur that will result 
in an x87 floating-point exception or incorrect result. 


EMMS operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


x87FPUTagWord := FFFFH; 


Intel C/C++ Compiler Intrinsic Equivalent 


void __mm_empty() 


Flags Affected 
None 


Protected Mode Exceptions 


#UD If CRO.EM[bit 2] = 1. 

#NM If CRO.TS[bit 3] = 1. 

#MF If there is a pending FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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ENCODEKEY 128—Encode 128-Bit Key with Key Locker 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 FA 1 1:rrr:bbb A VV AESKLE Wrap a 128-bit AES key from XMMO into a key handle 
ENCODEKEY 1 28 r32, r32, <XMMO-2>, and output handle in XMMO-2. 
<XMM4-6> 


Instruction Operand Encoding 


Op/En | Tuple Operand 1 Operand 2 Operand 3 Operands 4-5 Operands 6 - 7 
A NA ModRM:reg (w) ModRM:r/m (r) Implicit XMMO (r, w) Implicit XMM1-2 (w) | Implicit XMM4-6 (w) 
Description 


The ENCODEKEY128! instruction wraps a 128-bit AES key from the implicit operand XMMO into a key handle that 
is then stored in the implicit destination operands XMMO-2. 


The explicit source operand specifies handle restrictions, if any. 


The explicit destination operand is populated with information on the source of the key and its attributes. XMM4 
through XMM6 are reserved for future usages and software should not rely upon them being zeroed. 


Operation 


ENCODEKEY128 

#GP (0) if a reserved bit? in SRC[31:0] is set 

InputKey[1 27:0] := XMMO; 

KeyMetadata[2:0] = SRC[2:0]; 

KeyMetadata[23:3] = 0; // Reserved for future usage 
KeyMetadata[2 7:24] = 0; // KeyType is AES-128 (value of 0) 
KeyMetadata[1 27:28] = 0; // Reserved for future usage 


// KeyMetadata is the AAD input and InputKey is the Plaintext input for WrapKey128 
Handle[383:0] := WrapKey1 28(InputKey[1 27:0], KeyMetadata[1 27:0], IWKey.Integrity Key[127:0], IWKey.Encryption Key[255:0)); 


DEST[O] := IWKey.NoBackup; 

DEST[4:1] := lWKey.KeySource[3:0]; 
DEST[31:5] = 0; 

XMMO := Handle[127:0]; // AAD 

XMM1 := Handle[255:128]; // Integrity Tag 
XMM2 := Handle[383:256]; // CipherText 
XMM4 := 0; // Reserved for future usage 
XMM5 := 0; // Reserved for future usage 
XMM6 := 0; // Reserved for future usage 
RFLAGS.OF, SF, ZF, AF, PF, CF := 0; 


Flags Affected 


All arithmetic flags (OF, SF, ZF, AF, PF, CF) are cleared to 0. Although they are cleared for the currently defined oper- 
ations, future extensions may report information in the flags. 


1. Further details on Key Locker and usage of this instruction can be found here: 


https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 

2. SRC[31:3] are currently reserved for future usages. SRC[2], which indicates a no-decrypt restriction, is reserved if 
CPUID.19H:EAX[2] is 0. SRC[1], which indicates a no-encrypt restriction, is reserved if CPUID.1 9H:EAX[1] is 0. SRC[O], which indicates 
a CPLO-only restriction, is reserved if CPUID.1 9H:EAX[0] is 0. 
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Intel C/C++ Compiler Intrinsic Equivalent 


ENCODEKEY128 unsigned int _mm_encodekey128_u32(unsigned int htype, __m128i key, void* h); 


Exceptions (All Operating Modes) 
#GP If reserved bit is set in source register value. 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
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ENCODEKEY256—Encode 256-Bit Key with Key Locker 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 FB 1 1:rrr:bbb A VIV AESKLE Wrap a 256-bit AES key from XMM1:XMMO into a key 
ENCODEKEY 256 r32, r32 <XMMO-6> handle and store it in XMMO-3. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operands 3 - 4 Operands 5 - 9 
A NA ModRM:reg (w) ModRM:r/m (r) Implicit XMMO-1 (r, w) Implicit XMM2-6 (w) 
Description 


The ENCODEKEY256! instruction wraps a 256-bit AES key from the implicit operand XMM1:XMMO into a key handle 
that is then stored in the implicit destination operands XMMO-3. 

The explicit source operand is a general-purpose register and specifies what handle restrictions should be built into 
the handle. 


The explicit destination operand is populated with information on the source of the key and its attributes. XMM4 
through XMM6 are reserved for future usages and software should not rely upon them being zeroed. 


Operation 


ENCODEKEY256 

#GP (0) if a reserved bit? in SRC[31:0] is set 

InputKey[255:0] :-= XMM1:XMMO; 

KeyMetadata[2:0] = SRC[2:0]; 

KeyMetadata[23:3]=0; // Reserved for future usage 
KeyMetadata[27:24] = 1; // KeyType is AES-256 (value of 1) 
KeyMetadata[1 27:28] = 0; // Reserved for future usage 


// KeyMetadata is the AAD input and InputKey is the Plaintext input for WrapKey256 
Handle[51 1:0] := WrapKey256(InputKey[255:0], KeyMetadata[1 27:0], IWKey.Integrity Key[127:0], IlWKey.Encryption Key[255:0)); 


DEST[O] := IWKey.NoBackup; 

DEST[4:1] := lWKey.KeySource[3:0]; 

DEST[31:5] = 0; 

XMMO := Handle[127:0]; // AAD 

XMM1 := Handle[255:128]; // Integrity Tag 

XMM2 := Handle[383:256]; // CipherText[1 27:0] 
XMM3 := Handle[51 1:384]; // CipherText[255:128] 


XMM4 := 0; // Reserved for future usage 
XMM5 := 0; // Reserved for future usage 
XMM6 := 0; // Reserved for future usage 


RFLAGS.OF, SF, ZF, AF, PF, CF := 0; 


1. Further details on Key Locker and usage of this instruction can be found here: 


https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 

2. SRC[31:3] are currently reserved for future usages. SRC[2], which indicates a no-decrypt restriction, is reserved if 
CPUID.19H:EAX[2] is 0. SRC[1], which indicates a no-encrypt restriction, is reserved if CPUID.1 9H:EAX[1] is 0. SRC[O], which indicates 
a CPLO-only restriction, is reserved if CPUID.1 9H:EAX[0] is 0. 
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Flags Affected 


All arithmetic flags (OF, SF, ZF, AF, PF, CF) are cleared to 0. Although they are cleared for the currently defined oper- 
ations, future extensions may report information in the flags. 


Intel C/C++ Compiler Intrinsic Equivalent 


ENCODEKEY256 unsigned int _mm_encodekey256_u32(unsigned int htype, __m128i key_lo, __m128i key_hi, void* h); 


Exceptions (All Operating Modes) 
#GP If reserved bit is set in source register value. 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CPUID.19H:EBX.AESKLE [bit 0] = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 


3-338 Vol. 2A ENCODEKEY256—Encode 256-Bit Key with Key Locker 


INSTRUCTION SET REFERENCE, A-L 


ENDBR32—Terminate an Indirect Branch in 32-bit and Compatibility Mode 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 1E FB ZO VV CET_IBT Terminate indirect branch in 32 bit and compatibility 
ENDBR32 mode. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA NA 
Description 
Terminate an indirect branch in 32 bit and compatibility mode. 
Operation 
IF EndbranchEnabled(CPL) & (IA32_EFER.LMA = 0 | (IA32_EFER.LMA=1 & CS.L = 0) 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = IDLE 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = IDLE 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 
Flags Affected 
None. 
Exceptions 
None. 
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ENDBR64—Terminate an Indirect Branch in 64-bit Mode 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 1E FA ZO VN CET_IBT Terminate indirect branch in 64 bit mode. 
ENDBR64 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA NA 
Description 


Terminate an indirect branch in 64 bit mode. 


Operation 
IF EndbranchEnabled(CPL) & IA32_EFER.LMA = 1&CS.L=1 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = IDLE 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = IDLE 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 


Flags Affected 
None. 


Exceptions 
None. 
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ENTER—Make Stack Frame for Procedure Parameters 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
C8 iw 00 ENTER imm16, 0 ll Valid Valid Create a stack frame for a procedure. 
C8 iw 01 ENTER imm16,1 ll Valid Valid Create a stack frame with a nested pointer for 


a procedure. 


C8 iw ib ENTER imm16, imm8 ll Valid Valid Create a stack frame with nested pointers for 
a procedure. 


Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 


Il iw imm8 NA NA 


Description 


Creates a stack frame (comprising of space for dynamic storage and 1-32 frame pointer storage) for a procedure. 
The first operand (imm16) specifies the size of the dynamic storage in the stack frame (that is, the number of bytes 
of dynamically allocated on the stack for the procedure). The second operand (imm8) gives the lexical nesting level 
(0 to 31) of the procedure. The nesting level (imm8 mod 32) and the OperandSize attribute determine the size in 
bytes of the storage space for frame pointers. 


The nesting level determines the number of frame pointers that are copied into the “display area” of the new stack 
frame from the preceding frame. The default size of the frame pointer is the StackAddrSize attribute, but can be 
overridden using the 66H prefix. Thus, the OperandSize attribute determines the size of each frame pointer that 
will be copied into the stack frame and the data being transferred from SP/ESP/RSP register into the BP/EBP/RBP 
register. 


The ENTER and companion LEAVE instructions are provided to support block structured languages. The ENTER 
instruction (when used) is typically the first instruction in a procedure and is used to set up a new stack frame for 
a procedure. The LEAVE instruction is then used at the end of the procedure (just before the RET instruction) to 
release the stack frame. 


If the nesting level is 0, the processor pushes the frame pointer from the BP/EBP/RBP register onto the stack, 
copies the current stack pointer from the SP/ESP/RSP register into the BP/EBP/RBP register, and loads the 
SP/ESP/RSP register with the current stack-pointer value minus the value in the size operand. For nesting levels of 
1 or greater, the processor pushes additional frame pointers on the stack before adjusting the stack pointer. These 
additional frame pointers provide the called procedure with access points to other nested frames on the stack. See 
“Procedure Calls for Block-Structured Languages” in Chapter 6 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1, for more information about the actions of the ENTER instruction. 


The ENTER instruction causes a page fault whenever a write using the final value of the stack pointer (within the 
current stack segment) would do so. 


In 64-bit mode, default operation size is 64 bits; 32-bit operation size cannot be encoded. Use of 66H prefix 
changes frame pointer operand size to 16 bits. 


When the 66H prefix is used and causing the OperandSize attribute to be less than the StackAddrSize, software is 
responsible for the following: 


¢ The companion LEAVE instruction must also use the 66H prefix, 


¢ The value in the RBP/EBP register prior to executing “66H ENTER” must be within the same 16KByte region of 
the current stack pointer (RSP/ESP), such that the value of RBP/EBP after “66H ENTER” remains a valid address 
in the stack. This ensures “66H LEAVE” can restore 16-bits of data from the stack. 
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Operation 


AllocSize := imm16; 
NestingLevel := imm8 MOD 32; 
IF (OperandSize = 64) 
THEN 
Push(RBP); (* RSP decrements by 8 *) 
FrameTemp := RSP; 
ELSE IF OperandSize = 32 
THEN 
Push(EBP); (* (E)SP decrements by 4 *) 
FrameTemp := ESP; FI; 
ELSE (* OperandSize = 16 *) 
Push(BP); (* RSP or (€)SP decrements by 2 *) 
FrameTemp := SP; 
Fl; 


IF NestingLevel = 0 
THEN GOTO CONTINUE; 
Fl; 


IF (NestingLevel > 1) 
THEN FOR i := 1 to (NestingLevel - 1) 


DO 
IF (OperandSize = 64) 
THEN 
RBP := RBP - 8; 


Push([RBP]); (* Quadword push *) 
ELSE IF OperandSize = 32 
THEN 
IF StackSize = 32 
EBP := EBP - 4; 
Push([EBP]); (* Doubleword push *) 
ELSE (* StackSize = 16 *) 
BP := BP - 4; 
Push([BP]); (* Doubleword push *) 
FI; 
FI; 
ELSE (* OperandSize = 16 *) 
IF StackSize = 32 
THEN 
EBP := EBP - 2; 
Push([EBP]); (* Word push *) 
ELSE (* StackSize = 16 *) 
BP := BP - 2; 
Push([BP]); (* Word push *) 
FI; 
FI; 
OD; 
FI; 


IF (OperandSize = 64) (* nestinglevel 1 *) 
THEN 
Push(FrameTemp); (* Quadword push and RSP decrements by 8 *) 
ELSE IF OperandSize = 32 
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THEN 
Push(FrameTemp); Fl; (* Doubleword push and (€)SP decrements by 4 *) 
ELSE (* OperandSize = 16 *) 
Push(FrameTemp); (* Word push and RSP|ESP|SP decrements by 2 *) 
Fl; 


CONTINUE: 
IF 64-Bit Mode (StackSize = 64) 
THEN 
RBP := FrameTemp; 
RSP := RSP — AllocSize; 
ELSE IF OperandSize = 32 
THEN 
EBP := FrameTemp; 
ESP := ESP — AllocSize; Fl; 
ELSE (* OperandSize = 16 *) 
BP := FrameTemp[15:1]; (* Bits 16 and above of applicable RBP/EBP are unmodified *) 
SP := SP — AllocSize; 
Fl; 


END; 


Flags Affected 
None. 


Protected Mode Exceptions 
#SS(0) If the new value of the SP or ESP register is outside the stack segment limit. 


#PF(fault-code) If a page fault occurs or if a write using the final value of the stack pointer (within the current 
stack segment) would cause a page fault. 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#SS If the new value of the SP or ESP register is outside the stack segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#SS(0) If the new value of the SP or ESP register is outside the stack segment limit. 


#PF(fault-code) If a page fault occurs or if a write using the final value of the stack pointer (within the current 
stack segment) would cause a page fault. 


#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If the stack address is in a non-canonical form. 


#PF(fault-code) If a page fault occurs or if a write using the final value of the stack pointer (within the current 
stack segment) would cause a page fault. 


#UD If the LOCK prefix is used. 
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EXTRACTPS—Extract Packed Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

66 OF 3A 17 /rib A VV SSE4_1 Extract one single-precision floating-point value 

EXTRACTPS reg/m32, xmm1, imm8 from xmm1 at the offset specified by imm8 and 
store the result in reg or m32. Zero extend the 
results in 64-bit register if applicable. 

VEX.128.66.0F3A.WIG 17 /r ib A VV AVX Extract one single-precision floating-point value 

VEXTRACTPS reg/m32, xmm1, imm8 from xmm_1 at the offset specified by imm8 and 
store the result in reg or m32. Zero extend the 
results in 64-bit register if applicable. 

EVEX.128.66.0F3A.WIG 17 /r ib B VIV AVX512F Extract one single-precision floating-point value 

VEXTRACTPS reg/m32, xmm1, imm8 from xmm1 at the offset specified by imm8 and 
store the result in reg or m32. Zero extend the 
results in 64-bit register if applicable. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) Imm8 NA 
B Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
Description 


Extracts a single-precision floating-point value from the source operand (second operand) at the 32-bit offset spec- 
ified from imm8s. Immediate bits higher than the most significant offset for the vector length are ignored. 


The extracted single-precision floating-point value is stored in the low 32-bits of the destination operand 


In 64-bit mode, destination register operand has default operand size of 64 bits. The upper 32-bits of the register 
are filled with zero. REX.W is ignored. 


VEX.128 and EVEX encoded version: When VEX.W1 or EVEX.W1 form is used in 64-bit mode with a general purpose 
register (GPR) as a destination operand, the packed single quantity is zero extended to 64 bits. 


VEX.vvvv/EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


128-bit Legacy SSE version: When a REX.W prefix is used in 64-bit mode with a general purpose register (GPR) as 
a destination operand, the packed single quantity is zero extended to 64 bits. 

The source register is an XMM register. Imm8[1:0] determine the starting DWORD offset from which to extract the 
32-bit floating-point value. 

If VEXTRACTPS is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause 
an #UD exception. 


Operation 


VEXTRACTPS (EVEX and VEX.128 encoded version) 
SRC_OFFSET := IMM8[1:0] 
IF (64-Bit Mode and DEST is register) 
DEST[31:0] := (SRC[127:0] >> (SRC_OFFSET*32)) AND OFFFFFFFFh 
DEST[63:32] := 0 
ELSE 
DEST[31:0] := (SRC[127:0] >> (SRC_OFFSET*32)) AND OFFFFFFFFh 
Fl 
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EXTRACTPS (128-bit Legacy SSE version) 
SRC_OFFSET := IMM8[1:0] 
IF (64-Bit Mode and DEST is register) 
DEST[31:0] := (SRC[127:0] >> (SRC_OFFSET*32)) AND OFFFFFFFFh 
DEST[63:32] := 0 
ELSE 
DEST[31:0] := (SRC[127:0] >> (SRC_OFFSET*32)) AND OFFFFFFFFh 
Fl 


Intel C/C++ Compiler Intrinsic Equivalent 
EXTRACTPS int __mm_extract_ps (__m128 a, const int nidx); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


VEX-encoded instructions, see Table 2-22, “Type 5 Class Exception Conditions”. 
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EVEX-encoded instructions, see Table 2-57, “Type EONF Class Exception Conditions”. 


Additionally: 
#UD IF VEX.L = 0. 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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F2XM1—Compute 2*-1 


Opcode Instruction 64-Bit Compat/ Description 

Mode Leg Mode 
D9 FO F2XM1 Valid Valid Replace ST(0) with (25% - 1). 
Description 


Computes the exponential value of 2 to the power of the source operand minus 1. The source operand is located in 
register ST(O) and the result is also stored in ST(O). The value of the source operand must lie in the range -1.0 to 
+1.0. If the source value is outside this range, the result is undefined. 


The following table shows the results obtained when computing the exponential value of various classes of 
numbers, assuming that neither overflow nor underflow occurs. 


Table 3-16. Results Obtained from F2XM1 


ST(0) SRC ST(0) DEST 
— 1,0 to -0 —0.5 to-—O 
-0 -0 
+0 +0 
+0 to+1.0 +0 to 1.0 


Values other than 2 can be exponentiated using the following formula: 
xy := 2ly * log5x) 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


ST(0) := (25% — 1); 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
co, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value or unsupported format. 
#D Source is a denormal value. 

#U Result is too small for destination format. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FABS—Absolute Value 


Opcode Instruction 64-Bit |Compat/ Description 
Mode | Leg Mode 
D9 €1 FABS Valid Valid Replace ST with its absolute value. 
Description 


Clears the sign bit of ST(O) to create the absolute value of the operand. The following table shows the results 
obtained when creating the absolute value of various classes of numbers. 


Table 3-17. Results Obtained from FABS 


ST(0) SRC ST(0) DEST 
— + 00 
—F +F 
_0 +0 
+0 +0 
+F +F 
+00 +00 
NaN NaN 


NOTES: 
F Means finite floating-point value. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 
ST(O) := |ST(O)|; 


FPU Flags Affected 
C1 Set to 0. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 
#I1S Stack underflow occurred. 


Protected Mode Exceptions 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FADD/FADDP/FIADD—Add 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 

D8 /O FADD m32fp Valid Valid Add m32fp to ST(0) and store result in ST(0). 

DC /O FADD m64fp Valid Valid Add m64fp to ST(0) and store result in ST(0). 

D8 CO+i FADD ST(0), ST(i) Valid Valid Add ST(0) to ST(i) and store result in ST(0). 

DC CO+i FADD ST(i), ST(0) Valid Valid Add ST(i) to ST(0) and store result in ST(i). 

DE CO+i FADDP ST(i), ST(0) Valid Valid Add ST(0) to ST(i), store result in ST(i), and pop the 
register stack. 

DE C1 FADDP Valid Valid Add ST(0) to ST(1), store result in ST(1), and pop the 
register stack. 

DA /O FIADD m32int Valid Valid Add m32int to ST(0) and store result in ST(O). 

DE /O FIADD m16int Valid Valid Add m16int to ST(O) and store result in ST(O). 

Description 


Adds the destination and source operands and stores the sum in the destination location. The destination operand 
is always an FPU register; the source operand can be a register or a memory location. Source operands in memory 
can be in single-precision or double-precision floating-point format or in word or doubleword integer format. 


The no-operand version of the instruction adds the contents of the ST(0) register to the ST(1) register. The one- 
operand version adds the contents of a memory location (either a floating-point or an integer value) to the 
contents of the ST(0) register. The two-operand version, adds the contents of the ST(0) register to the ST(i) 
register or vice versa. The value in ST(0) can be doubled by coding: 


FADD ST(0), ST(0); 


The FADDP instructions perform the additional operation of popping the FPU register stack after storing the result. 
To pop the register stack, the processor marks the ST(O) register as empty and increments the stack pointer (TOP) 
by 1. (The no-operand version of the floating-point add instructions always results in the register stack being 
popped. In some assemblers, the mnemonic for this instruction is FADD rather than FADDP.) 


The FIADD instructions convert an integer source operand to double extended-precision floating-point format 
before performing the addition. 


The table on the following page shows the results obtained when adding various classes of numbers, assuming that 
neither overflow nor underflow occurs. 


When the sum of two operands with opposite signs is 0, the result is +0, except for the round toward —oo mode, in 
which case the result is -O. When the source operand is an integer 0, it is treated as a +0. 


When both operand are infinities of the same sign, the result is « of the expected sign. If both operands are infini- 
ties of opposite signs, an invalid-operation exception is generated. See Table 3-18. 
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Table 3-18. FADD/FADDP/FIADD Results 
DEST 


SRC 


NOTES: 

F Means finite floating-point value. 

| Means integer. 

* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF Instruction = FIADD 
THEN 
DEST := DEST + ConvertToDoubleExtendedPrecisionFP(SRC); 
ELSE (* Source operand is floating-point value *) 
DEST := DEST + SRC; 


Fl; 
IF Instruction = FADDP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
co, C2, C3 Undefined. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 

#IA Operand is an SNaN value or unsupported format. 
Operands are infinities of unlike sign. 

#D Source operand is a denormal value. 

#U Result is too small for destination format. 

#0 Result is too large for destination format. 

#P Value cannot be represented exactly in destination format. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 
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If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FBLD—Load Binary Coded Decimal 


Opcode Instruction 64-Bit |Compat/ |Description 
Mode __| Leg Mode 
DF /4 FBLD m80bcd Valid Valid Convert BCD value to floating-point and push onto the 
FPU stack. 
Description 


Converts the BCD source operand into double extended-precision floating-point format and pushes the value onto 
the FPU stack. The source operand is loaded without rounding errors. The sign of the source operand is preserved, 
including that of —0. 


The packed BCD digits are assumed to be in the range 0 through 9; the instruction does not check for invalid digits 
(AH through FH). Attempting to load an invalid encoding produces an undefined result. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
TOP := TOP - 1; 
ST(0) := ConvertToDoubleExtendedPrecisionFP(SRC); 


FPU Flags Affected 
C1 Set to 1 if stack overflow occurred; otherwise, set to 0. 
co, C2, C3 Undefined. 


Floating-Point Exceptions 
#1S Stack overflow occurred. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FBSTP—Store BCD Integer and Pop 


Opcode Instruction 64-Bit | Compat/ Description 

Mode Leg Mode 
DF /6 FBSTP m80bcd Valid Valid Store ST(0) in m80bcd and pop ST(0). 
Description 


Converts the value in the ST(O) register to an 18-digit packed BCD integer, stores the result in the destination 
operand, and pops the register stack. If the source value is a non-integral value, it is rounded to an integer value, 
according to rounding mode specified by the RC field of the FPU control word. To pop the register stack, the 
processor marks the ST(0) register as empty and increments the stack pointer (TOP) by 1. 


The destination operand specifies the address where the first byte destination value is to be stored. The BCD value 
(including its sign bit) requires 10 bytes of space in memory. 


The following table shows the results obtained when storing various classes of numbers in packed BCD format. 
Table 3-19. FBSTP Results 


ST(0) DEST 

— oo or Value Too Large for DEST Format * 

F<-1 -D 

-1<F<-0 a 

-0 -0 

+0 +0 

+0<F<+41 os 

F>+1 +D 
+o or Value Too Large for DEST Format * 
NaN ; 


NOTES: 

F Means finite floating-point value. 

D Means packed-BCD number. 

* Indicates floating-point invalid-operation (#IA) exception. 
** +0 or +1, depending on the rounding mode. 


If the converted value is too large for the destination format, or if the source operand is an «©, SNaN, QNAN, or is in 
an unsupported format, an invalid-arithmetic-operand condition is signaled. If the invalid-operation exception is 
not masked, an invalid-arithmetic-operand exception (#IA) is generated and no value is stored in the destination 
operand. If the invalid-operation exception is masked, the packed BCD indefinite value is stored in memory. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 


DEST := BCD(ST(0)); 
PopRegisterStack; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
co, C2, C3 Undefined. 


3-354 Vol. 2A FBSTP—Store BCD Integer and Pop 


INSTRUCTION SET REFERENCE, A-L 


Floating-Point Exceptions 


#1S Stack underflow occurred. 
#IA Converted value that exceeds 18 BCD digits in length. 

Source operand is an SNaN, QNaN, +2, or in an unsupported format. 
#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#GP(0) If a segment register is being loaded with a segment selector that points to a non-writable 
segment. 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FCHS—Change Sign 


Opcode Instruction 64-Bit | Compat/ Description 

Mode Leg Mode 
DS EO FCHS Valid Valid Complements sign of ST(0). 
Description 


Complements the sign bit of ST(0). This operation changes a positive value into a negative value of equal magni- 
tude or vice versa. The following table shows the results obtained when changing the sign of various classes of 
numbers. 


Table 3-20. FCHS Results 


ST(0) SRC ST(0) DEST 
Sey +00 
—F +F 
-0 +0 
+0 -0 
+F —F 
ee —oo 
NaN NaN 


NOTES: 
* F means finite floating-point value. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 
SignBit(ST(0)) := NOT (SignBit(ST(O))); 


FPU Flags Affected 
C1 Set to 0. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 
#I1S Stack underflow occurred. 


Protected Mode Exceptions 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FCLEX/FNCLEX—Clear Exceptions 


Opcode* Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
9B DB E2 FCLEX Valid Valid Clear floating-point exception flags after checking for 
pending unmasked floating-point exceptions. 
DB E2 FNCLEX” Valid Valid Clear floating-point exception flags without checking for 
pending unmasked floating-point exceptions. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Description 


Clears the floating-point exception flags (PE, UE, OE, ZE, DE, and IE), the exception summary status flag (ES), the 
stack fault flag (SF), and the busy flag (B) in the FPU status word. The FCLEX instruction checks for and handles 
any pending unmasked floating-point exceptions before clearing the exception flags; the FNCLEX instruction does 
not. 


The assembler issues two instructions for the FCLEX instruction (an FWAIT instruction followed by an FNCLEX 
instruction), and the processor executes each of these instructions separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


IA-32 Architecture Compatibility 


When operating a Pentium or Intel486 processor in MS-DOS* compatibility mode, it is possible (under unusual 
circumstances) for an FNCLEX instruction to be interrupted prior to being executed to handle a pending FPU excep- 
tion. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circumstances. An 
FNCLEX instruction cannot be interrupted in this way on later Intel processors, except for the Intel Quark™ X1000 
processor. 


This instruction affects only the x87 FPU floating-point exception flags. It does not affect the SIMD floating-point 
exception flags in the MXCSR register. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


FPUStatusWord[0:7] := 0; 
FPUStatusWord[1 5] := 0; 


FPU Flags Affected 


The PE, UE, OE, ZE, DE, IE, ES, SF, and B flags in the FPU status word are cleared. The CO, C1, C2, and C3 flags are 
undefined. 


Floating-Point Exceptions 
None 


Protected Mode Exceptions 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FCMOVcc—Floating-Point Conditional Move 


Opcode* Instruction 64-Bit |Compat/ |Description 
Mode Leg Mode* 
DA CO+i FCMOVB ST(0), ST(i) Valid Valid Move if below (CF=1). 
DA C8+i FCMOVE ST(0), ST(i) Valid Valid Move if equal (ZF=1). 
DA DO+i FCMOVBE ST(0), ST(i) Valid Valid Move if below or equal (CF=1 or ZF=1). 
DA D8+i FCMOVU ST(0), ST(i) Valid Valid Move if unordered (PF=1). 
DB CO+i FCMOVNB ST(0), ST(i) Valid Valid Move if not below (CF=0). 
DB C8+i FCMOVNE ST(0), ST(i) Valid Valid Move if not equal (ZF=0). 
DB DO+i FCMOVNBE ST(0), ST(i) Valid Valid Move if not below or equal (CF=0 and ZF=0). 
DB D8+i FCMOVNU ST(0), ST(i) Valid Valid Move if not unordered (PF=0). 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Description 


Tests the status flags in the EFLAGS register and moves the source operand (second operand) to the destination 
operand (first operand) if the given test condition is true. The condition for each mnemonic os given in the Descrip- 
tion column above and in Chapter 8 in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1. The source operand is always in the ST(i) register and the destination operand is always ST(0). 


The FCMOVcc instructions are useful for optimizing small IF constructions. They also help eliminate branching over- 
head for IF operations and the possibility of branch mispredictions by the processor. 


A processor may not support the FCMOVcc instructions. Software can check if the FCMOVcc instructions are 
supported by checking the processor’s feature information with the CPUID instruction (see “COMISS—Compare 
Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS” in this chapter). If both the CMOV and FPU 
feature bits are set, the FCMOVcc instructions are supported. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 
The FCMOVcc instructions were introduced to the IA-32 Architecture in the P6 family processors and are not avail- 
able in earlier IA-32 processors. 


Operation 


IF condition TRUE 
THEN ST(O) := ST(i); 
Fl; 


FPU Flags Affected 
C1 Set to 0 if stack underflow occurred. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 
#IS Stack underflow occurred. 


Integer Flags Affected 
None. 
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Protected Mode Exceptions 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


FCMOVcc—Floating-Point Conditional Move 


INSTRUCTION SET REFERENCE, A-L 


Vol.2A 3-361 


INSTRUCTION SET REFERENCE, A-L 


FCOM/FCOMP/FCOMPP—Compare Floating Point Values 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 

D8 /2 FCOM m32fp Valid Valid Compare ST(0) with m32fp. 

DC /2 FCOM m64fp Valid Valid Compare ST(0) with m64fp. 

D8 DO+i FCOM ST(i) Valid Valid Compare ST(0) with ST(i). 

D8 D1 FCOM Valid Valid Compare ST(0) with ST(1). 

D8 /3 FCOMP m32fp Valid Valid Compare ST(0) with m32fp and pop register stack. 
DC /3 FCOMP m64fp Valid Valid Compare ST(0) with m64fp and pop register stack. 
D8 D8+i FCOMP ST(i) Valid Valid Compare ST(0) with ST(i) and pop register stack. 
D8 D9 FCOMP Valid Valid Compare ST(0) with ST(1) and pop register stack. 
DE D9 FCOMPP Valid Valid Compare ST(0) with ST(1) and pop register stack 

twice. 

Description 


Compares the contents of register ST(0) and source value and sets condition code flags CO, C2, and C3 in the FPU 
status word according to the results (see the table below). The source operand can be a data register or a memory 
location. If no source operand is given, the value in ST(O) is compared with the value in ST(1). The sign of zero is 
ignored, so that -0.0 is equal to +0.0. 


Table 3-21. FCOM/FCOMP/FCOMPP Results 


Condition c3 C2 co 
ST(O) > SRC 0 0 0 
ST(O) < SRC 0 0 1 
ST(O) = SRC 1 0 0 
Unordered* 1 1 1 


NOTES: 
* Flags not set if unmasked invalid-arithmetic-operand (#IA) exception is generated. 


This instruction checks the class of the numbers being compared (see “FXAM—Examine Floating-Point” in this 
chapter). If either operand is a NaN or is in an unsupported format, an invalid-arithmetic-operand exception (#IA) 
is raised and, if the exception is masked, the condition flags are set to “unordered.” If the invalid-arithmetic- 
operand exception is unmasked, the condition code flags are not set. 


The FCOMP instruction pops the register stack following the comparison operation and the FCOMPP instruction pops 
the register stack twice following the comparison operation. To pop the register stack, the processor marks the 
ST(0) register as empty and increments the stack pointer (TOP) by 1. 


The FCOM instructions perform the same operation as the FUCOM instructions. The only difference is how they 
handle QNaN operands. The FCOM instructions raise an invalid-arithmetic-operand exception (#IA) when either or 
both of the operands is a NaN value or is in an unsupported format. The FUCOM instructions perform the same 
operation as the FCOM instructions, except that they do not generate an invalid-arithmetic-operand exception for 
QNaNs. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
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Operation 
CASE (relation of operands) OF 
ST > SRC: C3, C2, CO := 000; 
ST < SRC: C3, C2, CO := 001; 
ST = SRC: C3, C2, CO := 100; 
ESAC; 
IF ST(O) or SRC = NaN or unsupported format 
THEN 
#IA 
IF FPUControlWord.IM = 1 
THEN 
C3, C2, CO := 111; 
Fl; 
Fl; 
IF Instruction = FCOMP 
THEN 
PopRegisterStack; 
Fl; 
IF Instruction = FCOMPP 
THEN 
PopRegisterStack; 
PopRegisterStack; 


Fl; 


FPU Flags Affected 
C1 Set to 0. 
Co, C2, C3 See table on previous page. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 

#IA One or both operands are NaN values or have unsupported formats. 
Register is marked empty. 

#D One or both operands are denormal values. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FCOMI/FCOMIP/FUCOMI/FUCOMIP—Compare Floating Point Values and Set EFLAGS 


Opcode Instruction 64-Bit |Compat/ |Description 
Mode Leg Mode 

DB FO+i FCOMI ST, ST(i) Valid Valid Compare ST(0) with ST(i) and set status flags accordingly. 

DF FO+i FCOMIP ST, ST(i) Valid Valid Compare ST(0) with ST(i), set status flags accordingly, and 
pop register stack. 

DB E8+i FUCOMI ST, ST(i) Valid Valid Compare ST(0) with ST(i), check for ordered values, and set 
status flags accordingly. 

DF E8+i FUCOMIP ST, ST(i) Valid Valid Compare ST(0) with ST(i), check for ordered values, set 
status flags accordingly, and pop register stack. 


Description 


Performs an unordered comparison of the contents of registers ST(0) and ST(i) and sets the status flags ZF, PF, and 
CF in the EFLAGS register according to the results (see the table below). The sign of zero is ignored for compari- 
sons, so that -0.0 is equal to +0.0. 


Table 3-22. FCOMI/FCOMIP/ FUCOMI/FUCOMIP Results 


Comparison Results* ZF PF CF 
STO > ST(i) 0 0 0 
STO < ST(i) 0 0 1 
STO = ST(i) 1 0 0 
Unordered** 1 1 1 


NOTES: 
* See the IA-32 Architecture Compatibility section below. 
** Flags not set if unmasked invalid-arithmetic-operand (#1A) exception is generated. 


An unordered comparison checks the class of the numbers being compared (see “FXAM—Examine Floating-Point” 
in this chapter). The FUCOMI/FUCOMIP instructions perform the same operations as the FCOMI/FCOMIP instruc- 

tions. The only difference is that the FUCOMI/FUCOMIP instructions raise the invalid-arithmetic-operand exception 
(#IA) only when either or both operands are an SNaN or are in an unsupported format; QNaNs cause the condition 
code flags to be set to unordered, but do not cause an exception to be generated. The FCOMI/FCOMIP instructions 
raise an invalid-operation exception when either or both of the operands are a NaN value of any kind or are in an 

unsupported format. 


If the operation results in an invalid-arithmetic-operand exception being raised, the status flags in the EFLAGS 
register are set only if the exception is masked. 


The FCOMI/FCOMIP and FUCOMI/FUCOMIP instructions set the OF, SF and AF flags to zero in the EFLAGS register 
(regardless of whether an invalid-operation exception is detected). 


The FCOMIP and FUCOMIP instructions also pop the register stack following the comparison operation. To pop the 
register stack, the processor marks the ST(Q) register as empty and increments the stack pointer (TOP) by 1. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


The FCOMI/FCOMIP/FUCOMI/FUCOMIP instructions were introduced to the IA-32 Architecture in the P6 family 
processors and are not available in earlier IA-32 processors. 
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Operation 


CASE (relation of operands) OF 
ST(0) > ST(i): ZF, PF, CF := 000; 
ST(0) < ST(i): ZF, PF, CF := 001; 
ST(0) = ST(i): ZF, PF, CF := 100; 


ESAC; 
IF Instruction is FCOMI or FCOMIP 
THEN 
IF ST(O) or ST(i) = NaN or unsupported format 
THEN 
#IA 
IF FPUControlwWord.IM = 1 
THEN 
ZF, PF, CF := 111; 
Fl; 
Fl; 
Fl; 
IF Instruction is FUCOMI or FUCOMIP 
THEN 
IF ST(O) or ST(i) = QNaN, but not SNaN or unsupported format 
THEN 
ZF, PF, CF := 111; 
ELSE (* ST(0) or ST(i) is SNaN or unsupported format *) 
#IA; 
IF FPUControlword.IM = 1 
THEN 
ZF, PF, CF := 111; 
Fl; 
Fl; 
Fl; 
IF Instruction is FCOMIP or FUCOMIP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 
Cl Set to 0. 
CO, C2, C3 Not affected. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 
#IA (FCOMI or FCOMIP instruction) One or both operands are NaN values or have unsupported 
formats. 


(FUCOMI or FUCOMIP instruction) One or both operands are SNaN values (but not QNaNs) or 
have undefined formats. Detection of a QNaN value does not raise an invalid-operand excep- 
tion. 
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Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FCOS— Cosine 


Opcode Instruction 64-Bit | Compat/ Description 
Mode /|Leg Mode 
D9 FF FCOS Valid Valid Replace ST(O) with its approximate cosine. 
Description 


Computes the approximate cosine of the source operand in register ST(0) and stores the result in ST(0). The 
source operand must be given in radians and must be within the range —2®? to +263. The following table shows the 
results obtained when taking the cosine of various classes of numbers. 


Table 3-23. FCOS Results 


ST(0) SRC ST(0) DEST 
—F —1 to +1 
-0 +1 
+0 +1 
+F —1to+1 
66 ¥ 
NaN NaN 


NOTES: 
F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


If the source operand is outside the acceptable range, the C2 flag in the FPU status word is set, and the value in 
register ST(O) remains unchanged. The instruction does not raise an exception when the source operand is out of 
range. It is up to the program to check the C2 flag for out-of-range conditions. Source values outside the range — 
2®3 to +2©3 can be reduced to the range of the instruction by subtracting an appropriate integer multiple of 2n. 
However, even within the range -2°? to +2°3, inaccurate results can occur because the finite approximation of x 
used internally for argument reduction is not sufficient in all cases. Therefore, for accurate results it is safe to apply 
FCOS only to arguments reduced accurately in software, to a value smaller in absolute value than 3n/8. See the 
sections titled “Approximation of Pi” and “Transcendental Instruction Accuracy” in Chapter 8 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for a discussion of the proper value to use for x in 
performing such reductions. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF |ST(O)| < 263 
THEN 
C2 := 0; 
ST(0) := FCOS(ST(0)); // approximation of cosine 
ELSE (* Source operand is out-of-range *) 
C2 := 1; 
FI; 
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FPU Flags Affected 
C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Undefined if C2 is 1. 
C2 Set to 1 if outside range (-2°? < source operand < +2®); otherwise, set to 0. 
Co, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value, «, or unsupported format. 
#D Source is a denormal value. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


FCOS— Cosine Vol.2A 3-369 


INSTRUCTION SET REFERENCE, A-L 


FDECSTP—Decrement Stack-Top Pointer 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
DS F6 FDECSTP Valid Valid Decrement TOP field in FPU status word. 
Description 


Subtracts one from the TOP field of the FPU status word (decrements the top-of-stack pointer). If the TOP field 
contains a 0, it is set to 7. The effect of this instruction is to rotate the stack by one position. The contents of the 


FPU data registers and tag register are not affected. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
IF TOP=0 

THEN TOP := 7; 

ELSE TOP := TOP - 1; 
Fl; 


FPU Flags Affected 
The Ci flag is set to 0. The CO, C2, and C3 flags are undefined. 


Floating-Point Exceptions 
None. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FDIV/FDIVP/FIDIV—Divide 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
D8 /6 FDIV m32fp Valid Valid Divide ST(O) by m32fp and store result in ST(0). 
DC /6 FDIV m64fp Valid Valid Divide ST(O) by m64fp and store result in ST(0). 
D8 FO+i FDIV ST(O), ST(i) Valid Valid Divide ST(O) by ST(i) and store result in ST(0). 
DC F8+i FDIV ST(i), ST(O) Valid Valid Divide ST(i) by ST(0) and store result in ST(i). 
DE F8+i FDIVP ST(i), ST(O) Valid Valid Divide ST(i) by ST(0), store result in ST(i), and pop the 
register stack. 
DE F9 FDIVP Valid Valid Divide ST(1) by ST(0), store result in ST(1), and pop 
the register stack. 
DA /6 FIDIV m32int Valid Valid Divide ST(0) by m32int and store result in ST(O). 
DE /6 FIDIV m16int Valid Valid Divide ST(0) by m76int and store result in ST(O). 
Description 


Divides the destination operand by the source operand and stores the result in the destination location. The desti- 
nation operand (dividend) is always in an FPU register; the source operand (divisor) can be a register or a memory 
location. Source operands in memory can be in single-precision or double-precision floating-point format, word or 
doubleword integer format. 


The no-operand version of the instruction divides the contents of the ST(1) register by the contents of the ST(0) 
register. The one-operand version divides the contents of the ST(0) register by the contents of a memory location 
(either a floating-point or an integer value). The two-operand version, divides the contents of the ST(0) register by 
the contents of the ST(i) register or vice versa. 


The FDIVP instructions perform the additional operation of popping the FPU register stack after storing the result. 
To pop the register stack, the processor marks the ST(O) register as empty and increments the stack pointer (TOP) 
by 1. The no-operand version of the floating-point divide instructions always results in the register stack being 
popped. In some assemblers, the mnemonic for this instruction is FDIV rather than FDIVP. 


The FIDIV instructions convert an integer source operand to double extended-precision floating-point format 
before performing the division. When the source operand is an integer 0, it is treated as a +0. 


If an unmasked divide-by-zero exception (#Z) is generated, no result is stored; if the exception is masked, an ~ of 
the appropriate sign is stored in the destination operand. 


The following table shows the results obtained when dividing various classes of numbers, assuming that neither 
overflow nor underflow occurs. 
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Table 3-24. FDIV/FDIVP/FIDIV Results 
DEST 


SRC 


NOTES: 

F Means finite floating-point value. 

| Means integer. 

* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 
** Indicates floating-point zero-divide (#Z) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF SRC=0 
THEN 
#Z; 
ELSE 
IF Instruction is FIDIV 
THEN 
DEST := DEST / ConvertToDoubleExtendedPrecisionFP(SRC); 
ELSE (* Source operand is floating-point value *) 
DEST := DEST / SRC; 


Fi; 
Fl; 
IF Instruction = FDIVP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 


Cl Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 
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Floating-Point Exceptions 


#1S Stack underflow occurred. 
#IA Operand is an SNaN value or unsupported format. 
too / too; +0 / +0 
#D Source is a denormal value. 
#Z DEST / +0, where DEST is not equal to +0. 
#U Result is too small for destination format. 
#0 Result is too large for destination format. 
#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FDIVR/FDIVRP/FIDIVR—Reverse Divide 


Opcode Instruction 64-Bit | Compat/ Description 
Mode _ /|Leg Mode 

D8 /7 FDIVR m32fp Valid Valid Divide m32fp by ST(0) and store result in ST(0). 

DC /7 FDIVR m64fp Valid Valid Divide m64fp by ST(0) and store result in ST(0). 

D8 F8+i FDIVR ST(0), ST(i) Valid Valid Divide ST(i) by ST(O) and store result in ST(0). 

DC FO+i FDIVR ST(i), ST(O) Valid Valid Divide ST(O) by ST(i) and store result in ST(i). 

DE FO+i FDIVRP ST(i), ST(O) Valid Valid Divide ST(O) by ST(i), store result in ST(i), and pop the 
register stack. 

DE F1 FDIVRP Valid Valid Divide ST(0) by ST(1), store result in ST(1), and pop the 
register stack. 

DA /7 FIDIVR m32int Valid Valid Divide m32int by ST(O) and store result in ST(O). 

DE /7 FIDIVR m76int Valid Valid Divide m16int by ST(O) and store result in ST(O). 

Description 


Divides the source operand by the destination operand and stores the result in the destination location. The desti- 
nation operand (divisor) is always in an FPU register; the source operand (dividend) can be a register or a memory 
location. Source operands in memory can be in single-precision or double-precision floating-point format, word or 
doubleword integer format. 


These instructions perform the reverse operations of the FDIV, FDIVP, and FIDIV instructions. They are provided to 
support more efficient coding. 


The no-operand version of the instruction divides the contents of the ST(0) register by the contents of the ST(1) 
register. The one-operand version divides the contents of a memory location (either a floating-point or an integer 
value) by the contents of the ST(0) register. The two-operand version, divides the contents of the ST(i) register by 
the contents of the ST(0) register or vice versa. 


The FDIVRP instructions perform the additional operation of popping the FPU register stack after storing the result. 
To pop the register stack, the processor marks the ST(0) register as empty and increments the stack pointer (TOP) 
by 1. The no-operand version of the floating-point divide instructions always results in the register stack being 
popped. In some assemblers, the mnemonic for this instruction is FDIVR rather than FDIVRP. 


The FIDIVR instructions convert an integer source operand to double extended-precision floating-point format 
before performing the division. 


If an unmasked divide-by-zero exception (#Z) is generated, no result is stored; if the exception is masked, an ~ of 
the appropriate sign is stored in the destination operand. 


The following table shows the results obtained when dividing various classes of numbers, assuming that neither 
overflow nor underflow occurs. 
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Table 3-25. FDIVR/FDIVRP/FIDIVR Results 
DEST 


SRC 


NOTES: 

F Means finite floating-point value. 

| Means integer. 

* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 
** Indicates floating-point zero-divide (#Z) exception. 


When the source operand is an integer 0, it is treated as a +0. This instruction’s operation is the same in non-64- 
bit modes and 64-bit mode. 


Operation 


IF DEST = 0 
THEN 
#Z; 
ELSE 
IF Instruction = FIDIVR 
THEN 
DEST := ConvertToDoubleExtendedPrecisionFP(SRC) / DEST; 
ELSE (* Source operand is floating-point value *) 
DEST := SRC / DEST; 


Fl; 
Fl; 
IF Instruction = FDIVRP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 


Cl Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 
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Floating-Point Exceptions 


#IS Stack underflow occurred. 
#IA Operand is an SNaN value or unsupported format. 
too / +00; +0 / +0 
#D Source is a denormal value. 
#Z SRC / +0, where SRC is not equal to +0. 
#U Result is too small for destination format. 
#0 Result is too large for destination format. 
#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Opcode Instruction 64-Bit Compat/ Description 

Mode Leg Mode 
DD CO+i FFREE ST(i) Valid Valid Sets tag for ST(i) to empty. 
Description 


Sets the tag in the FPU tag register associated with register ST(i) to empty (11B). The contents of ST(i) and the 


FPU stack-top pointer (TOP) are not affected. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


TAG(i) := 11B; 


FPU Flags Affected 
CO, Ci, C2, C3 undefined. 


Floating-Point Exceptions 
None 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FICOM/FICOMP—Compare Integer 


Opcode Instruction 64-Bit Compat/ | Description 
Mode Leg Mode 
DE /2 FICOM m16int Valid Valid Compare ST(0) with m7 6int. 
DA /2 FICOM m32int Valid Valid Compare ST(0) with m32int. 
DE /3 FICOMP m176int Valid Valid Compare ST(0) with m76int and pop stack register. 
DA /3 FICOMP m32int Valid Valid Compare ST(0) with m32int and pop stack register. 
Description 


Compares the value in ST(0) with an integer source operand and sets the condition code flags CO, C2, and C3 in the 
FPU status word according to the results (see table below). The integer value is converted to double extended- 
precision floating-point format before the comparison is made. 


Table 3-26. FICOM/FICOMP Results 


Condition C3 C2 co 
ST(0) > SRC 0 0 0 
ST(O) < SRC 0 0 1 
ST(O) = SRC 1 0 0 
Unordered 1 1 1 


These instructions perform an “unordered comparison.” An unordered comparison also checks the class of the 
numbers being compared (see “FXAM—Examine Floating-Point” in this chapter). If either operand is a NaN or is in 
an undefined format, the condition flags are set to “unordered.” 


The sign of zero is ignored, so that -0.0 := +0.0. 


The FICOMP instructions pop the register stack following the comparison. To pop the register stack, the processor 
marks the ST(0) register empty and increments the stack pointer (TOP) by 1. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
CASE (relation of operands) OF 
ST(0) > SRC: C3, C2, CO := 000; 
ST(0) < SRC: C3, C2, CO := 001; 
ST(0) = SRC: C3, C2, CO := 100; 
Unordered: C3, C2, CO := 111; 
ESAC; 
IF Instruction = FICOMP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 
C1 Set to 0. 
Co, C2, C3 See table on previous page. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 
#IA One or both operands are NaN values or have unsupported formats. 
#D One or both operands are denormal values. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FILD—Load Integer 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
DF /O FILD m16int Valid Valid Push m76int onto the FPU register stack. 
DB /O FILD m32int Valid Valid Push m3Z2int onto the FPU register stack. 
DF /5 FILD m64int Valid Valid Push m64int onto the FPU register stack. 
Description 


Converts the signed-integer source operand into double extended-precision floating-point format and pushes the 
value onto the FPU register stack. The source operand can be a word, doubleword, or quadword integer. It is loaded 
without rounding errors. The sign of the source operand is preserved. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 

TOP := TOP — 1; 

ST(O) := ConvertToDoubleExtendedPrecisionFP(SRC); 


FPU Flags Affected 
C1 Set to 1 if stack overflow occurred; set to 0 otherwise. 
CO, C2, C3 Undefined. 


Floating-Point Exceptions 
#IS Stack overflow occurred. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FINCSTP—Increment Stack-Top Pointer 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 F7 FINCSTP Valid Valid Increment the TOP field in the FPU status register. 
Description 


Adds one to the TOP field of the FPU status word (increments the top-of-stack pointer). If the TOP field contains a 
7, itis set to 0. The effect of this instruction is to rotate the stack by one position. The contents of the FPU data 
registers and tag register are not affected. This operation is not equivalent to popping the stack, because the tag 


for the previous top-of-stack register is not marked empty. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
IF TOP =7 

THEN TOP := 0; 

ELSE TOP := TOP + 1; 
Fl; 


FPU Flags Affected 


The Ci flag is set to 0. The CO, C2, and C3 flags are undefined. 


Floating-Point Exceptions 
None 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FINIT/FNINIT—Initialize Floating-Point Unit 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
9B DB E3 FINIT Valid Valid Initialize FPU after checking for pending unmasked 
floating-point exceptions. 
DB E3 FNINIT. Valid Valid Initialize FPU without checking for pending unmasked 
floating-point exceptions. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Description 


Sets the FPU control, status, tag, instruction pointer, and data pointer registers to their default states. The FPU 
control word is set to 037FH (round to nearest, all exceptions masked, 64-bit precision). The status word is cleared 
(no exception flags set, TOP is set to 0). The data registers in the register stack are left unchanged, but they are all 
tagged as empty (11B). Both the instruction and data pointers are cleared. 


The FINIT instruction checks for and handles any pending unmasked floating-point exceptions before performing 
the initialization; the FNINIT instruction does not. 


The assembler issues two instructions for the FINIT instruction (an FWAIT instruction followed by an FNINIT 
instruction), and the processor executes each of these instructions in separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


When operating a Pentium or Intel486 processor in MS-DOS compatibility mode, it is possible (under unusual 
circumstances) for an FNINIT instruction to be interrupted prior to being executed to handle a pending FPU excep- 
tion. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circumstances. An 
FNINIT instruction cannot be interrupted in this way on later Intel processors, except for the Intel Quark™ X1000 
processor. 


In the Intel387 math coprocessor, the FINIT/FNINIT instruction does not clear the instruction and data pointers. 
This instruction affects only the x87 FPU. It does not affect the XMM and MXCSR registers. 


Operation 


FPUControlWord := 037FH; 
FPUStatusWord := 0; 
FPUTagWord := FFFFH; 
FPUDataPointer := 0; 
FPUInstructionPointer := 0; 
FPULastinstructionOpcode := 0; 


FPU Flags Affected 
CO, C1, C2, C3 set to 0. 


Floating-Point Exceptions 
None 
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Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FIST/FISTP—Store Integer 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 

DF /2 FIST m17Gint Valid Valid Store ST(O) in m76int. 

DB /2 FIST m32int Valid Valid Store ST(O) in m32int. 

DF /3 FISTP m16int Valid Valid Store ST(O) in m76int and pop register stack. 
DB /3 FISTP m32int Valid Valid Store ST(O) in m32int and pop register stack. 
DF /7 FISTP m64int Valid Valid Store ST(O) in m64int and pop register stack. 
Description 


The FIST instruction converts the value in the ST(0) register to a signed integer and stores the result in the desti- 
nation operand. Values can be stored in word or doubleword integer format. The destination operand specifies the 
address where the first byte of the destination value is to be stored. 


The FISTP instruction performs the same operation as the FIST instruction and then pops the register stack. To pop 
the register stack, the processor marks the ST(0) register as empty and increments the stack pointer (TOP) by 1. 
The FISTP instruction also stores values in quadword integer format. 


The following table shows the results obtained when storing various classes of numbers in integer format. 
Table 3-27. FIST/FISTP Results 


ST(0) DEST 
— oo or Value Too Large for DEST Format > 
F<-l - 
-1<F<-0 i 
-0 0 
+0 0 
+0<F<+1 ee 
F>+1 +] 
+o or Value Too Large for DEST Format 
NaN * 


NOTES: 

F Means finite floating-point value. 

| Means integer. 

* Indicates floating-point invalid-operation (#IA) exception. 
** 0 or +1, depending on the rounding mode. 


If the source value is a non-integral value, it is rounded to an integer value, according to the rounding mode spec- 
ified by the RC field of the FPU control word. 


If the converted value is too large for the destination format, or if the source operand is an ~, SNaN, QNAN, or is in 
an unsupported format, an invalid-arithmetic-operand condition is signaled. If the invalid-operation exception is 
not masked, an invalid-arithmetic-operand exception (#IA) is generated and no value is stored in the destination 
operand. If the invalid-operation exception is masked, the integer indefinite value is stored in memory. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
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Operation 
DEST := Integer(ST(0)); 


IF Instruction = FISTP 
THEN 
PopRegisterStack; 
Fl; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Indicates rounding direction of if the inexact exception (#P) is generated: 0:= not roundup; 1 
= roundup. 
Set to 0 otherwise. 

Co, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 
#IA Converted value is too large for the destination format. 

Source operand is an SNaN, QNaN, +2, or unsupported format. 
#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FISTTP—Store Integer with Truncation 


Opcode Instruction 64-Bit Mode | Compat/ Description 

Leg Mode 
DF /1 FISTTP m16int Valid Valid Store ST(O) in m16int with truncation. 
DB /1 FISTTP m32int Valid Valid Store ST(O) in m32int with truncation. 
DD/1 FISTTP m64int Valid Valid Store ST(O) in m64int with truncation. 
Description 


FISTTP converts the value in ST into a signed integer using truncation (chop) as rounding mode, transfers the 
result to the destination, and pop ST. FISTTP accepts word, short integer, and long integer destinations. 


The following table shows the results obtained when storing various classes of numbers in integer format. 


Table 3-28. FISTTP Results 


ST(0) DEST 

—co or Value Too Large for DEST Format * 
F< -] | 
-1<F<+1 0 
FS+1 +| 
+eo or Value Too Large for DEST Format ? 
NaN - 
NOTES: 


F Means finite floating-point value. 
I Means integer. 
* Indicates floating-point invalid-operation (#1A) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
DEST := ST; 
pop ST; 


Flags Affected 
C1 is cleared; CO, C2, C3 undefined. 


Numeric Exceptions 
Invalid, Stack Invalid (stack underflow), Precision. 


Protected Mode Exceptions 


#GP(0) If the destination is in a nonwritable segment. 
For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 
#PF(fault-code) For a page fault. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#NM If CRO.EM[bit 2] = 1. 
If CRO.TS[bit 3] = 1. 
#UD If CPUID.O1H:ECX.SSE3[bit 0] = 0. 
If the LOCK prefix is used. 
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Real Address Mode Exceptions 


GP(0) If any part of the operand would lie outside of the effective address space from 0 to OFFFFH. 
#NM If CRO.EM[bit 2] = 1. 

If CRO.TS[bit 3] = 1. 
#UD If CPUID.01H:ECX.SSE3[bit 0] = 0. 


If the LOCK prefix is used. 


Virtual 8086 Mode Exceptions 


GP(0) If any part of the operand would lie outside of the effective address space from 0 to OFFFFH. 
#NM If CRO.EM[bit 2] = 1. 

If CRO.TS[bit 3] = 1. 
#UD If CPUID.01H:ECX.SSE3[bit 0] = 0. 


If the LOCK prefix is used. 
#PF(fault-code) For a page fault. 
#AC(0) For unaligned memory reference if the current privilege is 3. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 
If the LOCK prefix is used. 


FISTTP—Store Integer with Truncation Vol.2A 3-389 


INSTRUCTION SET REFERENCE, A-L 


FLD—Load Floating Point Value 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
DS /O FLD m32fp Valid Valid Push m32fp onto the FPU register stack. 
DD /O FLD m64fp Valid Valid Push m64fp onto the FPU register stack. 
DB /5 FLD m8Ofp Valid Valid Push m80fp onto the FPU register stack. 
D9 CO+i FLD ST(i) Valid Valid Push ST(i) onto the FPU register stack. 
Description 


Pushes the source operand onto the FPU register stack. The source operand can be in single-precision, double- 
precision, or double extended-precision floating-point format. If the source operand is in single-precision or 
double-precision floating-point format, it is automatically converted to the double extended-precision floating- 
point format before being pushed on the stack. 

The FLD instruction can also push the value in a selected FPU register [ST(i)] onto the stack. Here, pushing register 
ST(0) duplicates the stack top. 


NOTE 


When the FLD instruction loads a denormal value and the DM bit in the CW is not masked, an 
exception is flagged but the value is still pushed onto the x87 stack. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF SRC is ST(i) 
THEN 
temp := ST(i); 
FI; 


TOP := TOP — 1; 


IF SRC is memory-operand 
THEN 
ST(0) := ConvertToDoubleExtendedPrecisionFP(SRC); 
ELSE (* SRC is ST(i) *) 
ST(O) := temp; 
FI; 


FPU Flags Affected 
C1 Set to 1 if stack overflow occurred; otherwise, set to 0. 
CO, C2, C3 Undefined. 


Floating-Point Exceptions 


#IS Stack underflow or overflow occurred. 

#IA Source operand is an SNaN. Does not occur if the source operand is in double extended-preci- 
sion floating-point format (FLD m8Ofp or FLD ST(i)). 

#D Source operand is a denormal value. Does not occur if the source operand is in double 


extended-precision floating-point format. 
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Protected Mode Exceptions 

#GP(0) If destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FLD1/FLDL2T/FLDL2E/FLDPI/FLDLG2/FLDLN2/FLDZ—Load Constant 


Opcode* Instruction 64-Bit | Compat/ Description 

Mode /|Leg Mode 
DI E8 FLD1 Valid Valid Push +1.0 onto the FPU register stack. 
DIS EO FLDL2T Valid Valid Push logz10 onto the FPU register stack. 
DI EA FLDL2E Valid Valid Push logze onto the FPU register stack. 
DS EB FLDPI Valid Valid Push z onto the FPU register stack. 
D9 EC FLDLG2 Valid Valid Push log; 92 onto the FPU register stack. 
DS ED FLDLN2 Valid Valid Push loga2 onto the FPU register stack. 
DS EE FLDZ Valid Valid Push +0.0 onto the FPU register stack. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Description 


Push one of seven commonly used constants (in double extended-precision floating-point format) onto the FPU 
register stack. The constants that can be loaded with these instructions include +1.0, +0.0, log310, logze, 2, logy92, 
and log.2. For each constant, an internal 66-bit constant is rounded (as specified by the RC field in the FPU control 
word) to double extended-precision floating-point format. The inexact-result exception (#P) is not generated as a 
result of the rounding, nor is the C1 flag set in the x87 FPU status word if the value is rounded up. 


See the section titled “Approximation of Pi” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 1, for a description of the x constant. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


When the RC field is set to round-to-nearest, the FPU produces the same constants that is produced by the Intel 
8087 and Intel 287 math coprocessors. 


Operation 
TOP := TOP — 1; 
ST(0) := CONSTANT; 


FPU Flags Affected 
C1 Set to 1 if stack overflow occurred; otherwise, set to 0. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 
#1S Stack overflow occurred. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FLDCW—Load x87 FPU Control Word 


Opcode Instruction 64-Bit | Compat/ Description 
Mode _ | Leg Mode 
D9 /5 FLDCW m2byte Valid Valid Load FPU control word from m2byte. 
Description 


Loads the 16-bit source operand into the FPU control word. The source operand is a memory location. This instruc- 
tion is typically used to establish or change the FPU’s mode of operation. 


If one or more exception flags are set in the FPU status word prior to loading a new FPU control word and the new 
control word unmasks one or more of those exceptions, a floating-point exception will be generated upon execution 
of the next floating-point instruction (except for the no-wait floating-point instructions, see the section titled “Soft- 
ware Exception Handling” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). To avoid raising exceptions when changing FPU operating modes, clear any pending exceptions (using 
the FCLEX or FNCLEX instruction) before loading the new control word. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


FPUControlWord := SRC; 


FPU Flags Affected 
CO, C1, C2, C3 undefined. 


Floating-Point Exceptions 


None; however, this operation might unmask a pending exception in the FPU status word. That exception is then 
generated upon execution of the next “waiting” floating-point instruction. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FLDENV—Load x87 FPU Environment 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
D9 /4 FLDENV m14/28byte Valid Valid Load FPU environment from m14byte or m28byte. 
Description 


Loads the complete x87 FPU operating environment from memory into the FPU registers. The source operand spec- 
ifies the first byte of the operating-environment data in memory. This data is typically written to the specified 
memory location by a FSTENV or FNSTENV instruction. 


The FPU operating environment consists of the FPU control word, status word, tag word, instruction pointer, data 

pointer, and last opcode. Figures 8-9 through 8-12 in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, show the layout in memory of the loaded environment, depending on the operating mode of the 
processor (protected or real) and the current operand-size attribute (16-bit or 32-bit). In virtual-8086 mode, the 
real mode layouts are used. 


The FLDENV instruction should be executed in the same operating mode as the corresponding FSTENV/FNSTENV 
instruction. 


If one or more unmasked exception flags are set in the new FPU status word, a floating-point exception will be 
generated upon execution of the next floating-point instruction (except for the no-wait floating-point instructions, 
see the section titled “Software Exception Handling” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1). To avoid generating exceptions when loading a new environment, clear all 
the exception flags in the FPU status word that is being loaded. 


If a page or limit fault occurs during the execution of this instruction, the state of the x87 FPU registers as seen by 
the fault handler may be different than the state being loaded from memory. In such situations, the fault handler 
should ignore the status of the x87 FPU registers, handle the fault, and return. The FLDENV instruction will then 
complete the loading of the x87 FPU registers with no resulting context inconsistency. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


FPUControlWord := SRC[FPUControlWord]; 

FPUStatusWord := SRC[FPUStatusWord]; 

FPUTagWord := SRC[FPUTagWord]; 

FPUDataPointer := SRC[FPUDataPointer]; 
FPUInstructionPointer := SRC[FPUInstructionPointer]; 
FPULastinstructionOpcode := SRC[FPULastInstructionOpcode]; 


FPU Flags Affected 
The CO, C1, C2, C3 flags are loaded. 


Floating-Point Exceptions 


None; however, if an unmasked exception is loaded in the status word, it is generated upon execution of the next 
“waiting” floating-point instruction. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FMUL/FMULP/FIMUL—Multiply 


Opcode Instruction 64-Bit |Compat/ |Description 
Mode Leg Mode 
D8 /1 FMUL m32fp Valid Valid Multiply ST(0) by m32fp and store result in ST(0). 
DC/1 FMUL m64fp Valid Valid Multiply ST(0) by m64fp and store result in ST(O). 
D8 C8+i FMUL ST(0), ST(i) Valid Valid Multiply ST(O) by ST(i) and store result in ST(0). 
DC C8+i FMUL ST(i), ST(O) Valid Valid Multiply ST(i) by ST(O) and store result in ST(i). 
DE C8+i FMULP ST(i), ST(0) Valid Valid Multiply ST(i) by ST(O), store result in ST(i), and pop the 
register stack. 
DE C9 FMULP Valid Valid Multiply ST(1) by ST(0), store result in ST(1), and pop 
the register stack. 
DA /1 FIMUL m32int Valid Valid Multiply ST(0) by m32int and store result in ST(O). 
DE /1 FIMUL m16int Valid Valid Multiply ST(0) by m76int and store result in ST(O). 
Description 


Multiplies the destination and source operands and stores the product in the destination location. The destination 
operand is always an FPU data register; the source operand can be an FPU data register or a memory location. 
Source operands in memory can be in single-precision or double-precision floating-point format or in word or 
doubleword integer format. 


The no-operand version of the instruction multiplies the contents of the ST(1) register by the contents of the ST(0) 
register and stores the product in the ST(1) register. The one-operand version multiplies the contents of the ST(0) 
register by the contents of a memory location (either a floating point or an integer value) and stores the product in 
the ST(0) register. The two-operand version, multiplies the contents of the ST(0) register by the contents of the 
ST(i) register, or vice versa, with the result being stored in the register specified with the first operand (the desti- 
nation operand). 


The FMULP instructions perform the additional operation of popping the FPU register stack after storing the 
product. To pop the register stack, the processor marks the ST(0) register as empty and increments the stack 
pointer (TOP) by 1. The no-operand version of the floating-point multiply instructions always results in the register 
stack being popped. In some assemblers, the mnemonic for this instruction is FMUL rather than FMULP. 


The FIMUL instructions convert an integer source operand to double extended- 
precision floating-point format before performing the multiplication. 


The sign of the result is always the exclusive-OR of the source signs, even if one or more of the values being multi- 
plied is 0 or «. When the source operand is an integer 0, it is treated as a +0. 


The following table shows the results obtained when multiplying various classes of numbers, assuming that neither 
overflow nor underflow occurs. 
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Table 3-29. FMUL/FMULP/FIMUL Results 
DEST 


SRC 


NOTES: 

F Means finite floating-point value. 

| Means Integer. 

* Indicates invalid-arithmetic-operand (#IA) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF Instruction = FIMUL 
THEN 
DEST := DEST * ConvertToDoubleExtendedPrecisionFP(SRC); 
ELSE (* Source operand is floating-point value *) 
DEST := DEST * SRC; 


Fl; 
IF Instruction = FMULP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 
#IA Operand is an SNaN value or unsupported format. 
One operand is +0 and the other is too, 
#D Source operand is a denormal value. 
#U Result is too small for destination format. 
#0 Result is too large for destination format. 
#P Value cannot be represented exactly in destination format. 
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Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


3-400 Vol. 2A FMUL/FMULP/FIMUL—Multiply 


FNOP—No Operation 


INSTRUCTION SET REFERENCE, A-L 


Opcode Instruction 64-Bit | Compat/ Description 
Mode _ /| Leg Mode 
DS DO FNOP Valid Valid No operation is performed. 
Description 


Performs no FPU operation. This instruction takes up space in the instruction stream but does not affect the FPU or 
machine context, except the EIP register and the FPU Instruction Pointer. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


FPU Flags Affected 
CO, Ci, C2, C3 undefined. 


Floating-Point Exceptions 
None 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


FNOP—No Operation 
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FPATAN—Partial Arctangent 


Opcode* Instruction 64-Bit Compat/ | Description 

Mode Leg Mode 
D9 F3 FPATAN Valid Valid Replace ST(1) with arctan(ST(1)/ST(O)) and pop the register stack. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Description 


Computes the arctangent of the source operand in register ST(1) divided by the source operand in register ST(O), 
stores the result in ST(1), and pops the FPU register stack. The result in register ST(0) has the same sign as the 
source operand ST(1) and a magnitude less than +n. 


The FPATAN instruction returns the angle between the X axis and the line from the origin to the point (X,Y), where 
Y (the ordinate) is ST(1) and X (the abscissa) is ST(0). The angle depends on the sign of X and Y independently, not 
just on the sign of the ratio Y/X. This is because a point (—X,Y) is in the second quadrant, resulting in an angle 
between 2/2 and a, while a point (X,-Y) is in the fourth quadrant, resulting in an angle between 0 and -1/2. A point 
(-X,-Y) is in the third quadrant, giving an angle between —n/2 and —n. 


The following table shows the results obtained when computing the arctangent of various classes of numbers, 
assuming that underflow does not occur. 


Table 3-30. FPATAN Results 


ST(0) 

— 0° -F -0 +0 +F +00 NaN 

— 3n/4* —nl2 —n/l2 —nl2 —n/l2 — n/4* NaN 

ST(1) -p —n to —n/2 —nl2 —nl2 —n/2 to -O -0 NaN 
Pp -?P -p* =" -0 -0 NaN 

*p +p +n" +0* +0 +0 NaN 

+p +n to +n/2 +n/2 +n/2 +n/2 to +0 +0 NaN 

+37/4* +n/2 +n/2 +n/2 +/2 + 1/4* NaN 

NaN NaN NaN NaN NaN NaN NaN 

NOTES: 


F Means finite floating-point value. 


* Table 8-10 in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 1, specifies that the ratios 0/0 and co/co 
generate the floating-point invalid arithmetic-operation exception and, if this exception is masked, the floating-point QNaN indefi- 
nite value is returned. With the FPATAN instruction, the 0/0 or co/co value is actually not calculated using division. Instead, the arc- 
tangent of the two variables is derived from a standard mathematical formulation that is generalized to allow complex numbers as 
arguments. In this complex variable formulation, arctangent(0,0) etc. has well defined values. These values are needed to develop 
a library to compute transcendental functions with complex arguments, based on the FPU functions that only allow floating-point 
values as arguments. 


There is no restriction on the range of source operands that FPATAN can accept. 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


The source operands for this instruction are restricted for the 80287 math coprocessor to the following range: 


0 <|ST(1)| < |ST(0)| < +0 
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Operation 


ST(1) := arctan(ST(1) / ST(0)); 
PopRegisterStack; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
co, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value or unsupported format. 
#D Source operand is a denormal value. 

#U Result is too small for destination format. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FPREM—Partial Remainder 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 F8 FPREM Valid Valid Replace ST(0) with the remainder obtained from dividing 
ST(0) by ST(1). 
Description 


Computes the remainder obtained from dividing the value in the ST(O) register (the dividend) by the value in the 
ST(1) register (the divisor or modulus), and stores the result in ST(0). The remainder represents the following 
value: 


Remainder := ST(0) — (Q * ST(1)) 
Here, Q is an integer value that is obtained by truncating the floating-point number quotient of [ST(0) / ST(1)] 


toward zero. The sign of the remainder is the same as the sign of the dividend. The magnitude of the remainder is 
less than that of the modulus, unless a partial remainder was computed (as described below). 


This instruction produces an exact result; the inexact-result exception does not occur and the rounding control has 
no effect. The following table shows the results obtained when computing the remainder of various classes of 
numbers, assuming that underflow does not occur. 


Table 3-31. FPREM Results 


ST(1) 
~co -F -0 +0 +F too NaN 
* * * * * * NaN 
ST(0) ST(0) -F or -0 id ie -F or -0 ST(0) NaN 
-0 -0 2 7 -0 -0 NaN 
+0 +0 i * +0 +0 NaN 
ST(0) +F or +0 sa = +F or +0 ST(0) NaN 
* * * * * * NaN 
NaN NaN NaN NaN NaN NaN NaN 
NOTES: 


F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 
** Indicates floating-point zero-divide (#Z) exception. 


When the result is 0, its sign is the same as that of the dividend. When the modulus is ~, the result is equal to the 
value in ST(0). 


The FPREM instruction does not compute the remainder specified in IEEE Std 754. The IEEE specified remainder 
can be computed with the FPREM1 instruction. The FPREM instruction is provided for compatibility with the Intel 
8087 and Intel287 math coprocessors. 


The FPREM instruction gets its name “partial remainder” because of the way it computes the remainder. This 
instruction arrives at a remainder through iterative subtraction. It can, however, reduce the exponent of ST(0) by 
no more than 63 in one execution of the instruction. If the instruction succeeds in producing a remainder that is 
less than the modulus, the operation is complete and the C2 flag in the FPU status word is cleared. Otherwise, C2 
is set, and the result in ST(Q) is called the partial remainder. The exponent of the partial remainder will be less 
than the exponent of the original dividend by at least 32. Software can re-execute the instruction (using the partial 
remainder in ST(Q) as the dividend) until C2 is cleared. (Note that while executing such a remainder-computation 
loop, a higher-priority interrupting routine that needs the FPU can force a context switch in-between the instruc- 
tions in the loop.) 


An important use of the FPREM instruction is to reduce the arguments of periodic functions. When reduction is 
complete, the instruction stores the three least-significant bits of the quotient in the C3, C1, and CO flags of the FPU 
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status word. This information is important in argument reduction for the tangent function (using a modulus of 2/4), 
because it locates the original angle in the correct one of eight sectors of the unit circle. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 
D := exponent(ST(0)) - exponent(ST(1)); 


IFD <64 
THEN 
Q := Integer(Truncate TowardZero(ST(0) / ST(1))); 
ST(0) := ST(O) - (ST(1) * Q); 


C2 := 0; 

CO, C3, C1 := LeastSignificantBits(Q); (* Q2, Q1, QO *) 
ELSE 

C2 := 1; 


N := An implementation-dependent number between 32 and 63; 
QQ := Integer(TruncateTowardZero((ST(0) / ST(1)) / 2©-)); 
ST(O) := ST(O) - (ST(1) * QQ * 20-N)); 

Fl; 


FPU Flags Affected 


Co Set to bit 2 (Q2) of the quotient. 

C1 Set to 0 if stack underflow occurred; otherwise, set to least significant bit of quotient (QO). 
C2 Set to 0 if reduction complete; set to 1 if incomplete. 

C3 Set to bit 1 (Q1) of the quotient. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value, modulus is 0, dividend is », or unsupported format. 
#D Source operand is a denormal value. 

#U Result is too small for destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FPREM1—Partial Remainder 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
D9 F5 FPREM1 Valid Valid Replace ST(0) with the IEEE remainder obtained from dividing 
ST(0) by ST(1). 
Description 


Computes the IEEE remainder obtained from dividing the value in the ST(0) register (the dividend) by the value in 
the ST(1) register (the divisor or modulus), and stores the result in ST(0). The remainder represents the following 
value: 


Remainder := ST(0) — (Q * ST(1)) 
Here, Q is an integer value that is obtained by rounding the floating-point number quotient of [ST(O) / ST(1)] 


toward the nearest integer value. The magnitude of the remainder is less than or equal to half the magnitude of the 
modulus, unless a partial remainder was computed (as described below). 


This instruction produces an exact result; the precision (inexact) exception does not occur and the rounding control 
has no effect. The following table shows the results obtained when computing the remainder of various classes of 
numbers, assuming that underflow does not occur. 


Table 3-32. FPREM1 Results 


ST(1) 
— 00 -—F -—0 +0 +F +00 NaN 
* * * * * * NaN 
ST(0) ST(0) +F or -0 i * +F or-0 ST(0) NaN 
-0 —0 . * -0 -0 NaN 
+0 +0 7 * +0 +0 NaN 
ST(0) +For+0 sis = +For+0 ST(0) NaN 
* * * * * * NaN 
NaN NaN NaN NaN NaN NaN NaN 
NOTES: 


F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 
** Indicates floating-point zero-divide (#Z) exception. 


When the result is 0, its sign is the same as that of the dividend. When the modulus is ~, the result is equal to the 
value in ST(0). 


The FPREM1 instruction computes the remainder specified in IEEE Standard 754. This instruction operates differ- 
ently from the FPREM instruction in the way that it rounds the quotient of ST(0) divided by ST(1) to an integer (see 
the “Operation” section below). 


Like the FPREM instruction, FRREM1 computes the remainder through iterative subtraction, but can reduce the 
exponent of ST(0) by no more than 63 in one execution of the instruction. If the instruction succeeds in producing 
a remainder that is less than one half the modulus, the operation is complete and the C2 flag in the FPU status word 
is cleared. Otherwise, C2 is set, and the result in ST(0) is called the partial remainder. The exponent of the partial 
remainder will be less than the exponent of the original dividend by at least 32. Software can re-execute the 
instruction (using the partial remainder in ST(O) as the dividend) until C2 is cleared. (Note that while executing 
such a remainder-computation loop, a higher-priority interrupting routine that needs the FPU can force a context 
switch in-between the instructions in the loop.) 


An important use of the FPREM1 instruction is to reduce the arguments of periodic functions. When reduction is 
complete, the instruction stores the three least-significant bits of the quotient in the C3, Ci, and CO flags of the FPU 
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status word. This information is important in argument reduction for the tangent function (using a modulus of 2/4), 
because it locates the original angle in the correct one of eight sectors of the unit circle. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 
D := exponent(ST(0)) - exponent(ST(1)); 


IFD<64 
THEN 
Q := Integer(RoundTowardNearestinteger(ST(0) / ST(1))); 
ST(0) := ST(O) - (ST(1) * Q); 


C2 := 0; 

CO, C3, C1 := LeastSignificantBits(Q); (* Q2, Q1, QO *) 
ELSE 

C2 := 1; 


N := An implementation-dependent number between 32 and 63; 
QQ := Integer(TruncateTowardZero((ST(0) / ST(1)) /2©-)); 
ST(O) := ST(O) - (ST(1) * QQ * 20-N)); 

Fl; 


FPU Flags Affected 


Co Set to bit 2 (Q2) of the quotient. 

C1 Set to 0 if stack underflow occurred; otherwise, set to least significant bit of quotient (QO). 
C2 Set to 0 if reduction complete; set to 1 if incomplete. 

C3 Set to bit 1 (Q1) of the quotient. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value, modulus (divisor) is 0, dividend is ~, or unsupported 
format. 

#D Source operand is a denormal value. 

#U Result is too small for destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FPTAN—Partial Tangent 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 F2 FPTAN Valid Valid Replace ST(O) with its approximate tangent and push 1 
onto the FPU stack. 


Description 


Computes the approximate tangent of the source operand in register ST(0), stores the result in ST(0), and pushes 
a 1.0 onto the FPU register stack. The source operand must be given in radians and must be less than +2°°. The 
following table shows the unmasked results obtained when computing the partial tangent of various classes of 
numbers, assuming that underflow does not occur. 


Table 3-33. FPTAN Results 


ST(0) SRC ST(0) DEST 
—F —Fto+F 
-—0 -0 
+0 +0 
+F —Fto+F 
ee ¥ 

NaN NaN 


NOTES: 
F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#1A) exception. 


If the source operand is outside the acceptable range, the C2 flag in the FPU status word is set, and the value in 
register ST(0) remains unchanged. The instruction does not raise an exception when the source operand is out of 
range. It is up to the program to check the C2 flag for out-of-range conditions. Source values outside the range — 
263 to +2°3 can be reduced to the range of the instruction by subtracting an appropriate integer multiple of 27. 
However, even within the range -2°? to +2°3, inaccurate results can occur because the finite approximation of x 
used internally for argument reduction is not sufficient in all cases. Therefore, for accurate results it is safe to apply 
FPTAN only to arguments reduced accurately in software, to a value smaller in absolute value than 32/8. See the 
sections titled “Approximation of Pi” and “Transcendental Instruction Accuracy” in Chapter 8 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for a discussion of the proper value to use for x in 
performing such reductions. 


The value 1.0 is pushed onto the register stack after the tangent has been computed to maintain compatibility with 
the Intel 8087 and Intel287 math coprocessors. This operation also simplifies the calculation of other trigonometric 
functions. For instance, the cotangent (which is the reciprocal of the tangent) can be computed by executing a 
FDIVR instruction after the FPTAN instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


3-408 Vol. 2A FPTAN—Partial Tangent 


INSTRUCTION SET REFERENCE, A-L 


Operation 
IF ST(0) < 263 
THEN 
C2 := 0; 
ST(O) := fptan(ST(0)); // approximation of tan 
TOP := TOP - 1; 
ST(0) := 1.0; 
ELSE (* Source operand is out-of-range *) 
C2 := 1; 
FI; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred; set to 1 if stack overflow occurred. 

Set if result was rounded up; cleared otherwise. 
C2 Set to 1 if outside range (-2°? < source operand < +2®); otherwise, set to 0. 
Co, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow or overflow occurred. 

#IA Source operand is an SNaN value, ~, or unsupported format. 
#D Source operand is a denormal value. 

#U Result is too small for destination format. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FRNDINT—Round to Integer 


Opcode Instruction 64-Bit Compat/ Description 

Mode Leg Mode 
DS FC FRNDINT Valid Valid Round ST(0) to an integer. 
Description 


Rounds the source value in the ST(0) register to the nearest integral value, depending on the current rounding 
mode (setting of the RC field of the FPU control word), and stores the result in ST(0). 


If the source value is ~, the value is not changed. If the source value is not an integral value, the floating-point 
inexact-result exception (#P) is generated. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


ST(0) := RoundTolntegralValue(ST(0)); 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value or unsupported format. 
#D Source operand is a denormal value. 

#P Source operand is not an integral value. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FRSTOR—Restore x87 FPU State 


Opcode Instruction 64-Bit Compat/ Description 

Mode Leg Mode 
DD /4 FRSTOR m94/108byte Valid Valid Load FPU state from m94byte or m108byte. 
Description 


Loads the FPU state (operating environment and register stack) from the memory area specified with the source 
operand. This state data is typically written to the specified memory location by a previous FSAVE/FNSAVE instruc- 
tion. 


The FPU operating environment consists of the FPU control word, status word, tag word, instruction pointer, data 
pointer, and last opcode. Figures 8-9 through 8-12 in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, show the layout in memory of the stored environment, depending on the operating mode of the 
processor (protected or real) and the current operand-size attribute (16-bit or 32-bit). In virtual-8086 mode, the 
real mode layouts are used. The contents of the FPU register stack are stored in the 80 bytes immediately following 
the operating environment image. 


The FRSTOR instruction should be executed in the same operating mode as the corresponding FSAVE/FNSAVE 
instruction. 


If one or more unmasked exception bits are set in the new FPU status word, a floating-point exception will be 
generated upon execution of the next floating-point instruction (except for the no-wait floating-point instructions, 
see the section titled “Software Exception Handling” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1). To avoid raising exceptions when loading a new operating environment, clear 
all the exception flags in the FPU status word that is being loaded. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


FPUControlWord := SRC[FPUControlWord]; 

FPUStatusWord := SRC[FPUStatusWord]; 

FPUTagWord := SRC[FPUTagWord]; 

FPUDataPointer := SRC[FPUDataPointer]; 
FPUInstructionPointer := SRC[FPUInstructionPointer]; 
FPULastinstructionOpcode := SRC[FPULastInstructionOpcode]; 


i" 


ST(0) := SRC[ST(O 


" 


(0) ) 
(1) ) 
(2) i 
(3) = SRC[ST(3)]; 
ST(4) = SRC[ST(4)]; 
(5) ) 
(6) ) 
(7) ) 


i" 


" 


i" 


i" 


FPU Flags Affected 
The CO, C1, C2, C3 flags are loaded. 


Floating-Point Exceptions 


None; however, if an unmasked exception is loaded in the status word, it is generated upon execution of the next 
“waiting” floating-point instruction. 
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Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FSAVE/FNSAVE—Store x87 FPU State 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
9B DD /6 FSAVE m94/108byte Valid Valid Store FPU state to m94byte or m108byte after 


checking for pending unmasked floating-point 
exceptions. Then re-initialize the FPU. 


DD /6 FNSAVE m94/ 108byte Valid Valid Store FPU environment to m94byte or m108byte 
without checking for pending unmasked floating- 
point exceptions. Then re-initialize the FPU. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Description 


Stores the current FPU state (operating environment and register stack) at the specified destination in memory, 
and then re-initializes the FPU. The FSAVE instruction checks for and handles pending unmasked floating-point 
exceptions before storing the FPU state; the FNSAVE instruction does not. 


The FPU operating environment consists of the FPU control word, status word, tag word, instruction pointer, data 

pointer, and last opcode. Figures 8-9 through 8-12 in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, show the layout in memory of the stored environment, depending on the operating mode of the 
processor (protected or real) and the current operand-size attribute (16-bit or 32-bit). In virtual-8086 mode, the 
real mode layouts are used. The contents of the FPU register stack are stored in the 80 bytes immediately follow 

the operating environment image. 


The saved image reflects the state of the FPU after all floating-point instructions preceding the FSAVE/FNSAVE 
instruction in the instruction stream have been executed. 


After the FPU state has been saved, the FPU is reset to the same default values it is set to with the FINIT/FNINIT 
instructions (see “FINIT/FNINIT—Initialize Floating-Point Unit” in this chapter). 


The FSAVE/FNSAVE instructions are typically used when the operating system needs to perform a context switch, 
an exception handler needs to use the FPU, or an application program needs to pass a “clean” FPU to a procedure. 


The assembler issues two instructions for the FSAVE instruction (an FWAIT instruction followed by an FNSAVE 
instruction), and the processor executes each of these instructions separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


For Intel math coprocessors and FPUs prior to the Intel Pentium processor, an FWAIT instruction should be 
executed before attempting to read from the memory image stored with a prior FSAVE/FNSAVE instruction. This 
FWAIT instruction helps ensure that the storage operation has been completed. 


When operating a Pentium or Intel486 processor in MS-DOS compatibility mode, it is possible (under unusual 
circumstances) for an FNSAVE instruction to be interrupted prior to being executed to handle a pending FPU excep- 
tion. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circumstances. An 
FNSAVE instruction cannot be interrupted in this way on later Intel processors, except for the Intel Quark™ x1000 
processor. 
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Operation 


(* Save FPU State and Registers *) 


DEST[FPUControlWord] := FPUControlWord; 
DEST[FPUStatusWord] := FPUStatusWord; 

DEST[FPUTagWord] := FPUTagWord; 

DEST[FPUDataPointer] := FPUDataPointer; 
DEST[FPUInstructionPointer] := FPUInstructionPointer; 
DEST[FPULastinstructionOpcode] := FPULastinstructionOpcode; 


DEST[ST(0)] := ST(O); 
DEST[ST(1)] := ST(1); 
DEST[ST(2)] = ST(2); 
DEST[ST(3)] = ST(3); 
DEST[ST(4)]:= ST(4); 
DEST[ST(5)] := ST(5); 
DEST[ST(6)] := ST(6); 
DEST[ST(7)] = ST(7); 


(* Initialize FPU *) 


FPUControlWord := 037FH; 


FPUStatusWord := 0; 


FPUTagWord := FFFFH; 


FPUDataPointer := 0; 


FPUInstructionPointer := 0; 
FPULastinstructionOpcode := 0; 


FPU Flags Affected 


The CO, C1, C2, and C3 flags are saved and then cleared. 


Floating-Point Exceptions 


None. 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 
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If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 
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FSCALE—Scale 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 FD FSCALE Valid Valid Scale ST(0) by ST(1). 
Description 


Truncates the value in the source operand (toward 0) to an integral value and adds that value to the exponent of 
the destination operand. The destination and source operands are floating-point values located in registers ST(0) 
and ST(1), respectively. This instruction provides rapid multiplication or division by integral powers of 2. The 
following table shows the results obtained when scaling various classes of numbers, assuming that neither overflow 
nor underflow occurs. 


Table 3-34. FSCALE Results 


ST(1) 


ST(0) 


NOTES: 
F Means finite floating-point value. 


In most cases, only the exponent is changed and the mantissa (significand) remains unchanged. However, when 
the value being scaled in ST(0) is a denormal value, the mantissa is also changed and the result may turn out to be 
a normalized number. Similarly, if overflow or underflow results from a scale operation, the resulting mantissa will 
differ from the source’s mantissa. 


The FSCALE instruction can also be used to reverse the action of the FXTRACT instruction, as shown in the following 
example: 

FXTRACT; 

FSCALE; 

FSTP ST(1); 


In this example, the FXTRACT instruction extracts the significand and exponent from the value in ST(O) and stores 
them in ST(0) and ST(1) respectively. The FSCALE then scales the significand in ST(0) by the exponent in ST(1), 
recreating the original value before the FXTRACT operation was performed. The FSTP ST(1) instruction overwrites 
the exponent (extracted by the FXTRACT instruction) with the recreated value, which returns the stack to its orig- 
inal state with only one register [ST(0)] occupied. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


ST(0) := ST(O) * 2RoundTowardZero(ST(1)) 


FPU Flags Affected 
C1 Set to 0 if stack underflow occurred. 

Set if result was rounded up; cleared otherwise. 
CO, C2, C3 Undefined. 
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Floating-Point Exceptions 


#1S 
#IA 
#D 
#U 
#0 
#P 


Stack underflow occurred. 

Source operand is an SNaN value or unsupported format. 
Source operand is a denormal value. 

Result is too small for destination format. 

Result is too large for destination format. 


Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM 
#MF 
#UD 


CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If there is a pending x87 FPU exception. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FSIN—Sine 
Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
DS FE FSIN Valid Valid Replace ST(O) with the approximate of its sine. 
Description 


Computes an approximation of the sine of the source operand in register ST(0) and stores the result in ST(0). The 
source operand must be given in radians and must be within the range -2° to +2®°. The following table shows the 
results obtained when taking the sine of various classes of numbers, assuming that underflow does not occur. 


Table 3-35. FSIN Results 


SRC (ST(0)) DEST (ST(0)) 
—F -—1to+1 
_0 -0 
+0 +0 
+F —1to+1 
Sees rs 
NaN NaN 


NOTES: 
F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


If the source operand is outside the acceptable range, the C2 flag in the FPU status word is set, and the value in 
register ST(0) remains unchanged. The instruction does not raise an exception when the source operand is out of 
range. It is up to the program to check the C2 flag for out-of-range conditions. Source values outside the range — 
263 to +2°3 can be reduced to the range of the instruction by subtracting an appropriate integer multiple of 27. 
However, even within the range -2°? to +2°3, inaccurate results can occur because the finite approximation of x 
used internally for argument reduction is not sufficient in all cases. Therefore, for accurate results it is safe to apply 
FSIN only to arguments reduced accurately in software, to a value smaller in absolute value than 3/4. See the 
sections titled “Approximation of Pi” and “Transcendental Instruction Accuracy” in Chapter 8 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for a discussion of the proper value to use for x in 
performing such reductions. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
IF -283 < ST(0) < 263 
THEN 
C2 := 0; 


ST(0) := fsin(ST(0)); // approximation of the mathematical sin function 
ELSE (* Source operand out of range *) 
C2 := 1; 
FI; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 

Set if result was rounded up; cleared otherwise. 
C2 Set to 1 if outside range (-2°7 < source operand < +2®3); otherwise, set to 0. 
Co, C3 Undefined. 
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Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Source operand is an SNaN value, «, or unsupported format. 
#D Source operand is a denormal value. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FSINCOS—Sine and Cosine 


Opcode Instruction 64-Bit | Compat/ Description 
Mode _ {Leg Mode 
DS FB FSINCOS Valid Valid Compute the sine and cosine of ST(0); replace ST(O) with the 


approximate sine, and push the approximate cosine onto the 
register stack. 


Description 


Computes both the approximate sine and the cosine of the source operand in register ST(0), stores the sine in 
ST(0), and pushes the cosine onto the top of the FPU register stack. (This instruction is faster than executing the 
FSIN and FCOS instructions in succession.) 


The source operand must be given in radians and must be within the range -2°? to +2®. The following table shows 
the results obtained when taking the sine and cosine of various classes of numbers, assuming that underflow does 
not occur. 


Table 3-36. FSINCOS Results 


DEST 
ST(1) Cosine ST(0) Sine 


NOTES: 
F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


If the source operand is outside the acceptable range, the C2 flag in the FPU status word is set, and the value in 
register ST(O) remains unchanged. The instruction does not raise an exception when the source operand is out of 
range. It is up to the program to check the C2 flag for out-of-range conditions. Source values outside the range — 
2©3 to +2©3 can be reduced to the range of the instruction by subtracting an appropriate integer multiple of 2z. 
However, even within the range -2°? to +2°3, inaccurate results can occur because the finite approximation of x 
used internally for argument reduction is not sufficient in all cases. Therefore, for accurate results it is safe to apply 
FSINCOS only to arguments reduced accurately in software, to a value smaller in absolute value than 32/8. See the 
sections titled “Approximation of Pi” and “Transcendental Instruction Accuracy” in Chapter 8 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for a discussion of the proper value to use for x in 
performing such reductions. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
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Operation 


IF ST(0) < 263 
THEN 
C2 := 0; 


TEMP := fcos(ST(0)); // approximation of cosine 
ST(0) := fsin(ST(0)); // approximation of sine 


TOP := TOP - 1; 
ST(0) := TEMP; 
ELSE (* Source operand out of range *) 
C2 := 1; 
FI; 


FPU Flags Affected 
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C1 Set to 0 if stack underflow occurred; set to 1 of stack overflow occurs. 

Set if result was rounded up; cleared otherwise. 
C2 Set to 1 if outside range (-2°7 < source operand < +2®); otherwise, set to 0. 
Co, C3 Undefined. 


Floating-Point Exceptions 


#IA Source operand is an SNaN value, ~, or unsupported format. 


#IS Stack underflow or overflow occurred. 
#D Source operand is a denormal value. 
#U Result is too small for destination format. 


#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 


Same exceptions as in protected mode. 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 
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FSQRT—Square Root 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 


DS FA FSQRT Valid Valid Computes square root of ST(0) and stores the result in ST(0). 


Description 


Computes the square root of the source value in the ST(O) register and stores the result in ST(O). 
The following table shows the results obtained when taking the square root of various classes of numbers, 


assuming that neither overflow nor underflow occurs. 
Table 3-37. FSQRT Results 


SRC (ST(0)) DEST (ST(0)) 
_F ¥ 
-0 -0 
+0 +0 
+F +F 
+00 +00 
NaN NaN 


NOTES: 
F Means finite floating-point value. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


ST(O) := SquareRoot(ST(0)); 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
CO, C2, C3 Undefined. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 

#IA Source operand is an SNaN value or unsupported format. 
Source operand is a negative value (except for —0). 

#D Source operand is a denormal value. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FST/FSTP—Store Floating Point Value 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 

D9 /2 FST m32fp Valid Valid Copy ST(0) to m32fp. 

DD /2 FST m64fp Valid Valid Copy ST(0) to m64fp. 

DD DO+i FST ST(i) Valid Valid Copy ST(0) to ST(i). 

D9 /3 FSTP m32fp Valid Valid Copy ST(0) to m32fp and pop register stack. 
DD /3 FSTP m64fp Valid Valid Copy ST(0) to m64fp and pop register stack. 
DB /7 FSTP m80fp Valid Valid Copy ST(0) to m8Ofp and pop register stack. 
DD D8+i FSTP ST(i) Valid Valid Copy ST(0) to ST(i) and pop register stack. 
Description 


The FST instruction copies the value in the ST(0) register to the destination operand, which can be a memory loca- 
tion or another register in the FPU register stack. When storing the value in memory, the value is converted to 
single-precision or double-precision floating-point format. 


The FSTP instruction performs the same operation as the FST instruction and then pops the register stack. To pop 
the register stack, the processor marks the ST(0) register as empty and increments the stack pointer (TOP) by 1. 
The FSTP instruction can also store values in memory in double extended-precision floating-point format. 


If the destination operand is a memory location, the operand specifies the address where the first byte of the desti- 
nation value is to be stored. If the destination operand is a register, the operand specifies a register in the register 
stack relative to the top of the stack. 


If the destination size is single-precision or double-precision, the significand of the value being stored is rounded to 
the width of the destination (according to the rounding mode specified by the RC field of the FPU control word), and 
the exponent is converted to the width and bias of the destination format. If the value being stored is too large for 
the destination format, a numeric overflow exception (#0) is generated and, if the exception is unmasked, no value 
is stored in the destination operand. If the value being stored is a denormal value, the denormal exception (#D) is 
not generated. This condition is simply signaled as a numeric underflow exception (#U) condition. 


If the value being stored is +0, +, or a NaN, the least-significant bits of the significand and the exponent are trun- 
cated to fit the destination format. This operation preserves the value’s identity as a 0, ~, or NaN. 


If the destination operand is a non-empty register, the invalid-operation exception is not generated. 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
DEST := ST(0); 
IF Instruction = FSTP 
THEN 
PopRegisterStack; 


Fl; 


FPU Flags Affected 
C1 Set to 0 if stack underflow occurred. 


Indicates rounding direction of if the floating-point inexact exception (#P) is generated: 0:= 
not roundup; 1 := roundup. 


CO, C2, C3 Undefined. 
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Floating-Point Exceptions 


#1S 
#IA 


#U 
#0 
#P 


Stack underflow occurred. 


If destination result is an SNaN value or unsupported format, except when the destination 
format is in double extended-precision floating-point format. 


Result is too small for the destination format. 
Result is too large for the destination format. 
Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FSTCW/FNSTCW-—Store x87 FPU Control Word 


Opcode Instruction 64-Bit |Compat/ |Description 
Mode Leg Mode 
9B D9 /7 FSTCW m2byte Valid Valid Store FPU control word to m2byte after checking for 
pending unmasked floating-point exceptions. 
D9 /7 FNSTCW m2byte Valid Valid Store FPU control word to m2byte without checking for 
pending unmasked floating-point exceptions. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Description 


Stores the current value of the FPU control word at the specified destination in memory. The FSTCW instruction 
checks for and handles pending unmasked floating-point exceptions before storing the control word; the FNSTCW 
instruction does not. 


The assembler issues two instructions for the FSTCW instruction (an FWAIT instruction followed by an FNSTCW 
instruction), and the processor executes each of these instructions in separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


When operating a Pentium or Intel486 processor in MS-DOS compatibility mode, it is possible (under unusual 
circumstances) for an FNSTCW instruction to be interrupted prior to being executed to handle a pending FPU excep- 
tion. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circumstances. An 
FNSTCW instruction cannot be interrupted in this way on later Intel processors, except for the Intel Quark™ X1000 
processor. 


Operation 


DEST := FPUControlWord; 


FPU Flags Affected 
The CO, C1, C2, and C3 flags are undefined. 


Floating-Point Exceptions 
None. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FSTENV/FNSTENV—Store x87 FPU Environment 


Opcode Instruction 64-Bit | Compat/ Description 
Mode Leg Mode 
9B DS /6 FSTENV m14/28byte Valid Valid Store FPU environment to m714byte or m28byte 


after checking for pending unmasked floating-point 
exceptions. Then mask all floating-point exceptions. 


D9 /6 FNSTENV m14/28byte Valid Valid Store FPU environment to m14byte or m28byte 
without checking for pending unmasked floating- 
point exceptions. Then mask all floating- 

point exceptions. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Description 


Saves the current FPU operating environment at the memory location specified with the destination operand, and 
then masks all floating-point exceptions. The FPU operating environment consists of the FPU control word, status 
word, tag word, instruction pointer, data pointer, and last opcode. Figures 8-9 through 8-12 in the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, show the layout in memory of the stored environ- 
ment, depending on the operating mode of the processor (protected or real) and the current operand-size attribute 
(16-bit or 32-bit). In virtual-8086 mode, the real mode layouts are used. 


The FSTENV instruction checks for and handles any pending unmasked floating-point exceptions before storing 
the FPU environment; the FNSTENV instruction does not. The saved image reflects the state of the FPU after all 
floating-point instructions preceding the FSTENV/FNSTENV instruction in the instruction stream have been 
executed. 


These instructions are often used by exception handlers because they provide access to the FPU instruction and 
data pointers. The environment is typically saved in the stack. Masking all exceptions after saving the environment 
prevents floating-point exceptions from interrupting the exception handler. 


The assembler issues two instructions for the FSTENV instruction (an FWAIT instruction followed by an FNSTENV 
instruction), and the processor executes each of these instructions separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


When operating a Pentium or Intel486 processor in MS-DOS compatibility mode, it is possible (under unusual 
circumstances) for an FNSTENV instruction to be interrupted prior to being executed to handle a pending FPU 
exception. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circum- 
stances. An FNSTENV instruction cannot be interrupted in this way on later Intel processors, except for the Intel 
Quark™ X1000 processor. 


Operation 


DEST[FPUControlWord] := FPUControlWord; 
DEST[FPUStatusWord] := FPUStatusWord; 

DEST[FPUTagWord] := FPUTagwWord; 

DEST[FPUDataPointer] := FPUDataPointer; 
DEST[FPUInstructionPointer] := FPUInstructionPointer; 
DEST[FPULastinstructionOpcode] := FPULastinstructionOpcode; 


FPU Flags Affected 
The CO, C1, C2, and C3 are undefined. 
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Floating-Point Exceptions 


None 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FSTSW/FNSTSW-—Store x87 FPU Status Word 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 

9B DD /7 FSTSW m2byte Valid Valid Store FPU status word at m2byte after checking 
for pending unmasked floating-point exceptions. 

9B DF €0 FSTSW AX Valid Valid Store FPU status word in AX register after 
checking for pending unmasked floating-point 
exceptions. 

DD /7 FNSTSW m2dbyte Valid Valid Store FPU status word at m2byte without 
checking for pending unmasked floating-point 
exceptions. 

DF EO FNSTSW AX Valid Valid Store FPU status word in AX register without 
checking for pending unmasked floating-point 
exceptions. 

NOTES: 


* See IA-32 Architecture Compatibility section below. 


Description 


Stores the current value of the x87 FPU status word in the destination location. The destination operand can be 
either a two-byte memory location or the AX register. The FSTSW instruction checks for and handles pending 
unmasked floating-point exceptions before storing the status word; the FNSTSW instruction does not. 


The FNSTSW AX form of the instruction is used primarily in conditional branching (for instance, after an FPU 
comparison instruction or an FPREM, FPREM1, or FXAM instruction), where the direction of the branch depends on 
the state of the FPU condition code flags. (See the section titled “Branching and Conditional Moves on FPU Condition 
Codes” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) This 
instruction can also be used to invoke exception handlers (by examining the exception flags) in environments that 
do not use interrupts. When the FNSTSW AX instruction is executed, the AX register is updated before the 
processor executes any further instructions. The status stored in the AX register is thus guaranteed to be from the 
completion of the prior FPU instruction. 


The assembler issues two instructions for the FSTSW instruction (an FWAIT instruction followed by an FNSTSW 
instruction), and the processor executes each of these instructions separately. If an exception is generated for 
either of these instructions, the save EIP points to the instruction that caused the exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


When operating a Pentium or Intel486 processor in MS-DOS compatibility mode, it is possible (under unusual 
circumstances) for an FNSTSW instruction to be interrupted prior to being executed to handle a pending FPU excep- 
tion. See the section titled “No-Wait FPU Instructions Can Get FPU Interrupt in Window” in Appendix D of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for a description of these circumstances. An 
FNSTSW instruction cannot be interrupted in this way on later Intel processors, except for the Intel Quark™ X1000 
processor. 


Operation 


DEST := FPUStatusWord; 


FPU Flags Affected 
The CO, C1, C2, and C3 are undefined. 


Floating-Point Exceptions 
None 
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Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FSUB/FSUBP/FISUB—Subtract 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D8 /4 FSUB m32fp Valid Valid Subtract m32fp from ST(0) and store result in ST(0). 
DC /4 FSUB m64fp Valid Valid Subtract m64fp from ST(0) and store result in ST(O). 
D8 E0+i FSUB ST(0), ST(i) Valid Valid Subtract ST(i) from ST(O) and store result in ST(0). 
DC E8+i FSUB ST(i), ST(0) Valid Valid Subtract ST(0) from ST(i) and store result in ST(i). 
DE E8+i FSUBP ST(i), ST(O) Valid Valid Subtract ST(0) from ST(i), store result in ST(i), and 
pop register stack. 
DE E9 FSUBP Valid Valid Subtract ST(O) from ST(1), store result in ST(1), and 
pop register stack. 
DA /4 FISUB m32int Valid Valid Subtract m32int from ST(O) and store result in ST(0). 
DE /4 FISUB m16int Valid Valid Subtract m1 6int from ST(O) and store result in ST(0). 
Description 


Subtracts the source operand from the destination operand and stores the difference in the destination location. 
The destination operand is always an FPU data register; the source operand can be a register or a memory location. 
Source operands in memory can be in single-precision or double-precision floating-point format or in word or 
doubleword integer format. 


The no-operand version of the instruction subtracts the contents of the ST(0) register from the ST(1) register and 
stores the result in ST(1). The one-operand version subtracts the contents of a memory location (either a floating- 
point or an integer value) from the contents of the ST(O) register and stores the result in ST(0). The two-operand 
version, subtracts the contents of the ST(O) register from the ST(i) register or vice versa. 


The FSUBP instructions perform the additional operation of popping the FPU register stack following the subtrac- 
tion. To pop the register stack, the processor marks the ST(0) register as empty and increments the stack pointer 
(TOP) by 1. The no-operand version of the floating-point subtract instructions always results in the register stack 
being popped. In some assemblers, the mnemonic for this instruction is FSUB rather than FSUBP. 


The FISUB instructions convert an integer source operand to double extended-precision floating-point format 
before performing the subtraction. 


Table 3-38 shows the results obtained when subtracting various classes of numbers from one another, assuming 
that neither overflow nor underflow occurs. Here, the SRC value is subtracted from the DEST value (DEST —- SRC= 
result). 


When the difference between two operands of like sign is 0, the result is +0, except for the round toward —-- mode, 
in which case the result is —-0. This instruction also guarantees that +0 — (-0) =+0, and that —0 — (+0) =-0. When the 
source operand is an integer 0, it is treated as a +0. 


When one operand is ~, the result is - of the expected sign. If both operands are ~ of the same sign, an invalid- 
operation exception is generated. 
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Table 3-38. FSUB/FSUBP/FISUB Results 


SRC 
— 0 —For-l -0 +0 +For+l + co NaN 
* — 00 — oo — 00 — oo — 00 NaN 
+0 +F or +0 DEST DEST -F — 00 NaN 
DEST +00 —SRC +0 -0 —SRC — oo NaN 
+o -—SRC +0 +0 —SRC — oo NaN 
+ co +F DEST DEST +F or +0 — co NaN 
+ co +00 +00 +00 +00 . NaN 
NaN NaN NaN NaN NaN NaN NaN 
NOTES: 


F Means finite floating-point value. 
| Means integer. 
* Indicates floating-point invalid-arithmetic-operand (#IA) exception. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF Instruction = FISUB 
THEN 
DEST := DEST — ConvertToDoubleExtendedPrecisionFP(SRC); 
ELSE (* Source operand is floating-point value *) 
DEST := DEST — SRC; 
Fl; 


IF Instruction = FSUBP 
THEN 
PopRegisterStack; 
Fl; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 


#IS Stack underflow occurred. 

#IA Operand is an SNaN value or unsupported format. 
Operands are infinities of like sign. 

#D Source operand is a denormal value. 

#U Result is too small for destination format. 

#0 Result is too large for destination format. 

#P Value cannot be represented exactly in destination format. 
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Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

#MF If there is a pending x87 FPU exception. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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FSUBR/FSUBRP/FISUBR—Reverse Subtract 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D8 /5 FSUBR m32fp Valid Valid Subtract ST(0) from m32fp and store result in ST(O). 
DC /5 FSUBR m64fp Valid Valid Subtract ST(0) from m64fp and store result in ST(O). 
D8 E8+i FSUBR ST(0), ST(i) Valid Valid Subtract ST(0) from ST(i) and store result in ST(O). 
DC EO+i FSUBR ST(i), ST(O) Valid Valid Subtract ST(i) from ST(O) and store result in ST(i). 
DE EO+i FSUBRP ST(i), ST(O) Valid Valid Subtract ST(i) from ST(O), store result in ST(i), and 
pop register stack. 
DE E1 FSUBRP Valid Valid Subtract ST(1) from ST(0), store result in ST(1), and 
pop register stack. 
DA/5 FISUBR m32int Valid Valid Subtract ST(0) from m3Zint and store result in ST(O). 
DE/5 FISUBR m176int Valid Valid Subtract ST(0) from m76int and store result in ST(0). 
Description 


Subtracts the destination operand from the source operand and stores the difference in the destination location. 
The destination operand is always an FPU register; the source operand can be a register or a memory location. 
Source operands in memory can be in single-precision or double-precision floating-point format or in word or 
doubleword integer format. 


These instructions perform the reverse operations of the FSUB, FSUBP, and FISUB instructions. They are provided 
to support more efficient coding. 


The no-operand version of the instruction subtracts the contents of the ST(1) register from the ST(0) register and 
stores the result in ST(1). The one-operand version subtracts the contents of the ST(0) register from the contents 
of a memory location (either a floating-point or an integer value) and stores the result in ST(0). The two-operand 
version, subtracts the contents of the ST(i) register from the ST(0) register or vice versa. 


The FSUBRP instructions perform the additional operation of popping the FPU register stack following the subtrac- 
tion. To pop the register stack, the processor marks the ST(0) register as empty and increments the stack pointer 
(TOP) by 1. The no-operand version of the floating-point reverse subtract instructions always results in the register 
stack being popped. In some assemblers, the mnemonic for this instruction is FSUBR rather than FSUBRP. 


The FISUBR instructions convert an integer source operand to double extended-precision floating-point format 
before performing the subtraction. 


The following table shows the results obtained when subtracting various classes of numbers from one another, 
assuming that neither overflow nor underflow occurs. Here, the DEST value is subtracted from the SRC value (SRC 
— DEST =result). 


When the difference between two operands of like sign is 0, the result is +0, except for the round toward -~ mode, 
in which case the result is -O. This instruction also guarantees that +0 — (-0) =+0, and that —0 — (+0) =—0. When the 
source operand is an integer 0, it is treated as a +0. 


When one operand is ~, the result is « of the expected sign. If both operands are ~ of the same sign, an invalid- 
operation exception is generated. 
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Table 3-39. FSUBR/FSUBRP/FISUBR Results 


SRC 
— oo —F or -I -0 +0 +F or +l + co NaN 
* + co + co +00 + 0o + co NaN 
— 00 +F or +0 —DEST —DEST +F + 00 NaN 
DEST — co SRC +0 +0 SRC +00 NaN 
— oo SRC -0 +0 SRC + co NaN 
— oo -F —DEST —DEST +F or +0 + 00 NaN 
— oo — co — oo — oo — oo * NaN 
NaN NaN NaN NaN NaN NaN NaN 
NOTES: 
F Means finite floating-point value. 
| Means integer. 
* Indicates floating-point invalid-arithmetic-operand (#1A) exception. 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 
IF Instruction = FISUBR 
THEN 
DEST := ConvertToDoubleExtendedPrecisionFP(SRC) — DEST; 
ELSE (* Source operand is floating-point value *) 
DEST := SRC — DEST; Fl; 
IF Instruction = FSUBRP 
THEN 
PopRegisterStack; Fl; 
FPU Flags Affected 
C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
CO, C2, C3 Undefined. 
Floating-Point Exceptions 
#IS Stack underflow occurred. 
#IA Operand is an SNaN value or unsupported format. 
Operands are infinities of like sign. 
#D Source operand is a denormal value. 
#U Result is too small for destination format. 
#0 Result is too large for destination format. 
#P Value cannot be represented exactly in destination format. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#NM 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 

#NM 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 

#NM 

#MF 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 

If there is a pending x87 FPU exception. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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FTST—TEST 
Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 4 FTST Valid Valid Compare ST(0) with 0.0. 
Description 


Compares the value in the ST(0) register with 0.0 and sets the condition code flags CO, C2, and C3 in the FPU status 
word according to the results (see table below). 


Table 3-40. FTST Results 


Condition C3 C2 co 
ST(0) > 0.0 0 0 0 
ST(0) < 0.0 0 0 1 
ST(0) = 0.0 1 0 0 
Unordered 1 1 1 


This instruction performs an “unordered comparison.” An unordered comparison also checks the class of the 
numbers being compared (see “FXAM—Examine Floating-Point” in this chapter). If the value in register ST(0) is a 
NaN or is in an undefined format, the condition flags are set to “unordered” and the invalid operation exception is 
generated. 


The sign of zero is ignored, so that (— 0.0 :=+0.0). 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


CASE (relation of operands) OF 
Not comparable: C3,C2,CO:= 111; 


ST(0) > 0.0: C3, C2, CO := 000; 

ST(0) < 0.0: C3, C2, CO := 001; 

ST(0) = 0.0: C3, C2, CO := 100; 
ESAC; 


FPU Flags Affected 
Cl Set to 0. 
Co, C2, C3 See Table 3-40. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 
#IA The source operand is a NaN value or is in an unsupported format. 
#D The source operand is a denormal value. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 
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Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FUCOM/FUCOMP/FUCOMPP—Unordered Compare Floating Point Values 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
DD E0+i FUCOM ST(i) Valid Valid Compare ST(0) with ST(i). 
DD €1 FUCOM Valid Valid Compare ST(0) with ST(1). 
DD E8+i FUCOMP ST(i) Valid Valid Compare ST(0) with ST(i) and pop register stack. 
DD E9 FUCOMP Valid Valid Compare ST(0) with ST(1) and pop register stack. 
DA E9 FUCOMPP Valid Valid Compare ST(0) with ST(1) and pop register stack twice. 
Description 


Performs an unordered comparison of the contents of register ST(0) and ST(i) and sets condition code flags CO, C2, 
and C3 in the FPU status word according to the results (see the table below). If no operand is specified, the 
contents of registers ST(0) and ST(1) are compared. The sign of zero is ignored, so that —-0.0 is equal to +0.0. 


Table 3-41. FUCOM/FUCOMP/FUCOMPP Results 


Comparison Results* C3 C2 co 
STO > ST(i) 0 0 0 
STO < ST(i) 0 0 1 
STO = ST(i) 1 0 0 
Unordered 1 1 1 


NOTES: 
* Flags not set if unmasked invalid-arithmetic-operand (#IA) exception is generated. 


An unordered comparison checks the class of the numbers being compared (see “FXAM—Examine Floating-Point” 
in this chapter). The FUCOM/FUCOMP/FUCOMPP instructions perform the same operations as the 
FCOM/FCOMP/FCOMPP instructions. The only difference is that the FUCOM/FUCOMP/FUCOMPP instructions raise 
the invalid-arithmetic-operand exception (#IA) only when either or both operands are an SNaN or are in an unsup- 
ported format; QNaNs cause the condition code flags to be set to unordered, but do not cause an exception to be 
generated. The FCOM/FCOMP/FCOMPP instructions raise an invalid-operation exception when either or both of the 
operands are a NaN value of any kind or are in an unsupported format. 


As with the FCOM/FCOMP/FCOMPP instructions, if the operation results in an invalid-arithmetic-operand exception 
being raised, the condition code flags are set only if the exception is masked. 


The FUCOMP instruction pops the register stack following the comparison operation and the FUCOMPP instruction 
pops the register stack twice following the comparison operation. To pop the register stack, the processor marks 
the ST(0) register as empty and increments the stack pointer (TOP) by 1. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
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IF ST(O) or SRC = QNaN, but not SNaN or unsupported format 


ELSE (* ST(O) or SRC is SNaN or unsupported format *) 


Operation 
CASE (relation of operands) OF 
ST > SRC: C3, C2, CO := 000; 
ST < SRC: C3, C2, CO := 001; 
ST = SRC: C3, C2, CO := 100; 
ESAC; 
THEN 
C3, C2, CO:= 111; 
#IA; 
IF FPUControlWord.IM = 1 
THEN 


C3, C2, CO := 111; 


Fl; 
Fl; 


IF Instruction = FUCOMP 
THEN 
PopRegisterStack; 
Fl; 


IF Instruction = FUCOMPP 
THEN 
PopRegisterStack; 
Fl; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Co, C2, C3 See Table 3-41. 


Floating-Point Exceptions 
#IS Stack underflow occurred. 
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#IA One or both operands are SNaN values or have unsupported formats. Detection of a QNaN 
value in and of itself does not raise an invalid-operand exception. 


#D One or both operands are denormal values. 


Protected Mode Exceptions 

#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FXAM—Examine Floating-Point 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
DS E5 FXAM Valid Valid Classify value or number in ST(0). 
Description 


Examines the contents of the ST(0) register and sets the condition code flags CO, C2, and C3 in the FPU status word 
to indicate the class of value or number in the register (see the table below). 


Table 3-42. FXAM Results 


Class C3 C2 co 
Unsupported 0 0 0 
NaN 0 0 1 
Normal finite number 0 1 0 
Infinity 0 1 1 
Zero 1 0 0 
Empty | 0 1 
Denormal number 1 1 0 


The Ci flag is set to the sign of the value in ST(0), regardless of whether the register is empty or full. 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 

Operation 

C1 := sign bit of ST; (* 0 for positive, 1 for negative *) 


CASE (class of value or number in ST(0)) OF 
Unsupported:C3, C2, CO := 000; 


NaN: C3, C2, CO := 001; 

Normal: C3, C2, CO := 010; 

Infinity: C3, C2, CO := 011; 

Zero: C3, C2, CO := 100; 

Empty: C3, C2, CO := 101; 

Denormal: C3, C2, CO := 110; 
ESAC; 


FPU Flags Affected 
C1 Sign of value in ST(O). 
CO, C2, C3 See Table 3-42. 


Floating-Point Exceptions 
None 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 
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Virtual-8086 Mode Exceptions 


Same exceptions as in protected mode. 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 
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FXCH—Exchange Register Contents 


Opcode Instruction 64-Bit Compat/ Description 

Mode Leg Mode 
DS C8+i FXCH ST(i) Valid Valid Exchange the contents of ST(0) and ST(i). 
DS C9 FXCH Valid Valid Exchange the contents of ST(0) and ST(1). 
Description 


Exchanges the contents of registers ST(O) and ST(i). If no source operand is specified, the contents of ST(0) and 
ST(1) are exchanged. 


This instruction provides a simple means of moving values in the FPU register stack to the top of the stack [ST(0)], 
so that they can be operated on by those floating-point instructions that can only operate on values in ST(0). For 
example, the following instruction sequence takes the square root of the third register from the top of the register 
stack: 

FXCH ST(3); 

FSORT; 

FXCH ST(3); 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF (Number-of-operands) is 1 
THEN 
temp := ST(0); 
ST(0) := SRC; 
SRC := temp; 
ELSE 
temp := ST(0); 
ST(0) := ST(1); 
ST(1) := temp; 
FI; 


FPU Flags Affected 
C1 Set to 0. 
Co, C2, C3 Undefined. 


Floating-Point Exceptions 
#IS Stack underflow occurred. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 
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FXRSTOR—Restore x87 FPU, MMX, XMM, and MXCSR State 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF AE /1 M | Valid Valid Restore the x87 FPU, MMX, XMM, and MXCSR 
FXRSTOR m512byte register state from m512byte. 

NP REX.W + OF AE /1 M | Valid N.E. Restore the x87 FPU, MMX, XMM, and MXCSR 
FXRSTOR64 m512byte register state from m51 2byte. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Reloads the x87 FPU, MMX technology, XMM, and MXCSR registers from the 512-byte memory image specified in 
the source operand. This data should have been written to memory previously using the FXSAVE instruction, and 
in the same format as required by the operating modes. The first byte of the data should be located on a 16-byte 
boundary. There are three distinct layouts of the FXSAVE state map: one for legacy and compatibility mode, a 
second format for 64-bit mode FXSAVE/FXRSTOR with REX.W=0, and the third format is for 64-bit mode with 
FXSAVE64/FXRSTOR64. Table 3-43 shows the layout of the legacy/compatibility mode state information in 
memory and describes the fields in the memory image for the FXRSTOR and FXSAVE instructions. Table 3-46 
shows the layout of the 64-bit mode state information when REX.W is set (FXSAVE64/FXRSTOR64). Table 3-47 
shows the layout of the 64-bit mode state information when REX.W is clear (FXSAVE/FXRSTOR). 


The state image referenced with an FXRSTOR instruction must have been saved using an FXSAVE instruction or be 
in the same format as required by Table 3-43, Table 3-46, or Table 3-47. Referencing a state image saved with an 
FSAVE, FNSAVE instruction or incompatible field layout will result in an incorrect state restoration. 


The FXRSTOR instruction does not flush pending x87 FPU exceptions. To check and raise exceptions when loading 
x87 FPU state information with the FXRSTOR instruction, use an FWAIT instruction after the FXRSTOR instruction. 


If the OSFXSR bit in control register CR4 is not set, the FXRSTOR instruction may not restore the states of the XMM 
and MXCSR registers. This behavior is implementation dependent. 


If the MXCSR state contains an unmasked exception with a corresponding status flag also set, loading the register 
with the FXRSTOR instruction will not result in a SIMD floating-point error condition being generated. Only the next 
occurrence of this unmasked exception will result in the exception being generated. 


Bits 16 through 32 of the MXCSR register are defined as reserved and should be set to 0. Attempting to write a 1 
in any of these bits from the saved state image will result in a general protection exception (#GP) being generated. 


Bytes 464:511 of an FXSAVE image are available for software use. FXRSTOR ignores the content of bytes 464:511 
in an FXSAVE state image. 


Operation 
IF 64-Bit Mode 
THEN 
(x87 FPU, MMX, XMM15-XMMO, MXCSR)  Load(SRC); 
ELSE 
(x87 FPU, MMX, XMM7-XMMO, MXCSR) := Load(SRC); 
Fl; 


x87 FPU and SIMD Floating-Point Exceptions 
None. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 


#AC 


#UD 


For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 

If a memory operand is not aligned on a 16-byte boundary, regardless of segment. (See align- 
ment check exception [#AC] below. ) 

For an attempt to set reserved bits in MXCSR. 

For an illegal address in the SS segment. 

For a page fault. 

If CRO.TS[bit 3] = 1. 

If CRO.EM[bit 2] = 1. 

If CPUID.O1H:EDX.FXSR[bit 24] = 0. 

If instruction is preceded by a LOCK prefix. 

If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 16-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 


#NM 


#UD 


If a memory operand is not aligned on a 16-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 
For an attempt to set reserved bits in MXCSR. 

If CRO.TS[bit 3] = 1. 

If CRO.EM[bit 2] = 1. 

If CPUID.01H:EDX.FXSR[bit 24] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


#PF(fault-code) 


#AC 
#UD 


For a page fault. 
For unaligned memory reference. 
If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
If memory operand is not aligned on a 16-byte boundary, regardless of segment. 
For an attempt to set reserved bits in MXCSR. 
#PF(fault-code) For a page fault. 


#NM If CRO.TS[bit 3] = 1. 
If CRO.EM[bit 2] = 1. 
#UD If CPUID.O1H:EDX.FXSR[bit 24] = 0. 
If instruction is preceded by a LOCK prefix. 
#AC If this exception is disabled a general protection exception (#GP) is signaled if the memory 


operand is not aligned on a 16-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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FXSAVE—Save x87 FPU, MMX Technology, and SSE State 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF AE /O M Valid Valid Save the x87 FPU, MMX, XMM, and MXCSR 
FXSAVE m5172byte register state to m572byte. 

NP REX.W + OF AE /O M Valid N.E. Save the x87 FPU, MMX, XMM, and MXCSR 
FXSAVE64 m512byte register state to m572byte. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Saves the current state of the x87 FPU, MMX technology, XMM, and MXCSR registers to a 512-byte memory loca- 
tion specified in the destination operand. The content layout of the 512 byte region depends on whether the 
processor is operating in non-64-bit operating modes or 64-bit sub-mode of IA-32e mode. 


Bytes 464:511 are available to software use. The processor does not write to bytes 464:511 of an FXSAVE area. 
The operation of FXSAVE in non-64-bit modes is described first. 


Non-64-Bit Mode Operation 
Table 3-43 shows the layout of the state information in memory when the processor is operating in legacy modes. 


Table 3-43. Non-64-bit-Mode Layout of FXSAVE and FXRSTOR 
Memory Region 


Rsvd FCS FIP[31:0] FOP Rsvd | FTW FSW FCW 
MXCSR_MASK MXCSR Rsrvd FDS FDP[31:0] 
Reserved STO/MMO 
Reserved ST1/MM1 
Reserved ST2/MM2 
Reserved ST3/MM3 
Reserved ST4/MM4 
Reserved ST5/MM5 
Reserved ST6/MM6 
Reserved ST7/MM7 
XMMO 
XMM1 
XMM2 
XMM3 
XMM4 
XMM5 
XMM6 
XMM7 272 
Reserved 288 
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Table 3-43. Non-64-bit-Mode Layout of FXSAVE and FXRSTOR 
Memory Region (Contd.) 


Reserved 304 
Reserved 320 
Reserved 336 
Reserved 352 
Reserved 368 
Reserved 384 
Reserved 400 
Reserved 416 
Reserved 432 
Reserved 448 
Available 464 
Available 480 
Available 496 


The destination operand contains the first byte of the memory image, and it must be aligned on a 16-byte 
boundary. A misaligned destination operand will result in a general-protection (#GP) exception being generated (or 
in some cases, an alignment check exception [#AC]). 


The FXSAVE instruction is used when an operating system needs to perform a context switch or when an exception 
handler needs to save and examine the current state of the x87 FPU, MMX technology, and/or XMM and MXCSR 


registers. 


The fields in Table 3-43 are defined in Table 3-44. 


Table 3-44. Field Definitions 


Field Definition 

FCW x87 FPU Control Word (16 bits). See Figure 8-6 in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 1, for the layout of the x87 FPU control word. 

FSW x87 FPU Status Word (16 bits). See Figure 8-4 in the Intel? 64 and IA-32 Architectures Software 
Developer's Manual, Volume 1, for the layout of the x87 FPU status word. 

Abridged FTW x87 FPU Tag Word (8 bits). The tag information saved here is abridged, as described in the following 
paragraphs. 

FOP x87 FPU Opcode (16 bits). The lower 11 bits of this field contain the opcode, upper 5 bits are reserved. 
See Figure 8-8 in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 1, for 
the layout of the x87 FPU opcode field. 

FIP x87 FPU Instruction Pointer Offset (64 bits). The contents of this field differ depending on the current 


addressing mode (32-bit, 16-bit, or 64-bit) of the processor when the FXSAVE instruction was 
executed: 


32-bit mode — 32-bit IP offset. 

16-bit mode — low 16 bits are IP offset; high 16 bits are reserved. 
64-bit mode with REX.W — 64-bit IP offset. 

64-bit mode without REX.W — 32-bit IP offset. 


See "x87 FPU Instruction and Operand (Data) Pointers” in Chapter 8 of the Intel® 64 and IA-32 
Architectures Software Developer's Manual, Volume 1, for a description of the x87 FPU instruction 
pointer. 
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Table 3-44. Field Definitions (Contd.) 


Field Definition 

FCS x87 FPU Instruction Pointer Selector (16 bits). If CPUID.(EAX=07H,ECX=0H):EBX[bit 13] = 1, the 
processor deprecates FCS and FDS, and this field is saved as OOOOH. 

FDP x87 FPU Instruction Operand (Data) Pointer Offset (64 bits). The contents of this field differ 


depending on the current addressing mode (32-bit, 16-bit, or 64-bit) of the processor when the 
FXSAVE instruction was executed: 


32-bit mode — 32-bit DP offset. 

16-bit mode — low 16 bits are DP offset; high 16 bits are reserved. 
64-bit mode with REX.W — 64-bit DP offset. 

64-bit mode without REX.W — 32-bit DP offset. 


See “x87 FPU Instruction and Operand (Data) Pointers” in Chapter 8 of the Intel® 64 and IA-32 
Architectures Software Developer's Manual, Volume 1, for a description of the x87 FPU operand 


pointer. 

FDS x87 FPU Instruction Operand (Data) Pointer Selector (16 bits). lf CPUID.(EAX=07H,ECX=0H):EBX [bit 
13] = 1, the processor deprecates FCS and FDS, and this field is saved as OOOOH. 

MXCSR MXCSR Register State (32 bits). See Figure 10-3 in the Intel® 64 and IA-32 Architectures Software 


Developer's Manual, Volume 1, for the layout of the MXCSR register. If the OSFXSR bit in control 
register CR4 is not set, the FXSAVE instruction may not save this register. This behavior is 
implementation dependent. 


MXCSR_ MXCSR_MASK (32 bits). This mask can be used to adjust values written to the MXCSR register, 

MASK ensuring that reserved bits are set to 0. Set the mask bits and flags in MXCSR to the mode of 
operation desired for SSE and SSE2 SIMD floating-point instructions. See “Guidelines for Writing to the 
MXCSR Register” in Chapter 11 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1, for instructions for how to determine and use the MXCSR_MASK value. 


STO/MMO through x87 FPU or MMX technology registers. These 80-bit fields contain the x87 FPU data registers or the 
ST7/MM7 MMX technology registers, depending on the state of the processor prior to the execution of the 
FXSAVE instruction. If the processor had been executing x87 FPU instruction prior to the FXSAVE 
instruction, the x87 FPU data registers are saved; if it had been executing MMX instructions (or SSE or 
SSE2 instructions that operated on the MMX technology registers), the MMX technology registers are 
saved. When the MMX technology registers are saved, the high 16 bits of the field are reserved. 


XMMO through XMM7 XMM registers (128 bits per field). If the OSFXSR bit in control register CR4 is not set, the FXSAVE 
instruction may not save these registers. This behavior is implementation dependent. 


The FXSAVE instruction saves an abridged version of the x87 FPU tag word in the FTW field (unlike the FSAVE 
instruction, which saves the complete tag word). The tag information is saved in physical register order (RO 
through R7), rather than in top-of-stack (TOS) order. With the FXSAVE instruction, however, only a single bit (1 for 
valid or 0 for empty) is saved for each tag. For example, assume that the tag word is currently set as follows: 


R7 R6 R5 R4 R3 R2 R1 RO 
11 xx xx xx 17°17 ~=«11~=«2127 
Here, 11B indicates empty stack elements and “xx” indicates valid (OOB), zero (01B), or special (10B). 
For this example, the FXSAVE instruction saves only the following 8 bits of information: 
R7 R6 R5 R4 R3 R2 R1 RO 
Oo 1 1 1 0 0 0 0 
Here, a 1 is saved for any valid, zero, or special tag, and a O is saved for any empty tag. 
The operation of the FXSAVE instruction differs from that of the FSAVE instruction, the as follows: 


¢ FXSAVE instruction does not check for pending unmasked floating-point exceptions. (The FXSAVE operation in 
this regard is similar to the operation of the FNSAVE instruction). 


e =6After the FXSAVE instruction has saved the state of the x87 FPU, MMX technology, XMM, and MXCSR registers, 
the processor retains the contents of the registers. Because of this behavior, the FXSAVE instruction cannot be 
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used by an application program to pass a “clean” x87 FPU state to a procedure, since it retains the current 
state. To clean the x87 FPU state, an application must explicitly execute an FINIT instruction after an FKSAVE 
instruction to reinitialize the x87 FPU state. 


¢ The format of the memory image saved with the FXSAVE instruction is the same regardless of the current 
addressing mode (32-bit or 16-bit) and operating mode (protected, real address, or system management). 
This behavior differs from the FSAVE instructions, where the memory image format is different depending on 
the addressing mode and operating mode. Because of the different image formats, the memory image saved 
with the FXSAVE instruction cannot be restored correctly with the FRSTOR instruction, and likewise the state 
saved with the FSAVE instruction cannot be restored correctly with the FXRSTOR instruction. 


The FSAVE format for FTW can be recreated from the FTW valid bits and the stored 80-bit FP data (assuming the 
stored data was not the contents of MMX technology registers) using Table 3-45. 


Table 3-45. Recreating FSAVE Format 


Exponent Exponent Fraction JandM FTW valid bit 
all 1's all O's all O's bits x87 FTW 
0 0 0 Ox 1 Special 10 
0 0 0 1x 1 Valid 00 
0 0 1 00 1 Special 10 
0 0 1 10 1 Valid 00 
0 1 0 Ox 1 Special 10 
0 1 0 1x 1 Special 10 
0 1 1 00 1 Zero 01 
0 1 1 10 1 Special 10 
1 0 0 1x 1 Special 10 
1 0 0 1x 1 Special 10 
1 0 1 00 1 Special 10 
1 0 1 10 1 Special 10 
For all legal combinations above. 0 Empty 11 


The J-bit is defined to be the 1-bit binary integer to the left of the decimal place in the significand. The M-bit is 
defined to be the most significant bit of the fractional portion of the significand (i.e., the bit immediately to the right 
of the decimal place). 


When the M-bit is the most significant bit of the fractional portion of the significand, it must be 0 if the fraction is 
all 0's. 


IA-32e Mode Operation 


In compatibility sub-mode of IA-32e mode, legacy SSE registers, XMMO through XMM7, are saved according to the 
legacy FXSAVE map. In 64-bit mode, all of the SSE registers, XMMO through XMM15, are saved. Additionally, there 
are two different layouts of the FXSAVE map in 64-bit mode, corresponding to FXSAVE64 (which requires 
REX.W=1) and FXSAVE (REX.W=0). In the FXSAVE64 map (Table 3-46), the FPU IP and FPU DP pointers are 64-bit 
wide. In the FXSAVE map for 64-bit mode (Table 3-47), the FPU IP and FPU DP pointers are 32-bits. 
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Table 3-46. Layout of the 64-bit-mode FXSAVE64 Map 
(requires REX.W = 1) 


FIP FOP Reserved FTW FSW FCW 0 
MXCSR_MASK MXCSR FDP 16 
Reserved STO/MMO 32 
Reserved ST1/MM1 48 
Reserved ST2/MM2 64 
Reserved ST3/MM3 80 
Reserved ST4/MM4 96 
Reserved ST5/MM5 
Reserved ST6/MM6 
Reserved ST7/MM7 
XMMO 
XMM1 176 
XMM2 192 
XMM3 208 
XMM4 224 
XMM5 240 
XMM6 256 
XMM7 272 
XMM8 288 
XMMg 304 
XMM10 320 
XMM11 336 
XMM12 352 
XMM13 
XMM14 
XMM15 
Reserved 
Reserved 
Reserved 448 
Available 464 
Available 480 
Available 496 
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Table 3-47. Layout of the 64-bit-mode FXSAVE Map (REX.W = 0) 


13. 12 11 10 9 8 7 6 5 4 a2.) 10 / | 
Reserved FCS FIP[31:0] FOP Reserved FTW FSW FCW 
MXCSR_MASK MXCSR Reserved FDS FDP[31:0] 
Reserved STO/MMO 
Reserved ST1/MM1 
Reserved ST2/MM2 
Reserved ST3/MM3 
Reserved ST4/MM4 
Reserved ST5/MM5 
Reserved ST6/MM6 
Reserved ST7/MM7 
XMMO 
XMM1 176 
XMM2 192 
XMM3 208 
XMM4 224 
XMM5 240 
XMM6 256 
XMM7 272 
XMM8 288 
XMMg 304 
XMM10 320 
XMM11 336 
XMM12 352 
XMM13 
XMM14 
XMM15 
Reserved 
Reserved 
Reserved 
Available 464 
Available 480 
Available 496 
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Operation 


IF 64-Bit Mode 
THEN 
IF REX.W = 1 
THEN 


DEST := Save64BitPromotedFxsave(x87 FPU, MMX, XMM15-XMMO, 
MXCSR); 


ELSE 


DEST := Save64BitDefaultFxsave(x87 FPU, MMX, XMM15-XMMO, MXCSR); 


Fl; 
ELSE 


DEST := SaveLegacyFxsave(x87 FPU, MMX, XMM7-XMMO, MXCSR); 


Fl; 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 


#UD 
#UD 
#AC 


For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 


If a memory operand is not aligned on a 16-byte boundary, regardless of segment. (See the 
description of the alignment check exception [#AC] below.) 

For an illegal address in the SS segment. 

For a page fault. 

If CRO.TS[bit 3] = 1. 

If CRO.EM[bit 2] = 1. 

If CPUID.O1H:EDX.FXSR[bit 24] = 0. 

If the LOCK prefix is used. 

If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 16-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


Real-Address Mode Exceptions 


#GP 


#NM 


#UD 


If a memory operand is not aligned on a 16-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 
If CRO.TS[bit 3] = 1. 

If CRO.EM[bit 2] = 1. 

If CPUID.01H:EDX.FXSR[bit 24] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


#PF(fault-code) 
#AC 
#UD 


For a page fault. 
For unaligned memory reference. 
If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 


#PF(fault-code) 
#NM 


#UD 


#AC 


If a memory address referencing the SS segment is in a non-canonical form. 

If the memory address is in a non-canonical form. 

If memory operand is not aligned on a 16-byte boundary, regardless of segment. 

For a page fault. 

If CRO.TS[bit 3] = 1. 

If CRO.EM[bit 2] = 1. 

If CPUID.01H:EDX.FXSR[bit 24] = 0. 

If the LOCK prefix is used. 

If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 16-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


Implementation Note 


The order in which the processor signals general-protection (#GP) and page-fault (#PF) exceptions when they both 
occur on an instruction boundary is given in Table 5-2 in the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 3B. This order vary for FXSAVE for different processor implementations. 
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FXTRACT—Extract Exponent and Significand 


Opcode/ 64-Bit | Compat/ Description 

Instruction Mode Leg Mode 

DS F4 Valid Valid Separate value in ST(0) into exponent and significand, store 

FXTRACT exponent in ST(0), and push the significand onto the register 
stack. 

Description 


Separates the source value in the ST(O) register into its exponent and significand, stores the exponent in ST(0), 
and pushes the significand onto the register stack. Following this operation, the new top-of-stack register ST(0) 
contains the value of the original significand expressed as a floating-point value. The sign and significand of this 
value are the same as those found in the source operand, and the exponent is 3FFFH (biased value for a true expo- 
nent of zero). The ST(1) register contains the value of the original operand’s true (unbiased) exponent expressed 
as a floating-point value. (The operation performed by this instruction is a superset of the IEEE-recommended 
logb(x) function.) 

This instruction and the F2XM1 instruction are useful for performing power and range scaling operations. The 
FXTRACT instruction is also useful for converting numbers in double extended-precision floating-point format to 
decimal representations (e.g., for printing or displaying). 

If the floating-point zero-divide exception (#Z) is masked and the source operand is zero, an exponent value of —co 
is stored in register ST(1) and O with the sign of the source operand is stored in register ST(0O). 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


TEMP := Significand(ST(0)); 
ST(O) := Exponent(ST(0)); 
TOP := TOP — 1; 

ST(O) := TEMP; 


FPU Flags Affected 
C1 Set to 0 if stack underflow occurred; set to 1 if stack overflow occurred. 
CO, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow or overflow occurred. 

#IA Source operand is an SNaN value or unsupported format. 
#Z ST(0) operand is +0. 

#D Source operand is a denormal value. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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FYL2X—Compute y * log>x 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 F1 FYL2X Valid Valid Replace ST(1) with (ST(1) * log,ST(0)) and pop the 
register stack. 


Description 


Computes (ST(1) * logy (ST(0))), stores the result in register ST(1), and pops the FPU register stack. The source 
operand in ST(Q) must be a non-zero positive number. 


The following table shows the results obtained when taking the log of various classes of numbers, assuming that 
neither overflow nor underflow occurs. 


Table 3-48. FYL2X Results 


ST(0) 
— oo -F +0 +0<+F<+1 +1 +F>+1 +00 NaN 
bs by +090 +00 : — oo — co NaN 
ST(1) * * * +F ae) —-F — oo NaN 
* * * +0 -~0 -0 * NaN 
* * : -0 +0 +0 7 NaN 
: P we _F +0 +F +00 NaN 
68 * * ayes —oo * +0 +00 NaN 
NaN NaN NaN NaN NaN NaN NaN NaN NaN 

NOTES: 


F Means finite floating-point value. 
* Indicates floating-point invalid-operation (#IA) exception. 
** Indicates floating-point zero-divide (#Z) exception. 


If the divide-by-zero exception is masked and register ST(0) contains +0, the instruction returns - with a sign that 
is the opposite of the sign of the source operand in register ST(1). 


The FYL2X instruction is designed with a built-in multiplication to optimize the calculation of logarithms with an 
arbitrary positive base (b): 


log,x := (logaby"! * logox 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 


ST(1) := ST(1) * logoST(0); 
PopRegisterStack; 


FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
Co, C2, C3 Undefined. 
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Floating-Point Exceptions 


#1S 
#IA 


#Z 
#D 
#U 
#0 
#P 


Stack underflow occurred. 

Either operand is an SNaN or unsupported format. 

Source operand in register ST(0) is a negative finite value 
(not -0). 

Source operand in register ST(0) is +0. 

Source operand is a denormal value. 

Result is too small for destination format. 

Result is too large for destination format. 


Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM 
#MF 
#UD 


CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
If there is a pending x87 FPU exception. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 


Same exceptions as 


in protected mode. 


Virtual-8086 Mode Exceptions 


Same exceptions as 


in protected mode. 


Compatibility Mode Exceptions 


Same exceptions as 


in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as 
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in protected mode. 
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FYL2XP1—Compute y * log,(x +1) 


Opcode Instruction 64-Bit Compat/ Description 
Mode Leg Mode 
D9 FI FYL2XP1 Valid Valid Replace ST(1) with ST(1) * logs(ST(O) + 1.0) and pop the 
register stack. 


Description 
Computes (ST(1) * logo(ST(O) + 1.0)), stores the result in register ST(1), and pops the FPU register stack. The 
source operand in ST(0) must be in the range: 

1 = 4272) te = 272) 


The source operand in ST(1) can range from —:: to +oo. If the ST(0) operand is outside of its acceptable range, the 
result is undefined and software should not rely on an exception being generated. Under some circumstances 
exceptions may be generated when ST(0) is out of range, but this behavior is implementation specific and not guar- 
anteed. 


The following table shows the results obtained when taking the log epsilon of various classes of numbers, assuming 
that underflow does not occur. 


Table 3-49. FYL2XP1 Results 


ST(0) 
-(1-( /2/2 )) to -0 +0 to +(1 -( /2/2 )) 
ST(1) +F +0 -0 -F NaN 
+0 +0 -0 -0 NaN 
-0 -0 +0 +0 NaN 
-F -0 +0 +F NaN 
ey * * +oo NaN 
NaN NaN NaN NaN NaN 
NOTES: 


F Means finite floating-point value. 
* Indicates floating-point invalid-operation (#IA) exception. 


This instruction provides optimal accuracy for values of epsilon [the value in register ST(0)] that are close to O. For 
small epsilon (e) values, more significant digits can be retained by using the FYL2XP1 instruction than by using 
(e+1) as an argument to the FYL2X instruction. The (e+1) expression is commonly found in compound interest and 
annuity calculations. The result can be simply converted into a value in another logarithm base by including a scale 
factor in the ST(1) source operand. The following equation is used to calculate the scale factor for a particular loga- 
rithm base, where n is the logarithm base desired for the result of the FYL2XP1 instruction: 


scale factor := log, 2 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 
Operation 


ST(1) := ST(1) * logs(ST(O) + 1.0); 
PopRegisterStack; 
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FPU Flags Affected 


C1 Set to 0 if stack underflow occurred. 
Set if result was rounded up; cleared otherwise. 
co, C2, C3 Undefined. 


Floating-Point Exceptions 


#1S Stack underflow occurred. 

#IA Either operand is an SNaN value or unsupported format. 
#D Source operand is a denormal value. 

#U Result is too small for destination format. 

#0 Result is too large for destination format. 

#P Value cannot be represented exactly in destination format. 


Protected Mode Exceptions 


#NM CRO.EM[bit 2] or CRO.TS[bit 3] = 1. 
#MF If there is a pending x87 FPU exception. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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GF2P8AFFINEINVQB—Galois Field Affine Transformation Inverse 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
66 OF3A CF /r /ib A VIN GFNI Computes inverse affine transformation in the 
GF2P8AFFINEINVOB xmm1, finite field GF(2*8). 
xmm2/m128, imm8 
VEX.128.66.0F3A.W1 CF /r /ib B VIN AVX Computes inverse affine transformation in the 
VGF2P8AFFINEINVOB xmm1, xmm2z, GFNI finite field GF(2*8). 
xmm3/m128, imm8 
VEX.256.66.0F3A.W1 CF /r /ib B VIN AVX Computes inverse affine transformation in the 
VGF2P8AFFINEINVOB ymm1, ymm2, GFNI finite field GF(2*8). 
ymm3/m256, imm8 
EVEX.128.66.0F3A.W1 CF /r /ib C VIV AVX512VL Computes inverse affine transformation in the 
VGF2P8AFFINEINVOB xmm1{k1}{z}, GFNI finite field GF(2*8). 
xmm2, xmm3/m128/m64bcst, imm8 
EVEX.256.66.0F3A.W1 CF /r /ib C VIV AVX512VL Computes inverse affine transformation in the 
VGF2P8AFFINEINVOB ymm1{k1}{z}, GFNI finite field GF(2*8). 
ymm2, ymm3/m256/m64bcst, imm8 
EVEX.512.66.0F3A.W1 CF /r /ib C VIV AVX512F Computes inverse affine transformation in the 
VGF2P8AFFINEINVOB zmm1{k1}{z}, GFNI finite field GF(2*8). 
zmm2, zmm3/m512/m64bcst, imm8 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) immé (r) NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imme (r) 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) imme (r) 
Description 


The AFFINEINVB instruction computes an affine transformation in the Galois Field 28. For this instruction, an affine 
transformation is defined by A * inv(x) + b where “A” is an 8 by 8 bit matrix, and “x” and “b” are 8-bit vectors. The 
inverse of the bytes in x is defined with respect to the reduction polynomial x® + x* + x? +x + 1. 


One SIMD register (operand 1) holds “x” as either 16, 32 or 64 8-bit vectors. A second SIMD (operand 2) register 
or memory operand contains 2, 4, or 8 “A” values, which are operated upon by the correspondingly aligned 8 “x” 
values in the first register. The “b” vector is constant for all calculations and contained in the immediate byte. 


The EVEX encoded form of this instruction does not support memory fault suppression. The SSE encoded forms of 
the instruction require 16B alignment on their memory operations. 


The inverse of each byte is given by the following table. The upper nibble is on the vertical axis and the lower nibble 
is on the horizontal axis. For example, the inverse of 0x95 is Ox8A. 
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Table 3-50. Inverse Byte Listings 
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- 0 1 2 3 4 5 6 7 8 9 A B C D E F 
0 0 1 8D FG CB 52 7B D1 E8 4F 29 ia) BO €1 €5 C7 
1 74 B4 AA 4B 99 2B 60 5F 58 3F FD CC FF 40 EE Be 
2 3A 6E 5A FI 55 4D A8 cg C1 A 98 15 30 44 A2 C2 
3 2C 45 92 6C F3 39 66 42 F2 35 20 6F 77 BB 59 19 
4 1D FE 37 67 2D 31 F5 69 A7 64 AB 13 54 25 —9 9 
5 ED 5C 5 CA 4C 24 87 BF 18 3E 22 FO 51 EC 61 17 
6 16 5E AF D3 49 AG 36 43 F4 47 91 DF 33 93 21 3B 
7 79 B7 97 85 10 B5 BA 3C B6 70 DO 6 Al FA 81 82 
8 83 7E 7F 80 96 73 BE 56 9B 9E 95 DS F7 2 B9 A4 
9 DE 6A 32 6D D8 8A 84 72 2A 14 OF 88 F9 DC 89 9A 
A FB 7C 2E C3 8F B8 65 48 26 c8 12 4A CE E7 D2 62 
B C EO 1F EF 11 75 78 7) AS 8E 76 3D BD BC 86 57 
C B 28 2F A3 DA D4 E4 F A9 27 53 4 1B FC AC E6 
D 7A AE 63 cS DB E2 EA 94 8B C4 D5 9D F8 90 6B 
E B1 D6 EB C6 E CF AD 8 4€ D7 E3 5D 50 1E B3 
F 5B 23 38 34 68 46 3 8C DD 9C 7D AO CD 1A 41 1C 
Operation 
define affine_inverse_byte(tsrc2qw, src1 byte, imm): 
FOR i := 0 to 7: 
* parity(x) = 1 if x has an odd number of 1s init, and O otherwise.* 
* inverse(x) is defined in the table above * 
retbyte.bit[i] := parity(tsrc2qw.byte[7-i] AND inverse(src1byte)) XOR imm8.bit[i] 
return retbyte 
VGF2P8AFFINEINVQB dest, src1, src2, imm8 (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1: 
IF SRC2 is memory and EVEX.b==1: 
tsrc2 := SRC2.qword[0] 
ELSE: 
tsrc2 := SRC2.qword[j] 
FOR b := 0 to 7: 
IF k1[j*8+b] OR *no writemask*: 
FOR i := 0 to 7: 
DEST.qword[j].byte[b] := affine_inverse_byte(tsrc2, SRC1.qword{[j].byte[b], imm8) 
ELSE IF *zeroing*: 
DEST.qword[j].byte[b] := 0 
*ELSE DEST.qword{j].byte[b] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 
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VGF2P8AFFINEINVQB dest, src1, src2, imm8 (128b and 256b VEX encoded versions) 
(KL, VL) = (2, 128), (4, 256) 
FOR j :=0 TO KL-1: 
FOR b := 0 to 7: 
DEST.qword[j].byte[b] := affine_inverse_byte(SRC2.qword[j], SRC1.qword[j].byte[b], imm8) 
DEST[MAX_VL-1:VL] := 0 


GF2P8AFFINEINVQB srcdest, src1, imm8 (128b SSE encoded version) 
FOR j :=0TO1: 
FOR b := 0 to 7: 
SRCDEST.qword[j].byte[b] := affine_inverse_byte(SRC1.qword[j], SRCDEST.qword[j].byte[b], imm8) 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)GF2P8AFFINEINVQB __m128i__mm_gf2p8affineinv_epi64_epi8(__m128i, __m128i, int); 

(V)GF2P8AFFINEINVQB __m128i __mm_mask_gf2p8affineinv_epi64_epi8(__m128i, __ mmask16, __m128i, __m128i, int); 
(V)GF2P8AFFINEINVQB __m128i __mm_maskz_gf2p8affineinv_epi64_epi8(__mmask16, __m128i, __m128i, int); 
VGF2P8AFFINEINVQB __m256i_mm256_gf2p8affineinv_epi64_epi8(__m256i, __m256i, int); 

VGF2P8AFFINEINVQB __m256i__mm256_mask_gf2p8affineinv_epi64_epi8(__m256i,__ mmask32,__ m256i, __ m256i, int); 
VGF2P8AFFINEINVQB __m256i__mm256_maskz_gf2p8affineinv_epi64_epi8(__mmask32, ___ m256i, __m256i, int); 
VGF2P8AFFINEINVQB __m512i_mm512_gf2p8affineinv_epi64_epi8(__m512i,___m512i, int); 

VGF2P8AFFINEINVQB __m512i_mm512_mask_gf2p8affineinv_epi64_epi8(__m512i,__ mmask64,___m512i,__m512i, int); 
VGF2P8AFFINEINVQB __m512i_mm512_maskz_gf2p8affineinv_epi64_epi8(__mmask64,___m512i,__m512i, int); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Legacy-encoded and VEX-encoded: See Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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GF2P8AFFINEQB—Galois Field Affine Transformation 


INSTRUCTION SET REFERENCE, A-L 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
66 OF3A CE /r /ib A VV GFNI Computes affine transformation in the finite 
GF2P8AFFINEQB xmm1, field GF(2*8). 
xmm2/m128, imm8 
VEX.128.66.0F3A.W1 CE /r /ib B VV AVX Computes affine transformation in the finite 
VGF2P8AFFINEQB xmm1, xmm2, GFNI field GF(2*8). 
xmm3/m128, imm8 
VEX.256.66.0F3A.W1 CE /r /ib B VN AVX Computes affine transformation in the finite 
VGF2P8AFFINEQB ymm1, ymm2, GFNI field GF(2*8). 
ymm3/m256, imm8 
EVEX.128.66.0F3A.W1 CE /r /ib C VIN AVX512VL Computes affine transformation in the finite 
VGF2P8AFFINEQB xmm1{k1}{z}, GFNI field GF(2*8). 
xmm2, xmm3/m128/m64bcst, imm8 
EVEX.256.66.0F3A.W1 CE /r /ib C VV AVX512VL Computes affine transformation in the finite 
VGF2P8AFFINEQB ymm1{k1}{z}, GFNI field GF(2*8). 
ymm2, ymm3/m256/m64bcst, imm8 
EVEX.512.66.0F3A.W1 CE /r /ib C VIN AVX512F Computes affine transformation in the finite 
VGF2P8AFFINEQB zmm1{k1}{2}, GFNI field GF(2*8). 
zmm2, zmm3/m512/m64bcst, imm8 
Instruction Operand Encoding 

Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) immé (r) NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) immés (r) 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé (r) 

Description 


The AFFINEB instruction computes an affine transformation in the Galois Field 2°. For this instruction, an affine 
transformation is defined by A * x + b where “A” is an 8 by 8 bit matrix, and “x” and “b” are 8-bit vectors. One SIMD 
register (operand 1) holds “x” as either 16, 32 or 64 8-bit vectors. A second SIMD (operand 2) register or memory 
operand contains 2, 4, or 8 “A” values, which are operated upon by the correspondingly aligned 8 “x” values in the 
first register. The “b” vector is constant for all calculations and contained in the immediate byte. 


The EVEX encoded form of this instruction does not support memory fault suppression. The SSE encoded forms of 


the instruction require16B alignment on their memory operations. 


Operation 
define parity(x): 
t:=0 // single bit 
FOR i := 0 to 7: 
t=txor x.bit[i] 
return t 


define affine_byte(tsrc2qw, src1byte, imm): 
FOR i := 0 to 7: 
* parity(x) = 1 if x has an odd number of 1s in it, and O otherwise.* 
retbyte.bit[i] := parity(tsrc2qw.byte[7-i] AND src1 byte) XOR imm8.bit[i] 
return retbyte 
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VGF2P8AFFINEQB dest, src1, src2, imm8 (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:= O TOKL-1: 
IF SRC2 is memory and EVEX.b==1: 
tsrc2 := SRC2.qword[0] 
ELSE: 
tsrc2 := SRC2.qword[j] 


FOR b:= Oto 7: 
IF k1[j*8+b] OR *no writemask*: 
DEST.qword[j].byte[b] := affine_byte(tsrc2, SRC1.qword{[j].byte[b], imm8) 
ELSE IF *zeroing*: 
DEST.qword{j].byte[b] := 0 
*ELSE DEST.qword[j].byte[b] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VGF2P8AFFINEQB dest, src1, src2, imm8 (128b and 256b VEX encoded versions) 
(KL, VL) = (2, 128), (4, 256) 
FOR j:= OTOKL-1: 
FOR b:= Oto 7: 
DEST.qword[j].byte[b] := affine_byte(SRC2.qword[j], SRC1.qword[j].byte[b], imm8) 
DEST[MAX_VL-1:VL] := 0 


GF2P8AFFINEQB srcdest, src1, imm8 (128b SSE encoded version) 
FOR j:=0OTO1: 
FOR b := 0 to 7: 
SRCDEST.qword[j].byte[b] := affine_byte(SRC1.qword[j], SRCDEST.qword[j].byte[b], imms8) 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)GF2P8AFFINEQB __m128i__mm_gf2p8affine_epi64_epi8(__m128i, __m128i, int); 
(V)GF2P8AFFINEQB __m128i __mm_mask_gf2p8affine_epi64_epi8(__m128i, __ mmask16, 
(V)GF2P8AFFINEQB __m128i __mm_maskz_gf2p8affine_epi64_epi8(__mmask16, ___m128i, 
VGF2P8AFFINEQB __m256i_mm256_gf2p8affine_epi64_epi8(__m256i, __ m256i, int); 
VGF2P8AFFINEQB __m256i__mm256_mask_gf2p8affine_epi64_epi8(__m256i,__ mmask32, __ m256i, __m256i, int); 
VGF2P8AFFINEQB __m256i_mm256_maskz_gf2p8affine_epi64_epi8(__mmask32, __ m256i,___ m256i, int); 
VGF2P8AFFINEQB __m512i_mm512_gf2p8affine_epi64_epi8(__m512i,___m512i, int); 
VGF2P8AFFINEQB __m512i_mm512_mask_gf2p8affine_epi64_epi8(__m512i,___ mmask64, 
VGF2P8AFFINEQB __m512i_mm512_maskz_gf2p8affine_epi64_epi8(__mmask64, __m512i, 


m128i,__m128i, int); 
m1 28i, int); 


m512i,__m512i, int); 
m51 2i, int); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Legacy-encoded and VEX-encoded: See Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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GF2P8MULB—Galois Field Multiply Bytes 


INSTRUCTION SET REFERENCE, A-L 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
66 OF38 CF /r A VIN GFNI Multiplies elements in the finite field GF(2*8). 
GF2P8MULB xmm1, xmm2/m128 
VEX.128.66.0F38.W0 CF /r B VV AVX Multiplies elements in the finite field GF(2*8). 
VGF2P8MULB xmm1, xmmz, GFNI 
xmm3/m1 28 
VEX.256.66.0F38.W0 CF /r B VN AVX Multiplies elements in the finite field GF(2*8). 
VGF2P8MULB ymm1, ymm2, GFNI 
ymm3/m256 
EVEX.128.66.0F38.W0 CF /r C VN AVX512VL Multiplies elements in the finite field GF(2*8). 
VGF2P8MULB xmm1{k1}{z}, xmm2, GFNI 
xmm3/m128 
EVEX.256.66.0F38.W0 CF /r C VN AVX512VL Multiplies elements in the finite field GF(2*8). 
VGF2P8MULB ymm1{k1}{z}, ymm2, GFNI 
ymm3/m256 
EVEX.512.66.0F38.W0 CF /r C VV AVX512F Multiplies elements in the finite field GF(2*8). 
VGF2P8MULB zmm1{k1}{z}, zmm2, GFNI 
zmm3/m512 
Instruction Operand Encoding 

Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


The instruction multiplies elements in the finite field GF(2°), operating on a byte (field element) in the first source 
operand and the corresponding byte in a second source operand. The field GF(2°) is represented in polynomial 
representation with the reduction polynomial x® + x* + x° +x +1. 


This instruction does not support broadcasting. 


The EVEX encoded form of this instruction supports memory fault suppression. The SSE encoded forms of the 
instruction require16B alignment on their memory operations. 


Operation 


define gf2p8mul_byte(src1 byte, src2byte): 


tword := 0 
FOR i:= 0 to 7: 
IF src2byte.bit[i]: 


tword := tword XOR (src1byte<< i) 


* carry out polynomial reduction by the characteristic polynomial p* 


FOR i := 14 downto 8: 
p:= 0x11B << (i-8) 
IF tword.bit[i]: 
tword := tword XOR p 
return tword.byte[0] 


GF2P8MULB—Galois Field Multiply Bytes 


*0x11B = 0000_0001_0001_1011 in binary* 
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VGF2P8MULB dest, src1, src2 (EVEX encoded version) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j:= O TOKL-1: 
IF k1[j] OR *no writemask*: 
DEST.byte[j] := gf2p8mul_byte(SRC1.bytef[j], SRC2.byte[j]) 
ELSE iF *zeroing*: 
DEST.bytef[j] := 0 
* ELSE DEST.byte[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VGF2P8MULB dest, src1, src2 (128b and 256b VEX encoded versions) 
(KL, VL) = (16, 128), (32, 256) 
FOR j:= OTOKL-1: 

DEST. bytef[j] := gf2p8mul_byte(SRC1.bytefj], SRC2.bytef[j]) 
DEST[MAX_VL-1:VL] := 0 


GF2P8MULB srcdest, src1 (128b SSE encoded version) 
FOR j:= 0TO 15: 
SRCDEST.byte[j] :=gf2p8mul_byte(SRCDEST.byte[j], SRC1.byte[j]) 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)GF2P8MULB __m128i__mm_gf2p8mul_epi8(__m128i, __m128i); 

(V)GF2P8MULB __m128i__mm_mask_gf2p8mul_epi8(__m128i, __ mmask16, __m128i, 
(V)GF2P8MULB __m128i__mm_maskz_gf2p8mul_epi8(__mmask16,__m128i,__m128i); 
VGF2P8MULB __m256i __mm256_gf2p8mul_epi8(__m256i,___ m256i); 
VGF2P8MULB __m256i__mm256_mask_gf2p8mul_epi8(__m256i, __ mmask32, 
VGF2P8MULB __m256i__mm256_maskz_gf2p8mul_epi8(__mmask32, _m256i, 
VGF2P8MULB __m512i_mm512_gf2p8mul_epi8(__m512i,__m512i); 
VGF2P8MULB __m512i__mm512_mask_gf2p8mul_epi8(__m512i,__ mmask64, __m512i, 
VGF2P8MULB __m512i_mm512_maskz_gf2p8mul_epi8(__mmask64,___m512i,___m512i); 


m1 28i); 


m256i, __m256i); 
m256i); 


m512i); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Legacy-encoded and VEX-encoded: See Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded: See Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 7C/r RM | V/V SSE3 Horizontal add packed double-precision 
HADDPD xmm1, xmm2/m128 floating-point values from xmm2/m128 to 
xmm1. 
VEX.128.66.0F.WIG 7C /r RVM | V/V AVX Horizontal add packed double-precision 
VHADDPD xmm1,xmm2, xmm3/m128 floating-point values from xmm2 and 
xmm3/mem. 
VEX.256.66.0F.WIG 7C /r RVM | V/V AVX Horizontal add packed double-precision 
VHADDPD ymm1, ymm2, ymm3/m256 floating-point values from ymme2 and 
ymm3/mem. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds the double-precision floating-point values in the high and low quadwords of the destination operand and 
stores the result in the low quadword of the destination operand. 


Adds the double-precision floating-point values in the high and low quadwords of the source operand and stores the 


result in the high quadword of the destination operand. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
See Figure 3-16 for HADDPD; see Figure 3-17 for VHADDPD. 


HADDPD xmm1, xmm2/m128 


[127:64] 


[63:0] 


[127:64] 


v 


v 


xmm2/m128[63:0] + 
xmm2/m128[127:64] 


xmm1[63:0] + xmm1[127:64] 


Result: 
xmm1 


[127:64] 


[63:0] 


OM15993 


Figure 3-16. HADDPD—Packed Double-FP Horizontal Add 


HADDPD—Packed Double-FP Horizontal Add 
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SRC1 X3 X2 x1 x0 
SRC2 Y3 Y1 YO 
DEST| Y2 + Y3 X2 + X3 YO+rY1 XO + X1 


Figure 3-17. VHADDPD operation 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Operation 

HADDPD (128-bit Legacy SSE version) 
DEST[63:0] := SRC1[127:64] + SRC1[63:0] 
DEST[127:64] := SRC2[127:64] + SRC2[63:0] 
DEST[MAXVL-1:128] (Unmodified) 


VHADDPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[127:64] + SRC1[63:0] 
DEST[127:64] := SRC2[127:64] + SRC2[63:0] 
DEST[MAXVL-1:128] := 0 


VHADDPD (VEX.256 encoded version) 
DEST[63:0] := SRC1[127:64] + SRC1[63:0] 
DEST[127:64] := SRC2[127:64] + SRC2[63:0] 
DEST[191:128] := SRC1[255:192] + SRC1[191:128] 
DEST[255:192] := SRC2[255:192] + SRC2[191:128] 


Intel C/C++ Compiler Intrinsic Equivalent 


VHADDPD: m256d _mm256_hadd_pd (__m256d a, __m256d b); 


HADDPD: m128d_mm_hadd_pd (__m128d a,_m128d b); 


Exceptions 


When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general- 
protection exception (#GP) will be generated. 


3-472 Vol. 2A HADDPD—Packed Double-FP Horizontal Add 


INSTRUCTION SET REFERENCE, A-L 


Numeric Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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HADDPS—Packed Single-FP Horizontal Add 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F2 OF 7C/r RM |V/V SSE3 Horizontal add packed single-precision 
HADDPS xmm1, xmm2/m128 floating-point values from xmm2/m128 to 
xmm1. 
VEX.128.F2.0F.WIG 7C /r RVM | V/V AVX Horizontal add packed single-precision 
VHADDPS xmm1, xmm2, xmm3/m128 floating-point values from xmm2 and 
xmm3/mem. 
VEX.256.F2.0F.WIG 7C /r RVM | V/V AVX Horizontal add packed single-precision 
VHADDPS ymm1, ymm2, ymm3/m256 floating-point values from ymme2 and 
ymm3/mem. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Adds the single-precision floating-point values in the first and second dwords of the destination operand and stores 


the result in the first dword of the destination operand. 


Adds single-precision floating-point values in the third and fourth dword of the destination operand and stores the 


result in the second dword of the destination operand. 


Adds single-precision floating-point values in the first and second dword of the source operand and stores the result 


in the third dword of the destination operand. 


Adds single-precision floating-point values in the third and fourth dword of the source operand and stores the result 


in the fourth dword of the destination operand. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
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See Figure 3-18 for HADDPS; see Figure 3-19 for VHADDPS. 


HADDPS xmm1, xmm2/m128 


[127:96] 


[95:64] 


[63:32] 


[127:96] 


[95:64] 


[63:32] 


v 


v 


v 


v 


xmm2/m128 xmm2/m128 : : : 
[95:64] + xmm2/ | [31:0] + xmm2/ Saree eee pee Et 
m128[127:96] m128[63:32] ; : 
[127:96] [95:64] [63:32] [31:0] 
OM15994 
Figure 3-18. HADDPS—Packed Single-FP Horizontal Add 
src) X7 x6 X5 x4 x3 x2 x1 x0 
sSRCo| Y7 Y6 Y5 Y4 Y3 Y2 Y1 Yo 
DEST] Y6+Y7 Y4+Y5 X6+X7 X4+X5 | Y2+Y3 | YOtY1 | x2+xX3 X0O+X1 


Figure 3-19. VHADDPS operation 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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Operation 


HADDPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[63:32] + SRC1[31:0] 
DEST[63:32] := SRC1[127:96] + SRC1[95:64] 
DEST[95:64] := SRC2[63:32] + SRC2[31:0] 
DEST[127:96] := SRC2[127:96] + SRC2[95:64] 
DEST[MAXVL-1:128] (Unmodified) 


VHADDPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[63:32] + SRC1[31:0] 
DEST[63:32] := SRC1[127:96] + SRC1[95:64] 
DEST[95:64] := SRC2[63:32] + SRC2[31:0] 
DEST[127:96] := SRC2[127:96] + SRC2[95:64] 
DEST[MAXVL-1:128] := 0 


VHADDPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[63:32] + SRC1[31:0] 
DEST[63:32] := SRC1[127:96] + SRC1[95:64] 
DEST[95:64] := SRC2[63:32] + SRC2[31:0] 
DEST[127:96] := SRC2[127:96] + SRC2[95:64] 
DEST[159:128] := SRC1[191:160] + SRC1[159:128] 
DEST[191:160] := SRC1[255:224] + SRC1[223:192] 
DEST[223:192] := SRC2[191:160] + SRC2[159:128] 
DEST[255:224] := SRC2[255:224] + SRC2[223:192] 


Intel C/C++ Compiler Intrinsic Equivalent 


HADDPS: m128 _mm_hadd_ps (__m128 a,__m128 b); 


VHADDPS: m256 _mm256_hadd_ps (__m256 a,_m256 b); 


Exceptions 


When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general- 
protection exception (#GP) will be generated. 


Numeric Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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HLT—Halt 
Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
F4 HLT ZO | Valid Valid Halt 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 

Description 


Stops instruction execution and places the processor in a HALT state. An enabled interrupt (including NMI and 
SMI), a debug exception, the BINIT# signal, the INIT# signal, or the RESET# signal will resume execution. If an 
interrupt (including NMI) is used to resume execution after a HLT instruction, the saved instruction pointer 


(CS:EIP) points to the instruction following the HLT instruction. 


When a HLT instruction is executed on an Intel 64 or IA-32 processor supporting Intel Hyper-Threading Technology, 
only the logical processor that executes the instruction is halted. The other logical processors in the physical 
processor remain active, unless they are each individually halted by executing a HLT instruction. 


The HLT instruction is a privileged instruction. When the processor is running in protected or virtual-8086 mode, 
the privilege level of a program or procedure must be 0 to execute the HLT instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


Enter Halt state; 


Flags Affected 
None 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
None. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


HLT—Halt 
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HSUBPD—Packed Double-FP Horizontal Subtract 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 7D /r RM |V/V SSE3 Horizontal subtract packed double-precision 
HSUBPD xmm1, xmm2/m128 floating-point values from xmm2/m128 to 
xmm1. 
VEX.128.66.0F.WIG 7D /r RVM | V/V AVX Horizontal subtract packed double-precision 
VHSUBPD xmm1,xmm2, xmm3/m1 28 floating-point values from xmm_2 and 
xmm3/mem. 
VEX.256.66.0F.WIG 7D /r RVM | V/V AVX Horizontal subtract packed double-precision 
VHSUBPD ymm1, ymm2, ymm3/m256 floating-point values from ymm_2 and 
ymm3/mem. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


The HSUBPD instruction subtracts horizontally the packed DP FP numbers of both operands. 


Subtracts the double-precision floating-point value in the high quadword of the destination operand from the low 
quadword of the destination operand and stores the result in the low quadword of the destination operand. 


Subtracts the double-precision floating-point value in the high quadword of the source operand from the low quad- 
word of the source operand and stores the result in the high quadword of the destination operand. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


See Figure 3-20 for HSUBPD; see Figure 3-21 for VHSUBPD. 


HSUBPD xmm1, xmm2/m128 


[127:64] [63:0] 


[127:64] 


Vv Vv 
xmm2/m128[63:0] - 
xmm2/m128[127:64] 


xmm_1[63:0] - xmm1[127:64] 


[127:64] [63:0] 


OM15995 


Figure 3-20. HSUBPD—Packed Double-FP Horizontal Subtract 
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SRC1 X3 X2 x1 X0 
SRC2 Y3 Y1 Yo 
DEST Y2 -Y3 X2 - X3 Yo-Y1 XO - X1 


Figure 3-21. VHSUBPD operation 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Operation 


HSUBPD (128-bit Legacy SSE version) 
DEST[63:0] := SRC1[63:0] - SRC1[127:64] 
DEST[127:64] := SRC2[63:0] - SRC2[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


VHSUBPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC1[127:64] 
DEST[127:64] := SRC2[63:0] - SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


VHSUBPD (VEX.256 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC1[127:64] 
DEST[127:64] := SRC2[63:0] - SRC2[127:64] 
DEST[191:128] := SRC1[191:128] - SRC1[255:192] 
DEST[255:192] := SRC2[191:128] - SRC2[255:192] 


Intel C/C++ Compiler Intrinsic Equivalent 
HSUBPD: m128d_mm_hsub_pd(__m128d a,__m128d b) 


VHSUBPD: m256d _mm256_hsub_pd (__m256d a, __m256d b); 


Exceptions 


When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general- 
protection exception (#GP) will be generated. 


Numeric Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 
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Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F2 OF 7D /r RM | V/V SSE3 Horizontal subtract packed single-precision 
HSUBPS xmm1, xmm2/m128 floating-point values from xmm2/m1 28 to 
xmm1. 
VEX.128.F2.0F.WIG 7D /r RVM | V/V AVX Horizontal subtract packed single-precision 
VHSUBPS xmm1, xmm2, xmm3/m128 floating-point values from xmm2 and 
xmm3/mem. 
VEX.256.F2.0F.WIG 7D /r RVM | V/V AVX Horizontal subtract packed single-precision 
VHSUBPS ymm1, ymm2, ymm3/m256 floating-point values from ymm2 and 
ymm3/mem. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Subtracts the single-precision floating-point value in the second dword of the destination operand from the first 
dword of the destination operand and stores the result in the first dword of the destination operand. 


Subtracts the single-precision floating-point value in the fourth dword of the destination operand from the third 
dword of the destination operand and stores the result in the second dword of the destination operand. 


Subtracts the single-precision floating-point value in the second dword of the source operand from the first dword 
of the source operand and stores the result in the third dword of the destination operand. 


Subtracts the single-precision floating-point value in the fourth dword of the source operand from the third dword 
of the source operand and stores the result in the fourth dword of the destination operand. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
See Figure 3-22 for HSUBPS; see Figure 3-23 for VHSUBPS. 
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HSUBPS xmm1, xmm2/m128 


[127:96] 


[95:64] 


[63:32] 


[127:96] 


[95:64] 


[63:32] 


v 


v 


v 


v 


xmm2/m128 xmm2/m128 : ; : 
psed)-anma | etd)-ammar | mimivsed | xnmigtgl. | RESULT 
m128[127:96] m128[63:32] : ; 

[127:96] [95:64] [63:32] [31:0] 

OM15996 

Figure 3-22. HSUBPS—Packed Single-FP Horizontal Subtract 
SRC1) X7 x6 X5 x4 X3 x2 x1 x0 
SRC2| Y7 Y6 Y5 Y4 Y3 Y2 Y1 YO 
DEST] Y6-Y7 Y4-Y5 X6-X7 X4-X5 | Y2-Y3 YO-Y1 X2-X3 Xx0-X1 


Figure 3-23. VHSUBPS operation 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 


VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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Operation 


HSUBPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] - SRC1[63:32] 
DEST[63:32] := SRC1[95:64] - SRC1[127:96] 
DEST[95:64] := SRC2[31:0] - SRC2[63:32] 
DEST[127:96] := SRC2[95:64] - SRC2[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


VHSUBPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC1[63:32] 
DEST[63:32] := SRC1[95:64] - SRC1[127:96] 
DEST[95:64] := SRC2[31:0] - SRC2[63:32] 
DEST[127:96] := SRC2[95:64] - SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


VHSUBPS (VEX.256 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC1[63:32] 
DEST[63:32] := SRC1[95:64] - SRC1[127:96] 
DEST[95:64] := SRC2[31:0] - SRC2[63:32] 
DEST[127:96] := SRC2[95:64] - SRC2[127:96] 
DEST[159:1 28] := SRC1[159:1 28] - SRC1[191:160] 
DEST[191:160] := SRC1[223:192] - SRC1[255:224] 
DEST[223:192] := SRC2[159:1 28] - SRC2[191:160] 
DEST[255:224] := SRC2[223:192] - SRC2[255:224] 


Intel C/C++ Compiler Intrinsic Equivalent 
HSUBPS: m128 _mm_hsub_ps(__m128 a,__m128 b); 
VHSUBPS: m256 __mm256_hsub_ps (__m256 a,__m256 b); 


Exceptions 


When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general- 
protection exception (#GP) will be generated. 


Numeric Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”. 
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IDIV—Signed Divide 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

F6 /7 IDIV r/m8 M Valid Valid Signed divide AX by r/m8, with result stored in: 
AL := Quotient, AH := Remainder. 

REX + F6 /7 IDIV r/m8* M Valid N.E. Signed divide AX by r/m8, with result stored in 
AL := Quotient, AH := Remainder. 

F7/7 IDIV r/m16 M Valid Valid Signed divide DX:AX by r/m76, with result 
stored in AX := Quotient, DX := Remainder. 

F7/7 IDIV r/m32 M Valid Valid Signed divide EDX:EAX by r/m32, with result 
stored in EAX := Quotient, EDX := Remainder. 

REX.W + F7 /7 IDIV r/m64 M Valid N.E. Signed divide RDX:RAX by r/m64, with result 
stored in RAX := Quotient, RDX := Remainder. 

NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Divides the (signed) value in the AX, DX:AX, or EDX:EAX (dividend) by the source operand (divisor) and stores the 
result in the AX (AH:AL), DX:AX, or EDX:EAX registers. The source operand can be a general-purpose register or a 
memory location. The action of this instruction depends on the operand size (dividend/divisor). 


Non-integral results are truncated (chopped) towards 0. The remainder is always less than the divisor in magni- 
tude. Overflow is indicated with the #DE (divide error) exception rather than with the CF flag. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. In 64-bit mode when REX.W is 
applied, the instruction divides the signed value in RDX:RAX by the source operand. RAX contains a 64-bit 

quotient; RDX contains a 64-bit remainder. 


See the summary chart at the beginning of this section for encoding data and limits. See Table 3-51. 
Table 3-51. IDIV Results 


Operand Size Dividend Divisor Quotient Remainder Quotient Range 
Word/byte AX r/m8 AL AH -128 to +127 
Doubleword/word DX:AX r/m16 AX DX —32,768 to +32,767 
Quadword/doubleword EDX:EAX r/m32 EAX EDX —23' to 23! -1 
Doublequadword/ quadword RDX:RAX r/m64 RAX RDX —2% to 25 — 1 
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Operation 


IF SRC= 0 
THEN #DE; (* Divide error *) 
FI; 


IF OperandSize = 8 (* Word/byte operation *) 
THEN 
temp := AX / SRG; (* Signed division *) 
IF (temp > 7FH) or (temp < 80H) 
(* If a positive result is greater than 7FH or a negative result is less than 80H *) 
THEN #DE; (* Divide error *) 
ELSE 
AL:= temp; 
AH := AX SignedModulus SRC; 
Fl; 
ELSE IF OperandSize = 16 (* Doubleword/word operation *) 
THEN 
temp := DX:AX / SRC; (* Signed division *) 
IF (temp > 7FFFH) or (temp < 8000H) 
(* If a positive result is greater than 7FFFH 
or a negative result is less than 8000H *) 
THEN 
#DE; (* Divide error *) 
ELSE 
AX := temp; 
DX := DX:AX SignedModulus SRC; 
Fl; 
Fl; 
ELSE IF OperandSize = 32 (* Quadword/doubleword operation *) 
temp := EDX:EAX / SRC; (* Signed division *) 
IF (temp > 7FFFFFFFH) or (temp < 80000000H) 
(* If a positive result is greater than 7FFFFFFFH 
or a negative result is less than 80000000H *) 


THEN 

#DE; (* Divide error *) 
ELSE 

EAX := temp; 


EDX := EDXE:AX SignedModulus SRC; 
Fl; 
Fl; 
ELSE IF OperandSize = 64 (* Doublequadword/quadword operation *) 
temp := RDX:RAX / SRG; (* Signed division *) 
IF (temp > 7FFFFFFFFFFFFFFFH) or (temp < 8000000000000000H) 
(* If a positive result is greater than 7FFFFFFFFFFFFFFFH 
or a negative result is less than 8000000000000000H *) 


THEN 

#DE; (* Divide error *) 
ELSE 

RAX := temp; 


RDX := RDE:RAX SignedModulus SRC; 
Fl; 
Fl; 
Fl; 
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Flags Affected 


The CF, OF, SF, ZF, AF, and PF flags are undefined. 


Protected Mode Exceptions 


#DE 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#AC(0) 


#UD 


If the source operand (divisor) is 0. 
The signed result (quotient) is too large for the destination. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If a memory operand effective address is outside the SS segment limit. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#DE 


#GP 
#SS 
#UD 


If the source operand (divisor) is 0. 


The signed result (quotient) is too large for the destination. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#DE 


#GP(0) 

#SS(0) 
#PF(fault-code) 
#AC(0) 

#UD 


If the source operand (divisor) is 0. 


The signed result (quotient) is too large for the destination. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 
#DE 


#PF(fault-code) 
#AC(0) 


#UD 
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If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

If the source operand (divisor) is 0 

If the quotient is too large for the designated register. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

F6/5 IMUL r/m8* M Valid Valid AX:= AL * r/mbyte. 

F7/5 IMUL r/m16 M Valid Valid DX:AX := AX * r/m word. 

F7/5 IMUL r/m32 M Valid Valid EDX:EAX := EAX * r/m32. 

REX.W + F7 /5 IMUL r/m64 M Valid N.E. RDX:RAX := RAX * r/m64. 

OF AF /r IMUL 776, r/m16 RM | Valid Valid word register := word register * r/m16. 

OF AF /r IMUL 32, r/m32 RM | Valid Valid doubleword register := doubleword register * 
/m32. 

REX.W + OF AF /r IMUL r64, r/m64 RM | Valid N.E. Quadword register := Quadword register * 
r/m64. 

6B /r ib IMUL r16, r/m16, imm8 RMI | Valid Valid word register := r/m16 * sign-extended 
immediate byte. 

6B /r ib IMUL r32, r/m32, imm8 RMI | Valid Valid doubleword register := r/m32 * sign- 
extended immediate byte. 

REX.W + 6B /r ib IMUL r64, r/m64, imm8 RMI | Valid N.E. Quadword register := r/m64 * sign-extended 
immediate byte. 

69 /riw IMUL 7716, r/m16, imm16 RMI | Valid Valid word register := r/m16 * immediate word. 

69 /rid IMUL r32, r/m32, imm32 RMI | Valid Valid doubleword register := r/m32 * immediate 
doubleword. 

REX.W + 69 /r id IMUL r64, r/m64, imm32 RMI | Valid N.E. Quadword register := r/m64 * immediate 
doubleword. 

NOTES: 

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8/16/32 NA 
Description 


Performs a signed multiplication of two operands. This instruction has three forms, depending on the number of 


operands. 


¢ One-operand form — This form is identical to that used by the MUL instruction. Here, the source operand (in 
a general-purpose register or memory location) is multiplied by the value in the AL, AX, EAX, or RAX register 
(depending on the operand size) and the product (twice the size of the input operand) is stored in the AX, 
DX:AX, EDX:EAX, or RDX:RAX registers, respectively. 


° Two-operand form — With this form the destination operand (the first operand) is multiplied by the source 
operand (second operand). The destination operand is a general-purpose register and the source operand is an 
immediate value, a general-purpose register, or a memory location. The intermediate product (twice the size of 
the input operand) is truncated and stored in the destination operand location. 


¢ Three-operand form — This form requires a destination operand (the first operand) and two source operands 
(the second and the third operands). Here, the first source operand (which can be a general-purpose register 
or a memory location) is multiplied by the second source operand (an immediate value). The intermediate 
product (twice the size of the first source operand) is truncated and stored in the destination operand (a 
general-purpose register). 


IMUL—Signed Multiply 
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When an immediate value is used as an operand, it is sign-extended to the length of the destination operand 
format. 


The CF and OF flags are set when the signed integer value of the intermediate product differs from the sign 
extended operand-size-truncated product, otherwise the CF and OF flags are cleared. 


The three forms of the IMUL instruction are similar in that the length of the product is calculated to twice the length 
of the operands. With the one-operand form, the product is stored exactly in the destination. With the two- and 
three- operand forms, however, the result is truncated to the length of the destination before it is stored in the 
destination register. Because of this truncation, the CF or OF flag should be tested to ensure that no significant bits 
are lost. 


The two- and three-operand forms may also be used with unsigned operands because the lower half of the product 
is the same regardless if the operands are signed or unsigned. The CF and OF flags, however, cannot be used to 
determine if the upper half of the result is non-zero. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. Use of REX.W modifies the three 
forms of the instruction as follows. 


¢ One-operand form —The source operand (in a 64-bit general-purpose register or memory location) is 
multiplied by the value in the RAX register and the product is stored in the RDX:RAX registers. 

° Two-operand form — The source operand is promoted to 64 bits if it is a register or a memory location. The 
destination operand is promoted to 64 bits. 


¢ Three-operand form — The first source operand (either a register or a memory location) and destination 
operand are promoted to 64 bits. If the source operand is an immediate, it is sign extended to 64 bits. 


Operation 


IF (NumberOfOperands = 1) 
THEN IF (OperandSize = 8) 
THEN 
TMP_XP := AL * SRC (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC *); 
AX := TMP_XP[15:0]; 
IF SignExtend(TMP_XP[7:0]) = TMP_XP 
THEN CF := 0; OF := 0; 
ELSE CF := 1; OF := 1; Fl; 
ELSE IF OperandSize = 16 
THEN 
TMP_XP := AX * SRC (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC *) 
DX:AX := TMP_XP[31:0]; 
IF SignExtend(TMP_XP[15:0]) = TMP_XP 
THEN CF := 0; OF := 0; 
ELSE CF := 1; OF := 1; Fl; 
ELSE IF OperandSize = 32 
THEN 
TMP_XP := EAX * SRC (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC*) 
EDX:EAX := TMP_XP[63:0]; 
IF SignExtend(TMP_XP[31:0]) = TMP_XP 
THEN CF := 0; OF := 0; 
ELSE CF := 1; OF := 1; Fl; 
ELSE (* OperandSize = 64 *) 
TMP_XP := RAX * SRC (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC *) 
EDX:EAX := TMP_XP[127:0]; 
IF SignExtend(TMP_XP[63:0]) = TMP_XP 
THEN CF := 0; OF := 0; 
ELSE CF := 1; OF := 1; Fl; 
Fl; 
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Fl; 
ELSE IF (NumberOfOperands = 2) 
THEN 
TMP_XP := DEST * SRC (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC *) 
DEST := TruncateToOperandSize(TMP_XP); 
IF SignExtend(DEST) # TMP_XP 
THEN CF := 1; OF := 1; 
ELSE CF := 0; OF := O; FI; 
ELSE (* NumberOfOperands = 3 *) 
TMP_XP := SRC1 * SRC2 (* Signed multiplication; TMP_XP is a signed integer at twice the width of the SRC1 *) 
DEST := TruncateToOperandSize(TMP_XP); 
IF SignExtend(DEST) # TMP_XP 
THEN CF := 1; OF := 1; 
ELSE CF := 0; OF := O; FI; 
Fl; 
Fl; 


Flags Affected 


For the one operand form of the instruction, the CF and OF flags are set when significant bits are carried into the 
upper half of the result and cleared when the result fits exactly in the lower half of the result. For the two- and 
three-operand forms of the instruction, the CF and OF flags are set when the result must be truncated to fit in the 
destination operand size and cleared when the result fits exactly in the destination operand size. The SF, ZF, AF, and 
PF flags are undefined. 


Protected Mode Exceptions 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL NULL 
segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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IN—Input from Port 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

E4 ib IN AL, imm8 | Valid Valid Input byte from imm8 I/O port address into 
AL. 

E5 ib IN AX, imm8 | Valid Valid Input word from imm8 |/O port address into 
AX. 

E5 ib IN EAX, imm& | Valid Valid Input dword from imm8 |/O port address into 
EAX. 

EC IN AL,DX ZO | Valid Valid Input byte from I/O port in DX into AL. 

ED IN AX,DX ZO | Valid Valid Input word from I/O port in DX into AX. 

ED IN EAX,DX ZO | Valid Valid Input doubleword from I/O port in DX into 
EAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| imm8 NA NA NA 
ZO NA NA NA NA 
Description 


Copies the value from the I/O port specified with the second operand (source operand) to the destination operand 
(first operand). The source operand can be a byte-immediate or the DX register; the destination operand can be 
register AL, AX, or EAX, depending on the size of the port being accessed (8, 16, or 32 bits, respectively). Using the 
DX register as a source operand allows I/O port addresses from 0 to 65,535 to be accessed; using a byte imme- 
diate allows I/O port addresses 0 to 255 to be accessed. 


When accessing an 8-bit I/O port, the opcode determines the port size; when accessing a 16- and 32-bit I/O port, 
the operand-size attribute determines the port size. At the machine code level, I/O instructions are shorter when 
accessing 8-bit I/O ports. Here, the upper eight bits of the port address will be 0. 


This instruction is only useful for accessing I/O ports located in the processor’s I/O address space. See Chapter 19, 
“Input/Output,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for more infor- 
mation on accessing I/O ports in the I/O address space. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


IF ((PE = 1) and ((CPL > IOPL) or (VM = 1))) 
THEN (* Protected mode with CPL > IOPL or virtual-8086 mode *) 
IF (Any I/O Permission Bit for I/O port being accessed = 1) 
THEN (* I/O operation is not allowed *) 
#GP(0); 
ELSE ( * I/O operation is allowed *) 
DEST := SRC; (* Read from selected I/O port *) 
Fl; 
ELSE (Real Mode or Protected Mode with CPL < IOPL *) 
DEST := SRC; (* Read from selected I/O port *) 
FI; 


Flags Affected 
None 
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Protected Mode Exceptions 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If any of the I/O permission bits in the TSS for the I/O port being accessed is 1. 
#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 
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INC—Increment by 1 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
FE /O INC r/m8 M Valid Valid Increment r/m byte by 1. 
REX + FE /O INC r/m&™ M Valid N.E. Increment r/m byte by 1. 
FF /O INC r/m16 M Valid Valid Increment r/m word by 1. 
FF /O INC r/m32 M Valid Valid Increment r/m doubleword by 1. 
REX.W + FF /O INC r/m64 M Valid N.E. Increment r/m quadword by 1. 
40+ rw INC r76 Oo |NE. Valid Increment word register by 1. 
40+ rd INC r32 6) N.E. Valid Increment doubleword register by 1. 
NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 
** AOH through 47H are REX prefixes in 64-bit mode. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
O opcode + rd (r, w) NA NA NA 
Description 


Adds 1 to the destination operand, while preserving the state of the CF flag. The destination operand can be a 
register or a memory location. This instruction allows a loop counter to be updated without disturbing the CF flag. 
(Use a ADD instruction with an immediate operand of 1 to perform an increment operation that does updates the 
CF flag.) 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, INC r16 and INC r32 are not encodable (because opcodes 40H through 47H are REX prefixes). 
Otherwise, the instruction’s 64-bit mode default operation size is 32 bits. Use of the REX.R prefix permits access to 
additional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. 


Operation 


DEST := DEST + 1; 


Flags Affected 
The CF flag is not affected. The OF, SF, ZF, AF, and PF flags are set according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination operand is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULLsegment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF AE /05 R VV CET_SS Increment SSP by 4 * r32[7:0]. 
INCSSPD r32 
F3 REX.W OF AE /05 R V/N.E. CET_SS Increment SSP by 8 * r64[7:0]. 
INCSSPQ r64 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
R NA ModRM:r/m (r) NA NA NA 
Description 


This instruction can be used to increment the current shadow stack pointer by the operand size of the instruction 
times the unsigned 8-bit value specified by bits 7:0 in the source operand. The instruction performs a pop and 
discard of the first and last element on the shadow stack in the range specified by the unsigned 8-bit value in bits 


7:0 of the source operand. 


Operation 
IF CPL = 3 


IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0 
THEN #UD; Fl; 


ELSE 


IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0 
THEN #UD; Fl; 


Fl; 


IF (operand size is 64-bit) 


THEN 


TMP1 = (R64[7:0] == 0) ? 1 : R64[7:0] 
TMP = ShadowStackLoad8B(SSP) 
TMP = ShadowStackLoad8B(SSP + TMP1 * 8 - 8) 


SSP := SSP + R64[7:0] * 8; 


ELSE 


TMP1 = (R32[7:0] == 0)? 1: R32[7:0] 
TMP = ShadowStackLoad4B(SSP) 
TMP = ShadowStackLoad4B(SSP + TMP1 * 4 - 4) 


SSP := SSP + R32[7:0] * 4; 


Fl; 


Flags Affected 


None. 


Intel C/C++ Compiler Intrinsic Equivalent 


INCSSPD void _incsspd(int); 
INCSSPQ void _incsspq(int); 
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Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. 
IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 
#PF(fault-code) If a page fault occurs. 


Real-Address Mode Exceptions 
#UD The INCSSP instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The INCSSP instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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INS/INSB/INSW/INSD—Input from Port to String 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

6C INS m8, DX ZO | Valid Valid Input byte from I/O port specified in DX into 
memory location specified in ES:(E)DI or RDI.* 

6D INS m16, DX ZO | Valid Valid Input word from I/O port specified in DX into 
memory location specified in €S:(E)DI or RDI." 

6D INS m32, DX ZO | Valid Valid Input doubleword from I/O port specified in DX 
into memory location specified in ES:(E)DI or 
RDI. 

6C INSB ZO | Valid Valid Input byte from I/O port specified in DX into 
memory location specified with ES:(€)DI or 
RDI. 

6D INSW ZO ‘| Valid Valid Input word from I/O port specified in DX into 
memory location specified in €S:(E)DI or RDI." 

6D INSD ZO | Valid Valid Input doubleword from I/O port specified in DX 
into memory location specified in ES:(E)DI or 
RDI. 

NOTES: 


* In 64-bit mode, only 64-bit (RDI) and 32-bit (EDI) address sizes are supported. In non-64-bit mode, only 32-bit (EDI) and 16-bit (Dl) 
address sizes are supported. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Copies the data from the I/O port specified with the source operand (second operand) to the destination operand 
(first operand). The source operand is an I/O port address (from 0 to 65,535) that is read from the DX register. The 
destination operand is a memory location, the address of which is read from either the ES:DI, ES:EDI or the RDI 
registers (depending on the address-size attribute of the instruction, 16, 32 or 64, respectively). (The ES segment 
cannot be overridden with a segment override prefix.) The size of the I/O port being accessed (that is, the size of 
the source and destination operands) is determined by the opcode for an 8-bit I/O port or by the operand-size attri- 
bute of the instruction for a 16- or 32-bit I/O port. 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the INS mnemonic) allows the source and destination 
operands to be specified explicitly. Here, the source operand must be “DX,” and the destination operand should be 
a symbol that indicates the size of the I/O port and the destination address. This explicit-operands form is provided 
to allow documentation; however, note that the documentation provided by this form can be misleading. That is, 
the destination operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword), 
but it does not have to specify the correct location. The location is always specified by the ES:(E)DI registers, 
which must be loaded correctly before the INS instruction is executed. 


The no-operands form provides “short forms” of the byte, word, and doubleword versions of the INS instructions. 
Here also DX is assumed by the processor to be the source operand and ES:(E)DI is assumed to be the destination 
operand. The size of the I/O port is specified with the choice of mnemonic: INSB (byte), INSW (word), or INSD 
(doubleword). 


After the byte, word, or doubleword is transfer from the I/O port to the memory location, the DI/EDI/RDI register 
is incremented or decremented automatically according to the setting of the DF flag in the EFLAGS register. (If the 
DF flag is 0, the (E)DI register is incremented; if the DF flag is 1, the (E)DI register is decremented.) The (E)DI 
register is incremented or decremented by 1 for byte operations, by 2 for word operations, or by 4 for doubleword 
operations. 
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The INS, INSB, INSW, and INSD instructions can be preceded by the REP prefix for block input of ECX bytes, words, 
or doublewords. See “REP/REPE/REPZ /REPNE/REPNZ—Repeat String Operation Prefix” in Chapter 4 of the Inte/® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 2B, for a description of the REP prefix. 


These instructions are only useful for accessing I/O ports located in the processor's I/O address space. See Chapter 
19, “Input/Output,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for more 
information on accessing I/O ports in the I/O address space. 


In 64-bit mode, default address size is 64 bits, 32 bit address size is supported using the prefix 67H. The address 
of the memory destination is specified by RDI or EDI. 16-bit address size is not supported in 64-bit mode. The 
operand size is not promoted. 


These instructions may read from the I/O port without writing to the memory location if an exception or VM exit 
occurs due to the write (e.g. #PF). If this would be problematic, for example because the I/O port read has side- 
effects, software should ensure the write to the memory location does not cause an exception or VM exit. 


Operation 


IF ((PE = 1) and ((CPL > IOPL) or (VM = 1))) 
THEN (* Protected mode with CPL > IOPL or virtual-8086 mode *) 
IF (Any I/O Permission Bit for I/O port being accessed = 1) 
THEN (* I/O operation is not allowed *) 
#GP(0); 
ELSE (* I/O operation is allowed *) 
DEST := SRC; (* Read from I/O port *) 
FI; 
ELSE (Real Mode or Protected Mode with CPL IOPL *) 
DEST := SRC; (* Read from I/O port *) 
FI; 


Non-64-bit Mode: 


IF (Byte transfer) 
THEN IF DF =0 
THEN (€)DI := (€)DI + 1; 
ELSE (E)DI := (€)DI - 1; FI; 
ELSE IF (Word transfer) 
THEN IF DF = O 
THEN (€)DI := (E)DI + 2; 
ELSE (E)DI := (€)DI - 2; FI; 
ELSE (* Doubleword transfer *) 
THEN IF DF =0 
THEN (€)DI := (E)DI + 4; 
ELSE (E)DI := (€)DI - 4; FI; 
FI; 
FI; 


FI64-bit Mode: 


IF (Byte transfer) 
THEN IF DF =0 
THEN (E|R)DI := (E[R)DI + 1; 
ELSE (E|R)DI := (EJR)DI - 1; Fl; 
ELSE IF (Word transfer) 
THEN IF DF = 0 
THEN (€)DI := (€)DI + 2; 
ELSE (€)DI := (E)DI - 2; FI; 
ELSE (* Doubleword transfer *) 
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THEN IF DF = 0 
THEN (E|R)DI := (E]R)DI + 4; 
ELSE (E|R)DI := (E[R)DI - 4; FI; 
Fl; 
Fl; 


Flags Affected 
None 


Protected Mode Exceptions 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


If the destination is located in a non-writable segment. 
If an illegal memory operand effective address in the ES segments is given. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If any of the I/O permission bits in the TSS for the I/O port being accessed is 1. 
#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


If the memory address is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 
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INSERTPS—Insert Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 3A 21 /rib A VIV SSE4_1 Insert a single-precision floating-point value selected 
INSERTPS xmm1, xmm2/m32, imm8 by imm8 from xmm2/m32 into xmm1 at the specified 
destination element specified by imm8 and zero out 
destination elements in xmm1 as indicated in imm8. 
VEX.128.66.0F3A.WIG 21 /r ib B VIV AVX Insert a single-precision floating-point value selected 
VINSERTPS xmm1, xmm_2, by imm8 from xmm3/m32 and merge with values in 
xmm3/m32, imm8 xmmce at the specified destination element specified 
by imm8 and write out the result and zero out 
destination elements in xmm1 as indicated in imm8. 
EVEX.128.66.0F3A.WO 21 /r ib C VIV AVX512F | Insert a single-precision floating-point value selected 
VINSERTPS xmm1, xmm2, by imm8 from xmm3/m32 and merge with values in 
xmm3/m32, imm8 xmmcz at the specified destination element specified 
by imm8 and write out the result and zero out 
destination elements in xmm1 as indicated in imm8s. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8s NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


(register source form) 


Copy a single-precision scalar floating-point element into a 128-bit vector register. The immediate operand has 
three fields, where the ZMask bits specify which elements of the destination will be set to zero, the Count_D bits 
specify which element of the destination will be overwritten with the scalar value, and for vector register sources 
the Count_S bits specify which element of the source will be copied. When the scalar source is a memory operand 


the Count_S bits are ignored. 
(memory source form) 


Load a floating-point element from a 32-bit memory location and destination operand it into the first source at the 
location indicated by the Count_D bits of the immediate operand. Store in the destination and zero out destination 
elements based on the ZMask bits of the immediate operand. 


128-bit Legacy SSE version: The first source register is an XMM register. The second source operand is either an 
XMM register or a 32-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding register destination are unmodified. 


VEX.128 and EVEX encoded version: The destination and first source register is an XMM register. The second 
source operand is either an XMM register or a 32-bit memory location. The upper bits (MAXVL-1:128) of the corre- 


sponding register destination are zeroed. 


If VINSERTPS is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause 


an #UD exception. 
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Operation 


VINSERTPS (VEX.128 and EVEX encoded version) 
IF (SRC = REG) THEN COUNT_S := imm8[7:6] 
ELSE COUNT_S := 0 
COUNT_D := imm8[5:4] 
ZMASK := imm8[3:0] 
CASE (COUNT_S) OF 
0: TMP := SRC2[31:0] 
1: TMP := SRC2[63:32] 
2: TMP := SRC2[95:64] 
3: TMP := SRC2[127:96] 
ESAC; 
CASE (COUNT_D) OF 
0: TMP2[31:0] := TMP 
TMP2[1 27:32] := SRC1[127:32] 
1: TMP2[63:32] := TMP 
TMP2[31:0] := SRC1[31:0] 
TMP2[1 27:64] := SRC1[127:64] 
2: TMP2[95:64] := TMP 
TMP2[63:0] := SRC1[63:0] 
TMP2[1 27:96] := SRC1[127:96] 
3: TMP2[127:96] := TMP 
TMP2[95:0] := SRC1[95:0] 
ESAC; 


IF (ZMASK[O] = 1) THEN DEST[31:0] := OO0O0000H 
ELSE DEST[31:0] := TMP2[31:0] 

IF (ZMASK[1] = 1) THEN DEST[63:32] := OOO00000H 
ELSE DEST[63:32] = TMP2[63:32] 

IF (ZMASK[2] = 1) THEN DEST[95:64] := O0OO00000H 
ELSE DEST[95:64] = TMP2[95:64] 

IF (ZMASK[3] = 1) THEN DEST[127:96] := OO000000H 
ELSE DEST[127:96] := TMP2[127:96] 

DEST[MAXVL-1:128] = 0 


INSERTPS (128-bit Legacy SSE version) 
IF (SRC = REG) THEN COUNT_S :=imm8[7:6] 
ELSE COUNT_S :=0 
COUNT_D := imm8[5:4] 
ZMASK := imm8[3:0] 
CASE (COUNT_S) OF 
O: TMP := SRC[31:0] 
1: TMP := SRC[63:32] 
2: TMP := SRC[95:64] 
3: TMP := SRC[127:96] 
ESAC; 


CASE (COUNT_D) OF 
0: TMP2[31:0] := TMP 
TMP2[127:32] := DEST[127:32] 
1: TMP2[63:32] := TMP 
TMP2[31:0] := DEST[31:0] 
TMP2[127:64] := DEST[127:64] 
2: TMP2[95:64] := TMP 
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TMP2[63:0] := DEST[63:0] 
TMP2[127:96] := DEST[127:96] 
3: TMP2[127:96] = TMP 
TMP2[95:0] := DEST[95:0] 
ESAC; 


IF (ZMASK[O] = 1) THEN DEST[31:0] = OO0O0000H 
ELSE DEST[31:0] := TMP2[31:0] 

IF (ZMASK[1] = 1) THEN DEST[63:32] := OOO00000H 
ELSE DEST[63:32] = TMP2[63:32] 

IF (ZMASK[2] = 1) THEN DEST[95:64] := OOO00000H 
ELSE DEST[95:64] = TMP2[95:64] 

IF (ZMASK[3] = 1) THEN DEST[127:96] := OO000000H 
ELSE DEST[127:96] := TMP2[127:96] 

DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VINSERTPS __m128 _mm_insert_ps(__m128 dst, __m128 src, const int nidx); 
INSETRTPS __m128 _mm_insert_ps(__m128 dst, ___m128 src, const int nidx); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0. 

EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
CC INT3 ZO | Valid Valid Generate breakpoint trap. 
CD ib INT imm8 | Valid Valid Generate software interrupt with vector 
specified by immediate byte. 
CE INTO ZO | Invalid Valid Generate overflow trap if overflow flag is 1. 
FI INT1 ZO | Valid Valid Generate debug trap. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 

ZO NA NA NA NA 

| imm8 NA NA NA 
Description 


The INT rn instruction generates a call to the interrupt or exception handler specified with the destination operand 
(see the section titled “Interrupts and Exceptions” in Chapter 6 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1). The destination operand specifies a vector from 0 to 255, encoded as an 8-bit 
unsigned intermediate value. Each vector provides an index to a gate descriptor in the IDT. The first 32 vectors are 
reserved by Intel for system use. Some of these vectors are used for internally generated exceptions. 


The INT rn instruction is the general mnemonic for executing a software-generated call to an interrupt handler. The 
INTO instruction is a special mnemonic for calling overflow exception (#OF), exception 4. The overflow interrupt 
checks the OF flag in the EFLAGS register and calls the overflow interrupt handler if the OF flag is set to 1. (The 
INTO instruction cannot be used in 64-bit mode.) 


The INT3 instruction uses a one-byte opcode (CC) and is intended for calling the debug exception handler with a 
breakpoint exception (#BP). (This one-byte form is useful because it can replace the first byte of any instruction at 
which a breakpoint is desired, including other one-byte instructions, without overwriting other instructions.) 


The INT1 instruction also uses a one-byte opcode (F1) and generates a debug exception (#DB) without setting any 
bits in DR6.1 Hardware vendors may use the INT1 instruction for hardware debug. For that reason, Intel recom- 
mends software vendors instead use the INT3 instruction for software breakpoints. 


An interrupt generated by the INTO, INT3, or INT1 instruction differs from one generated by INT n in the following 
ways: 


¢ The normal IOPL checks do not occur in virtual-8086 mode. The interrupt is taken (without fault) with any IOPL 
value. 


¢ The interrupt redirection enabled by the virtual-8086 mode extensions (VME) does not occur. The interrupt is 
always handled by a protected-mode handler. 


(These features do not pertain to CD03, the “normal” 2-byte opcode for INT 3. Intel and Microsoft assemblers will 
not generate the CD03 opcode from any mnemonic, but this opcode can be created by direct numeric code defini- 
tion or by self-modifying code.) 


The action of the INT rn instruction (including the INTO, INT3, and INT1 instructions) is similar to that of a far call 
made with the CALL instruction. The primary difference is that with the INT n instruction, the EFLAGS register is 
pushed onto the stack before the return address. (The return address is a far address consisting of the current 
values of the CS and EIP registers.) Returns from interrupt procedures are handled with the IRET instruction, which 
pops the EFLAGS information and return address from the stack. 


Each of the INT n, INTO, and INT3 instructions generates a general-protection exception (#GP) if the CPL is greater 
than the DPL value in the selected gate descriptor in the IDT. In contrast, the INT1 instruction can deliver a #DB 


1. The mnemonic ICEBP has also been used for the instruction with opcode F1. 
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even if the CPL is greater than the DPL of descriptor 1 in the IDT. (This behavior supports the use of INT1 by hard- 
ware vendors performing hardware debug.) 


The vector specifies an interrupt descriptor in the interrupt descriptor table (IDT); that is, it provides index into the 
IDT. The selected interrupt descriptor in turn contains a pointer to an interrupt or exception handler procedure. 
In protected mode, the IDT contains an array of 8-byte descriptors, each of which is an interrupt gate, trap gate, 
or task gate. In real-address mode, the IDT is an array of 4-byte far pointers (2-byte code segment selector and 
a 2-byte instruction pointer), each of which point directly to a procedure in the selected segment. (Note that in 
real-address mode, the IDT is called the interrupt vector table, and its pointers are called interrupt vectors. ) 


The following decision table indicates which action in the lower portion of the table is taken given the conditions in 
the upper portion of the table. Each Y in the lower section of the decision table represents a procedure defined in 
the “Operation” section for this instruction (except #GP). 


Table 3-52. Decision Table 
PE 0 1 1 1 1 1 1 1 


VM - - - - - 0 1 1 

IOPL - - - - - - <3 =3 

DPL/CPL - DPL< - DPL> DPL= DPL< - - 

RELATIONSHIP CPL CPL CPL or C CPL & NC 

INTERRUPT TYPE - S/W - - - - - - 

GATE TYPE - - Task Trap or Trap or Trap or Trap or Trap or 
Interrupt Interrupt Interrupt Interrupt Interrupt 


REAL-ADDRESS-MODE Y 
PROTECTED-MODE Y Y Y Y 


TRAP-OR-INTERRUPT- Y Y 
GATE 


INTER-PRIVILEGE-LEVEL- Y 
INTERRUPT 


INTRA-PRIVILEGE-LEVEL- Y 
INTERRUPT 


INTERRUPT-FROM- Y 
VIRTUAL-8086-MODE 


TASK-GATE Y 
#GP Y Y Y 
NOTES: 

— Don't Care. 

Y Yes, action taken. 
Blank Action not taken. 
S/W _ Applies to INT n, INT3, and INTO, but not to INT1. 


When the processor is executing in virtual-8086 mode, the IOPL determines the action of the INT n instruction. If 
the IOPL is less than 3, the processor generates a #GP(selector) exception; if the IOPLis 3, the processor executes 
a protected mode interrupt to privilege level 0. The interrupt gate's DPL must be set to 3 and the target CPL of the 
interrupt handler procedure must be 0 to execute the protected mode interrupt to privilege level 0. 


The interrupt descriptor table register (IDTR) specifies the base linear address and limit of the IDT. The initial base 
address value of the IDTR after the processor is powered up or reset is 0. 


Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Tech- 
nology (CET)” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET details. 
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Instruction ordering. Instructions following an INT n may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the INT n have 
completed execution (the later instructions may execute before data stored by the earlier instructions have 
become globally visible). This applies also to the INTO, INT3, and INT1 instructions, but not to executions of INTO 
when EFLAGS.OF = 0. 


Operation 


The following operational description applies not only to the INT n, INTO, INT3, or INT1 instructions, but also to 
external interrupts, nonmaskable interrupts (NMIs), and exceptions. Some of these events push onto the stack an 
error code. 


The operational description specifies numerous checks whose failure may result in delivery of a nested exception. 
In these cases, the original event is not delivered. 


The operational description specifies the error code delivered by any nested exception. In some cases, the error 
code is specified with a pseudofunction error_code(num,idt,ext), where idt and ext are bit values. The pseudofunc- 
tion produces an error code as follows: (1) if idt is 0, the error code is (num & FCH) | ext; (2) if idt is 1, the error 
code is (num « 3) | 2 | ext. 


In many cases, the pseudofunction error_code is invoked with a pseudovariable EXT. The value of EXT depends on 
the nature of the event whose delivery encountered a nested exception: if that event is a software interrupt (INT n, 
INT3, or INTO), EXT is 0; otherwise (including INT1), EXT is 1. 


IF PE=0 
THEN 
GOTO REAL-ADDRESS-MODE; 
ELSE (* PE= 1 *) 
IF (EFLAGS.VM = 1 AND CR4.VME = 0 AND IOPL < 3 AND INT n) 
THEN 
#GP(0); (* Bit O of error code is O because INT n *) 
ELSE 
IF (EFLAGS.VM = 1 AND CR4.VME = 1 AND INT n) 
THEN 
Consult bit n of the software interrupt redirection bit map in the TSS; 
IF bit nis clear 
THEN (* redirect interrupt to 8086 program interrupt handler *) 
Push EFLAGS[15:0]; = (* if IOPL < 3, save VIF in IF position and save IOPL position as 3 *) 
Push CS; 
Push IP; 
IF IOPL = 3 
THEN IF := 0; (* Clear interrupt flag *) 
ELSE VIF := 0; (* Clear virtual interrupt flag *) 
Fl; 
TF := 0; (* Clear trap flag *) 
load CS and EIP (lower 16 bits only) from entry nin interrupt vector table referenced from TSS; 
ELSE 
IF IOPL = 3 
THEN GOTO PROTECTED-MODE; 
ELSE #GP(0); (* Bit O of error code is O because INT n *) 
Fl; 
Fl; 
ELSE (* Protected mode, IA-32e mode, or virtual-8086 mode interrupt *) 
IF (IA32_EFER.LMA = 0) 
THEN (* Protected mode, or virtual-8086 mode interrupt *) 
GOTO PROTECTED-MODE; 
ELSE (* IA-32e mode interrupt *) 
GOTO IA-32e-MODE; 
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FI; 
FI; 
FI; 
FI; 
REAL-ADDRESS-MODE: 
IF ((vector_number « 2) + 3) is not within IDT limit 
THEN #GP; Fl; 
IF stack not large enough for a 6-byte return information 
THEN #SS; FI; 
Push (EFLAGS[1 5:0); 
IF := 0; (* Clear interrupt flag *) 
TF := 0; (* Clear trap flag *) 
AC := 0; (* Clear AC flag *) 
Push(CS); 
Push(IP); 
(* No error codes are pushed in real-address mode”) 
CS := IDT(Descriptor (vector_number « 2), selector)); 
EIP := IDT(Descriptor (vector_number « 2), offset)); (* 16 bit offset AND OOOOFFFFH *) 
END; 
PROTECTED-MODE: 
IF ((vector_number « 3) + 7) is not within IDT limits 
or selected IDT descriptor is not an interrupt-, trap-, or task-gate type 
THEN #GP(error_code(vector_number,1,EXT)); Fl; 
(* idt operand to error_code set because vector is used *) 
IF software interrupt (* Generated by INT n, INT3, or INTO; does not apply to INT1 *) 
THEN 
IF gate DPL < CPL (* PE = 1, DPL < CPL, software interrupt *) 
THEN #GP(error_code(vector_number, 1,0); FI; 
(* idt operand to error_code set because vector is used *) 
(* ext operand to error_code is O because INT n, INT3, or INTO*) 
Fl; 
IF gate not present 
THEN #NP(error_code(vector_number,1,EXT)); Fl; 
(* idt operand to error_code set because vector is used *) 
IF task gate (* Specified in the selected interrupt table descriptor *) 
THEN GOTO TASK-GATE; 
ELSE GOTO TRAP-OR-INTERRUPT-GATE; (* PE = 1, trap/interrupt gate *) 
Fl; 
END; 
|A-32e-MODE: 
IF INTO and CS.L = 1 (64-bit mode) 
THEN #UD; 
Fl; 
IF ((vector_number « 4) + 15) is not in IDT limits 
or selected IDT descriptor is not an interrupt-, or trap-gate type 
THEN #GP(error_code(vector_number,1,EXT)); 
(* idt operand to error_code set because vector is used *) 
Fl; 
IF software interrupt (* Generated by INT n, INT3, or INTO; does not apply to INT1 *) 
THEN 
IF gate DPL < CPL (* PE = 1, DPL < CPL, software interrupt *) 
THEN #GP(error_code(vector_number,1,0)); 
(* idt operand to error_code set because vector is used *) 
(* ext operand to error_code is O because INT n, INT3, or INTO*) 


3-506 Vol. 2A INT n/AINTO/INT3/INT 1—Call to Interrupt Procedure 


Fl; 
Fl; 
IF gate not present 
THEN #NP(error_code(vector_number,1,EXT)); 
(* idt operand to error_code set because vector is used *) 
Fl; 
GOTO TRAP-OR-INTERRUPT-GATE; (* Trap/interrupt gate *) 
END; 
TASK-GATE: (* PE = 1, task gate *) 
Read TSS selector in task gate (IDT descriptor); 
IF local/global bit is set to local or index not within GDT limits 
THEN #GP(error_code(TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
Access TSS descriptor in GDT; 
IF TSS descriptor specifies that the TSS is busy (low-order 5 bits set to 00001) 
THEN #GP(error_code(TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
IF TSS not present 
THEN #NP(error_code(TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
SWITCH-TASKS (with nesting) to TSS; 
IF interrupt caused by fault with error code 
THEN 
IF stack limit does not allow push of error code 
THEN #SS(EXT); Fl; 
Push(error code); 
Fl; 
IF EIP not within code segment limit 
THEN #GP(EXT); Fl; 
END; 
TRAP-OR-INTERRUPT-GATE: 
Read new code-segment selector for trap or interrupt gate (IDT descriptor); 
IF new code-segment selector is NULL 
THEN #GP(EXT); Fl; (* Error code contains NULL selector *) 
IF new code-segment selector is not within its descriptor table limits 
THEN #GP(error_code(new code-segment selector,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
Read descriptor referenced by new code-segment selector; 
IF descriptor does not indicate a code segment or new code-segment DPL > CPL 
THEN #GP(error_code(new code-segment selector,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
IF new code-segment descriptor is not present, 
THEN #NP(error_code(new code-segment selector,0,EXT)); FI; 
(* idt operand to error_code is O because selector is used *) 
IF new code segment is non-conforming with DPL < CPL 
THEN 
IF VM =0 
THEN 
GOTO INTER-PRIVILEGE-LEVEL-INTERRUPT; 
(* PE = 1, VM = 0, interrupt or trap gate, nonconforming code segment, 
DPL < CPL *) 
ELSE (* VM = 1 *) 
IF new code-segment DPL 4 0 
THEN #GP(error_code(new code-segment selector,0,EXT)); 
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(* idt operand to error_code is O because selector is used *) 
GOTO INTERRUPT-FROM-VIRTUAL-8086-MODE; FI; 
(* PE = 1, interrupt or trap gate, DPL < CPL, VM = 1 *) 


Fl; 
ELSE (* PE = 1, interrupt or trap gate, DPL > CPL *) 
IF VM = 1 


THEN #GP(error_code(new code-segment selector,0,EXT)); 
(* idt operand to error_code is O because selector is used *) 
IF new code segment is conforming or new code-segment DPL = CPL 
THEN 
GOTO INTRA-PRIVILEGE-LEVEL-INTERRUPT; 
ELSE (* PE = 1, interrupt or trap gate, nonconforming code segment, DPL > CPL *) 
#GP(error_code(new code-segment selector,0,EXT)); 
(* idt operand to error_code is 0 because selector is used *) 
FI; 
Fl; 
END; 
INTER-PRIVILEGE-LEVEL-INTERRUPT: 
(* PE = 1, interrupt or trap gate, non-conforming code segment, DPL < CPL *) 
IF (IA32_EFER.LMA = 0) (* Not IA-32e mode *) 
THEN 
(* Identify stack-segment selector for new privilege level in current TSS *) 
IF current TSS is 32-bit 
THEN 
TSSstackAddress := (new code-segment DPL « 3) + 4; 
IF (TSSstackAddress + 5) > current TSS limit 
THEN #TS(error_code(current TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
NewsSS := 2 bytes loaded from (TSS base + TSSstackAddress + 4); 
NewESP := 4 bytes loaded from (TSS base + TSSstackAddress); 
ELSE (* current TSS is 16-bit *) 
TSSstackAddress := (new code-segment DPL « 2) + 2 
IF (TSSstackAddress + 3) > current TSS limit 
THEN #TS(error_code(current TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
NewsSS := 2 bytes loaded from (TSS base + TSSstackAddress + 2); 
NewESP := 2 bytes loaded from (TSS base + TSSstackAddress); 
FI; 
IF NewSS is NULL 
THEN #TS(EXT); Fl; 
IF NewSS index is not within its descriptor-table limits 
or NewSS RPL # new code-segment DPL 
THEN #TS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
Read new stack-segment descriptor for NewSS in GDT or LDT; 
IF new stack-segment DPL # new code-segment DPL 
or new stack-segment Type does not indicate writable data segment 
THEN #TS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
IF NewSS is not present 
THEN #SS(error_code(NewSS,0,EXT)); FI; 
(* idt operand to error_code is O because selector is used *) 
NewSSP := IA32_PLi_SSP (* where i = new code-segment DPL *) 
ELSE (* IA-32e mode *) 
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IF IDT-gate IST = 0 
THEN TSSstackAddress := (new code-segment DPL « 3) + 4; 
ELSE TSSstackAddress := (IDT gate IST « 3) + 28; 
Fl; 
IF (TSSstackAddress + 7) > current TSS limit 
THEN #TS(error_code(current TSS selector,0,EXT); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
NewRSP := 8 bytes loaded from (current TSS base + TSSstackAddress); 
NewSS := new code-segment DPL; (* NULL selector with RPL = new CPL *) 
IF IDT-gate IST = 0 
THEN 
NewSSP := IA32_PLi_SSP (* where i = new code-segment DPL *) 
ELSE 
NewSSPAddress = |A32_INTERRUPT_SSP_TABLE_ADDR + (IDT-gate IST « 3) 
(* Check if shadow stacks are enabled at CPL 0 *) 
IF ShadowStackEnabled(CPL 0) 
THEN NewSSP := 8 bytes loaded from NewSSPAddress; FI; 
Fl; 
Fl; 
IF IDT gate is 32-bit 
THEN 
IF new stack does not have room for 24 bytes (error code pushed) 
or 20 bytes (no error code pushed) 
THEN #SS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
Fl 
ELSE 
IF IDT gate is 16-bit 
THEN 
IF new stack does not have room for 12 bytes (error code pushed) 
or 10 bytes (no error code pushed); 
THEN #SS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
ELSE (* 64-bit IDT gate”) 
IF StackAddress is non-canonical 
THEN #SS(EXT); Fl; (* Error code contains NULL selector *) 
Fl; 
Fl; 
IF (IA32_EFER.LMA = 0) (* Not IA-32e mode *) 
THEN 
IF instruction pointer from IDT gate is not within new code-segment limits 
THEN #GP(EXT); FI; (* Error code contains NULL selector *) 
ESP := NewESP; 
SS := NewSS; (* Segment descriptor information also loaded *) 
ELSE (* IA-32e mode *) 
IF instruction pointer from IDT gate contains a non-canonical address 
THEN #GP(EXT); Fl; (* Error code contains NULL selector *) 
RSP := NewRSP & FFFFFFFFFFFFFFFOH; 
SS := NewSS; 
Fl; 
IF IDT gate is 32-bit 
THEN 
CS:EIP := Gate(CS:EIP); (* Segment descriptor information also loaded *) 
ELSE 
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IF IDT gate 16-bit 
THEN 
CS:IP := Gate(CS:IP); 
(* Segment descriptor information also loaded *) 
ELSE (* 64-bit IDT gate *) 
CS:RIP := Gate(CS:RIP); 
(* Segment descriptor information also loaded *) 
FI; 
Fl; 
IF IDT gate is 32-bit 
THEN 
Push(far pointer to old stack); 
(* Old SS and ESP, 3 words padded to 4 *) 
Push(EFLAGS); 
Push(far pointer to return instruction); 
(* Old CS and EIP, 3 words padded to 4 *) 
Push(ErrorCode); (* If needed, 4 bytes *) 
ELSE 
IF IDT gate 16-bit 
THEN 
Push(far pointer to old stack); 
(* Old SS and SP, 2 words *) 
Push(EFLAGS(15:0)); 
Push(far pointer to return instruction); 
(* Old CS and IP, 2 words *) 
Push(ErrorCode); (* If needed, 2 bytes *) 
ELSE (* 64-bit IDT gate *) 
Push(far pointer to old stack); 
(* Old SS and SP, each an 8-byte push *) 
Push(RFLAGS); (* 8-byte push *) 
Push(far pointer to return instruction); 
(* Old CS and RIP, each an 8-byte push *) 
Push(ErrorCode); (* If needed, 8-bytes *) 
FI; 
Fl; 
IF ShadowStackEnabled(CPL) AND CPL = 3 
THEN 
IF IA32_EFER.LMA = 0 
THEN IA32_PL3_SSP := SSP; 
ELSE (* adjust so bits 63:N get the value of bit N-1, where N is the CPU's maximum linear-address width *) 
IA32_PL3_SSP := LA_adjust(SSP); 
FI; 
Fl; 
CPL := new code-segment DPL; 
CS(RPL) := CPL; 
IF ShadowStackEnabled(CPL) 
oldSSP := SSP 
SSP := NewSSP 
IF SSP & 0x07 != 0 
THEN #GP(0); Fl; 
(* Token and CS:LIP:oldSSP pushed on shadow stack must be contained in a naturally aligned 32-byte region *) 
IF (SSP & ~Ox1F) I= ((SSP - 24) & ~Ox1F) 
#GP(0); FI; 
IF ((IA32_EFER.LMA and CS.L) = 0 AND SSP[63:32] != 0) 
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THEN #GP(0); Fl; 

expected_token_value = SSP (* busy bit - bit position O - must be clear *) 

new_token_value = SSP | BUSY_BIT (* Set the busy bit *) 

IF shadow_stack_lock_cmpxchg8b(SSP, new_token_value, expected_token_value) != expected_token_value 
THEN #GP(0); Fl; 


IF oldSS.DPL != 3 
(* These stack pushes should not cause faults, VM exits, data breakpoints *) 
(* Such events will apply to the earlier accesses to the token, which is in the same 32-byte region *) 
ShadowStackPush8B(oldCS); (* Padded with 48 high-order bits of 0 *) 
ShadowStackPush8B(oldCSBASE + oldRIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(oldSSP); 
Fl; 
Fl; 
IF EndbranchEnabled (CPL) 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_S_CET.SUPPRESS = 0 
Fl; 
IF IDT gate is interrupt gate 
THEN IF := O (* Interrupt flag set to O, interrupts disabled *); FI; 
TF := 0; 
VM := 0; 
RF := 0; 
NT := 0; 
END; 
INTERRUPT-FROM-VIRTUAL-8086-MODE: 
(* Identify stack-segment selector for privilege level O in current TSS *) 
IF current TSS is 32-bit 
THEN 
IF TSS limit < 9 
THEN #TS(error_code(current TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
NewSS := 2 bytes loaded from (current TSS base + 8); 
NewESP := 4 bytes loaded from (current TSS base + 4); 
ELSE (* current TSS is 16-bit *) 
IF TSS limit < 5 
THEN #TS(error_code(current TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
NewSS := 2 bytes loaded from (current TSS base + 4); 
NewESP := 2 bytes loaded from (current TSS base + 2); 
Fl; 
IF NewSS is NULL 
THEN #TS(EXT); Fl; (* Error code contains NULL selector *) 
IF NewSS index is not within its descriptor table limits 
or NewSS RPL 40 
THEN #TS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is O because selector is used *) 
Read new stack-segment descriptor for NewSS in GDT or LDT; 
IF new stack-segment DPL # 0 or stack segment does not indicate writable data segment 
THEN #TS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
IF new stack segment not present 
THEN #SS(error_code(NewSS,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
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NewSSP := IA32_PLi_SSP (* where i = new code-segment DPL *) 
IF IDT gate is 32-bit 
THEN 
IF new stack does not have room for 40 bytes (error code pushed) 
or 36 bytes (no error code pushed) 
THEN #SS(error_code(NewSS,0,EXT)); FI; 
(* idt operand to error_code is O because selector is used *) 
ELSE (* IDT gate is 16-bit) 
IF new stack does not have room for 20 bytes (error code pushed) 
or 18 bytes (no error code pushed) 
THEN #SS(error_code(NewSS,0,EXT)); FI; 
(* idt operand to error_code is O because selector is used *) 
Fl; 
IF instruction pointer from IDT gate is not within new code-segment limits 
THEN #GP(EXT); Fl; (* Error code contains NULL selector *) 
tempEFLAGS := EFLAGS; 
VM := 0; 
TF := 0; 
RF := 0; 
NT := 0; 
IF service through interrupt gate 
THEN IF = 0; FI; 
TempSS := SS; 
Temp€SP := ESP; 
SS := NewSS; 
ESP := NewESP; 
(* Following pushes are 16 bits for 16-bit IDT gates and 32 bits for 32-bit IDT gates; 
Segment selector pushes in 32-bit mode are padded to two words *) 
Push(GS); 
Push(FS); 
Push(DS); 
Push(ES); 
Push(TempSS); 
Push(Temp€SP); 
Push(Temp€Flags); 
Push(CS); 
Push(EIP); 
GS := 0; (* Segment registers made NULL, invalid for use in protected mode *) 


CS := Gate(CS); (* Segment descriptor information also loaded *) 
CS(RPL) := 0; 
CPL := 0; 
IF IDT gate is 32-bit 
THEN 
EIP := Gate(instruction pointer); 
ELSE (* IDT gate is 16-bit *) 
EIP := Gate(instruction pointer) AND OOOOFFFFH; 


Fl; 

IF ShadowStackEnabled(CPL) 
oldSSP := SSP 
SSP := NewSSP 


IF SSP & 0x07 != 0 
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THEN #GP(0); Fl; 
(* Token and CS:LIP:oldSSP pushed on shadow stack must be contained in a naturally aligned 32-byte region *) 
IF (SSP & ~Ox1F) != ((SSP - 24) & ~0x1F) 
#GP(0); Fl; 
IF ((IA32_EFER.LMA and CS.L) = 0 AND SSP[63:32] != 0) 
THEN #GP(0); Fl; 
expected_token_value = SSP (* busy bit - bit position O - must be clear *) 
new_token_value = SSP | BUSY_BIT (* Set the busy bit *) 
IF shadow_stack_lock_cmpxchg8b(SSP, new_token_value, expected_token_value) != expected_token_value 
THEN #GP(0); Fl; 
IF oldSS.DPL != 3 
(* These stack pushes should not cause faults, VM exits, or data breakpoints *) 
(* Such events will apply to the earlier accesses to the token, which is in the same 32-byte region *) 
ShadowStackPush8B(oldCS); (* Padded with 48 high-order bits of 0 *) 
ShadowStackPush8B(oldCSBASE + oldRIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(oldSSP); 
Fl; 
Fl; 
IF EndbranchEnabled (CPL) 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_S_CET.SUPPRESS = 0 
Fl; 
(* Start execution of new routine in Protected Mode *) 
END; 


INTRA-PRIVILEGE-LEVEL-INTERRUPT: 
NewSSP = SSP; 
CHECK_SS_TOKEN = 0 
(* PE = 1, DPL = CPL or conforming segment *) 
IF IA32_EFER.LMA = 1 (* IA-32e mode *) 
IF IDT-descriptor IST #0 
THEN 
TSSstackAddress := (IDT-descriptor IST « 3) + 28; 
IF (TSSstackAddress + 7) > TSS limit 
THEN #TS(error_code(current TSS selector,0,EXT)); Fl; 
(* idt operand to error_code is 0 because selector is used *) 
NewRSP := 8 bytes loaded from (current TSS base + TSSstackAddress); 
ELSE NewRSP := RSP; 


Fl; 
IF ShadowStackEnabled(CPL) 
THEN 
NewSSPAddress = IA32_INTERRUPT_SSP_TABLE_ADDR + (IDT gate IST « 3) 
NewSSP := 8 bytes loaded from NewSSPAddress 
CHECK_SS_TOKEN = 1 
Fl; 
Fl; 
IF 32-bit gate (* implies IA32_EFER.LMA = 0 *) 
THEN 


IF current stack does not have room for 16 bytes (error code pushed) 
or 12 bytes (no error code pushed) 
THEN #SS(EXT); Fl; (* Error code contains NULL selector *) 
ELSE IF 16-bit gate (* implies IA32_EFER.LMA = 0 *) 
IF current stack does not have room for 8 bytes (error code pushed) 
or 6 bytes (no error code pushed) 
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THEN #SS(EXT); Fl; (* Error code contains NULL selector *) 
ELSE (* IA32_EFER.LMA = 1, 64-bit gate*) 
IF NewRSP contains a non-canonical address 
THEN #SS(EXT); (* Error code contains NULL selector *) 


FI; 
Fl; 
IF (IA32_EFER.LMA = 0) (* Not IA-32e mode *) 
THEN 
IF instruction pointer from IDT gate is not within new code-segment limit 
THEN #GP(EXT); Fl; (* Error code contains NULL selector *) 
ELSE 
IF instruction pointer from IDT gate contains a non-canonical address 
THEN #GP(EXT); Fl; (* Error code contains NULL selector *) 
RSP := NewRSP & FFFFFFFFFFFFFFFOH; 
Fl; 
IF IDT gate is 32-bit (* implies IA32_EFER.LMA = 0 *) 
THEN 
Push (EFLAGS); 
Push (far pointer to return instruction); (* 3 words padded to 4 *) 
CS:EIP := Gate(CS:EIP); (* Segment descriptor information also loaded *) 
Push (ErrorCode); (* If any *) 
ELSE 
IF IDT gate is 16-bit (* implies IA32_EFER.LMA = 0 *) 
THEN 
Push (FLAGS); 
Push (far pointer to return location); (* 2 words *) 
CS:IP := Gate(CS:IP); 
(* Segment descriptor information also loaded *) 
Push (ErrorCode); (* If any *) 
ELSE (* IA32_EFER.LMA = 1, 64-bit gate*) 
Push(far pointer to old stack); 
(* Old SS and SP, each an 8-byte push *) 
Push(RFLAGS); (* 8-byte push *) 
Push(far pointer to return instruction); 
(* Old CS and RIP, each an 8-byte push *) 
Push(ErrorCode); (* If needed, 8 bytes *) 
CS:RIP := GATE(CS:RIP); 
(* Segment descriptor information also loaded *) 
FI; 
Fl; 


CS(RPL) := CPL; 
IF ShadowStackEnabled(CPL) 
IF CHECK_SS_ TOKEN == 
THEN 
IF NewSSP & 0x07 != 0 
THEN #GP(0); FI; 
(* Token and CS:LIP:oldSSP pushed on shadow stack must be contained in a naturally aligned 32-byte region *) 
IF (NewSSP & ~0x1F) != ((NewSSP - 24) & ~0x1F) 
#GP(0); FI; 


IF ((IA32_EFER.LMA and CS.L) = 0 AND NewSSP[63:32] != 0) 

THEN #GP(0); FI; 
expected_token_value = NewSSP (* busy bit - bit position O - must be clear *) 
new_token_value = NewSSP | BUSY_BIT (* Set the busy bit *) 
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IF shadow_stack_lock_cmpxchg8b(NewSSP, new_token_value, expected_token_value) != expected_token_value 
THEN #GP(0); Fl; 
Fl; 
(* Align to next 8 byte boundary *) 
tempSSP = SSP; 
Shadow_stack_store 4 bytes of 0 to (NewSSP — 4) 
SSP = newSSP & OxFFFFFFFFFFFFFFF8H; 
(* These stack pushes should not cause faults, VM exits, or data breakpoints, if CHECK_SS_TOKEN is 1 *) 
(* Such events will apply to the earlier accesses to the token, which is in the same 32-byte region *) 
(* push cs:lip:ssp on shadow stack *) 
ShadowStackPush8B(oldCS); (* Padded with 48 high-order bits of 0 *) 
ShadowStackPush8B(oldCSBASE + oldRIP); (* Padded with 32 high-order bits of O for 32 bit LIP*) 
ShadowStackPush8B(tempSSP); 


Fl; 
IF EndbranchEnabled (CPL) 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 


IF IDT gate is interrupt gate 
THEN IF := 0; Fl; (* Interrupt flag set to 0; interrupts disabled *) 
TF := 0; 
NT := 0; 
VM := 0; 
RF := 0; 
END; 


Flags Affected 


The EFLAGS register is pushed onto the stack. The IF, TF, NT, AC, RF, and VM flags may be cleared, depending on 
the mode of operation of the processor when the INT instruction is executed (see the “Operation” section). If the 
interrupt uses a task gate, any flags may be set or cleared, controlled by the EFLAGS image in the new task’s TSS. 


Protected Mode Exceptions 


#GP(error_code) _ If the instruction pointer in the IDT or in the interrupt, trap, or task gate is beyond the code 
segment limits. 


If the segment selector in the interrupt, trap, or task gate is NULL. 


If an interrupt, trap, or task gate, code segment, or TSS segment selector index is outside its 
descriptor table limits. 


If the vector selects a descriptor outside the IDT limits. 
If an IDT descriptor is not an interrupt, trap, or task gate. 


If an interrupt is generated by the INT n, INT3, or INTO instruction and the DPL of an interrupt, 
trap, or task gate is less than the CPL. 


If the segment selector in an interrupt or trap gate does not point to a segment descriptor for 
a code segment. 


If the segment selector for a TSS has its local/global bit set for local. 
If a TSS segment descriptor specifies that the TSS is busy or not available. 
If SSP in IA32_PLi_SSP (where i is the new CPL) is not 8 byte aligned. 
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#SS(error_code) 


#NP(error_code) 
#TS(error_code) 


#PF(fault-code) 
#UD 
#AC(EXT) 


If the token and the stack frame to be pushed on shadow stack are not contained in a naturally 
aligned 32-byte region of the shadow stack. 


If “supervisor Shadow Stack” token on new shadow stack is marked busy. 


If destination mode is 32-bit or compatibility mode, but SSP address in “supervisor shadow 
stack” token is beyond 4GB. 


If SSP address in “supervisor shadow stack” token does not match SSP address in 
IA32_PLi_SSP (where i is the new CPL). 


If pushing the return address, flags, or error code onto the stack exceeds the bounds of the 
stack segment and no stack switch occurs. 


If the SS register is being loaded and the segment pointed to is marked not present. 


If pushing the return address, flags, error code, or stack segment pointer exceeds the bounds 
of the new stack segment when a stack switch occurs. 


If code segment, interrupt gate, trap gate, task gate, or TSS is not present. 


If the RPL of the stack segment selector in the TSS is not equal to the DPL of the code segment 
being accessed by the interrupt or trap gate. 


If DPL of the stack segment descriptor pointed to by the stack segment selector in the TSS is 
not equal to the DPL of the code segment descriptor for the interrupt or trap gate. 


If the stack segment selector in the TSS is NULL. 

If the stack segment for the TSS is not a writable data segment. 

If segment-selector index for stack segment is outside descriptor table limits. 

If a page fault occurs. 

If the LOCK prefix is used. 

If alignment checking is enabled, the gate DPL is 3, and a stack push is unaligned. 


Real-Address Mode Exceptions 


#GP 


#SS 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the interrupt vector number is outside the IDT limits. 
If stack limit violation on push. 


If pushing the return address, flags, or error code onto the stack exceeds the bounds of the 
stack segment. 


If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(error_code) 


#SS(error_code) 
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(For INT n, INTO, or BOUND instruction) If the IOPL is less than 3 or the DPL of the interrupt, 
trap, or task gate is not equal to 3. 


If the instruction pointer in the IDT or in the interrupt, trap, or task gate is beyond the code 
segment limits. 


If the segment selector in the interrupt, trap, or task gate is NULL. 


If a interrupt gate, trap gate, task gate, code segment, or TSS segment selector index is 
outside its descriptor table limits. 


If the vector selects a descriptor outside the IDT limits. 
If an IDT descriptor is not an interrupt, trap, or task gate. 


If an interrupt is generated by INT n, INT3, or INTO and the DPL of an interrupt, trap, or task 
gate is less than the CPL. 


If the segment selector in an interrupt or trap gate does not point to a segment descriptor for 
a code segment. 


If the segment selector for a TSS has its local/global bit set for local. 
If the SS register is being loaded and the segment pointed to is marked not present. 


If pushing the return address, flags, error code, stack segment pointer, or data segments 
exceeds the bounds of the stack segment. 
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#NP(error_code) If code segment, interrupt gate, trap gate, task gate, or TSS is not present. 


#TS(error_code) Ifthe RPL of the stack segment selector in the TSS is not equal to the DPL of the code segment 
being accessed by the interrupt or trap gate. 


If DPL of the stack segment descriptor for the TSS’s stack segment is not equal to the DPL of 
the code segment descriptor for the interrupt or trap gate. 


If the stack segment selector in the TSS is NULL. 

If the stack segment for the TSS is not a writable data segment. 

If segment-selector index for stack segment is outside descriptor table limits. 
#PF(fault-code) If a page fault occurs. 


#OF If the INTO instruction is executed and the OF flag is set. 
#UD If the LOCK prefix is used. 
#AC(EXT) If alignment checking is enabled, the gate DPL is 3, and a stack push is unaligned. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(error_code) _ If the instruction pointer in the 64-bit interrupt gate or trap gate is non-canonical. 
If the segment selector in the 64-bit interrupt or trap gate is NULL. 
If the vector selects a descriptor outside the IDT limits. 
If the vector points to a gate which is in non-canonical space. 
If the vector points to a descriptor which is not a 64-bit interrupt gate or a 64-bit trap gate. 
If the descriptor pointed to by the gate selector is outside the descriptor table limit. 
If the descriptor pointed to by the gate selector is in non-canonical space. 
If the descriptor pointed to by the gate selector is not a code segment. 


If the descriptor pointed to by the gate selector doesn’t have the L-bit set, or has both the L- 
bit and D-bit set. 


If the descriptor pointed to by the gate selector has DPL > CPL. 
If SSP in IA32_PLi_SSP (where i is the new CPL) is not 8 byte aligned. 


If the token and the stack frame to be pushed on shadow stack are not contained in a naturally 
aligned 32-byte region of the shadow stack. 


If “supervisor shadow stack” token on new shadow stack is marked busy. 


If destination mode is 32-bit or compatibility mode, but SSP address in “supervisor shadow 
stack” token is beyond 4GB. 


If SSP address in “supervisor shadow stack” token does not match SSP address in 
IA32_PLi_SSP (where i is the new CPL). 


#SS(error_code) If a push of the old EFLAGS, CS selector, EIP, or error code is in non-canonical space with no 
stack switch. 


If a push of the old SS selector, ESP, EFLAGS, CS selector, EIP, or error code is in non-canonical 
space on a stack switch (either CPL change or no-CPL with IST). 


#NP(error_code) If the 64-bit interrupt-gate, 64-bit trap-gate, or code segment is not present. 

#TS(error_code) If an attempt to load RSP from the TSS causes an access to non-canonical space. 
If the RSP from the TSS is outside descriptor table limits. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 

#AC(EXT) If alignment checking is enabled, the gate DPL is 3, and a stack push is unaligned. 
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INVD—Invalidate Internal Caches 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 08 INVD ZO | Valid Valid Flush internal caches; initiate flushing of 
external caches. 


NOTES: 
* See the IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Invalidates (flushes) the processor's internal caches and issues a special-function bus cycle that directs external 
caches to also flush themselves. Data held in internal caches is not written back to main memory. 


After executing this instruction, the processor does not wait for the external caches to complete their flushing oper- 
ation before proceeding with instruction execution. It is the responsibility of hardware to respond to the cache flush 
signal. 


The INVD instruction is a privileged instruction. When the processor is running in protected mode, the CPL of a 
program or procedure must be 0 to execute this instruction. 


The INVD instruction may be used when the cache is used as temporary memory and the cache contents need to 
be invalidated rather than written back to memory. When the cache is used as temporary memory, no external 
device should be actively writing data to main memory. 


Use this instruction with care. Data cached internally and not written back to main memory will be lost. Note that 
any data from an external device to main memory (for example, via a PCIWrite) can be temporarily stored in the 
caches; these data can be lost when an INVD instruction is executed. Unless there is a specific requirement or 
benefit to flushing caches without writing back modified cache lines (for example, temporary memory, testing, or 
fault recovery where cache coherency with main memory is not a concern), software should instead use the 
WBINVD instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


The INVD instruction is implementation dependent; it may be implemented differently on different families of Intel 
64 or IA-32 processors. This instruction is not supported on IA-32 processors earlier than the Intel486 processor. 


Operation 


Flush(InternalCaches); 
SignalFlush(ExternalCaches); 
Continue (* Continue execution *) 


Flags Affected 
None 


Protected Mode Exceptions 


#GP(0) If the current privilege level is not 0. 
If the processor reserved memory protections are activated. 
#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The INVD instruction cannot be executed in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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INVLPG—Invalidate TLB Entries 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF 01/7 INVLPG m M Valid Valid Invalidate TLB entries for page containing m. 
NOTES: 


* See the IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Invalidates any translation lookaside buffer (TLB) entries specified with the source operand. The source operand is 
a memory address. The processor determines the page that contains that address and flushes all TLB entries for 
that page.! 

The INVLPG instruction is a privileged instruction. When the processor is running in protected mode, the CPL must 
be 0 to execute this instruction. 


The INVLPG instruction normally flushes TLB entries only for the specified page; however, in some cases, it may 
flush more entries, even the entire TLB. The instruction invalidates TLB entries associated with the current PCID 
and may or may not do so for TLB entries associated with other PCIDs. (If PCIDs are disabled — CR4.PCIDE = 0 — 
the current PCID is OOOH.) The instruction also invalidates any global TLB entries for the specified page, regardless 
of PCID. 


For more details on operations that flush the TLB, see “MOV—Move to/from Control Registers” in the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 2B and Section 4.10.4.1, “Operations that Invalidate 
TLBs and Paging-Structure Caches,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A. 


This instruction’s operation is the same in all non-64-bit modes. It also operates the same in 64-bit mode, except 
if the memory address is in non-canonical form. In this case, INVLPG is the same as a NOP. 


IA-32 Architecture Compatibility 


The INVLPG instruction is implementation dependent, and its function may be implemented differently on different 
families of Intel 64 or IA-32 processors. This instruction is not supported on IA-32 processors earlier than the 
Intel486 processor. 


Operation 


Invalidate(RelevantTLBEntries); 
Continue; (* Continue execution *) 


Flags Affected 
None. 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD Operand is a register. 

If the LOCK prefix is used. 


1. If the paging structures map the linear address using a page larger than 4 KBytes and there are multiple TLB entries for that page 
(see Section 4.10.2.3, “Details of TLB Use,” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A), the 
instruction invalidates all of them. 
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Real-Address Mode Exceptions 
#UD Operand is a register. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The INVLPG instruction cannot be executed at the virtual-8086 mode. 


64-Bit Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD Operand is a register. 

If the LOCK prefix is used. 
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INVPCID—Invalidate Process-Context Identifier 


Opcode/Instruction Op/ |64/32- | CPUID Description 
En bit Feature 
Mode Flag 

66 OF 38 82 /r RM |NE/V INVPCID — | Invalidates entries in the TLBs and paging-structure 
INVPCID r32, m128 caches based on invalidation type in r32 and descrip- 

tor inm128. 
66 OF 38 82 /r RM |V/NE INVPCID — | Invalidates entries in the TLBs and paging-structure 
INVPCID r64, m128 caches based on invalidation type in r64 and descrip- 

tor inm128. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


Invalidates mappings in the translation lookaside buffers (TLBs) and paging-structure caches based on process- 
context identifier (PCID). (See Section 4.10, “Caching Translation Information,” in Intel 64 and IA-32 Architecture 
Software Developer’s Manual, Volume 3A.) Invalidation is based on the INVPCID type specified in the register 
operand and the INVPCID descriptor specified in the memory operand. 


Outside 64-bit mode, the register operand is always 32 bits, regardless of the value of CS.D. In 64-bit mode the 


register operand has 64 bits. 


There are four INVPCID types currently defined: 


* Individual-address invalidation: If the INVPCID type is 0, the logical processor invalidates mappings—except 
global translations—for the linear address and PCID specified in the INVPCID descriptor.! In some cases, the 
instruction may invalidate global translations or mappings for other linear addresses (or other PCIDs) as well. 


¢ Single-context invalidation: If the INVPCID type is 1, the logical processor invalidates all mappings—except 
global translations—associated with the PCID specified in the INVPCID descriptor. In some cases, the 
instruction may invalidate global translations or mappings for other PCIDs as well. 


¢ = All-context invalidation, including global translations: If the INVPCID type is 2, the logical processor invalidates 
all mappings—including global translations—associated with any PCID. 


e =All-context invalidation: If the INVPCID type is 3, the logical processor invalidates all mappings—except global 
translations—associated with any PCID. In some case, the instruction may invalidate global translations as well. 


The INVPCID descriptor comprises 128 bits and consists of a PCID and a linear address as shown in Figure 3-24. 
For INVPCID type 0, the processor uses the full 64 bits of the linear address even outside 64-bit mode; the linear 
address is not used for other INVPCID types. 


127 


6463 


Linear Address Reserved (must be zero) |PCID 


1211 O 


Figure 3-24. INVPCID Descriptor 


1. If the paging structures map the linear address using a page larger than 4 KBytes and there are multiple TLB entries for that page 
(see Section 4.10.2.3, “Details of TLB Use,” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A), the 


instruction invalidates all of them. 
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If CR4.PCIDE = 0, a logical processor does not cache information for any PCID other than OOOH. In this case, 
executions with INVPCID types 0 and 1 are allowed only if the PCID specified in the INVPCID descriptor is O00H; 
executions with INVPCID types 2 and 3 invalidate mappings only for PCID OOOH. Note that CR4.PCIDE must be 0 
outside IA-32e mode (see Chapter 4.10.1, “Process-Context Identifiers (PCIDs),” of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3A). 


Operation 


INVPCID_TYPE := value of register operand; // must be in the range of 0-3 
INVPCID_DESC := value of memory operand; 
CASE INVPCID_TYPE OF 
0: // individual-address invalidation 
PCID := INVPCID_DESC[1 1:0]; 
L_ADDR := INVPCID_DESC[1 27:64]; 
Invalidate mappings for L_ADDR associated with PCID except global translations; 
BREAK; 
1: // single PCID invalidation 
PCID := INVPCID_DESC[1 1:0]; 
Invalidate all mappings associated with PCID except global translations; 


BREAK; 

2: // all PCID invalidation including global translations 
Invalidate all mappings for all PCIDs, including global translations; 
BREAK; 

3: // all PCID invalidation retaining global translations 
Invalidate all mappings for all PCIDs except global translations; 
BREAK; 


ESAC; 


Intel C/C++ Compiler Intrinsic Equivalent 


INVPCID: void _invpcid(unsigned __int32 type, void * descriptor); 


SIMD Floating-Point Exceptions 
None 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains an unusable segment. 
If the source operand is located in an execute-only code segment. 
If an invalid type is specified in the register operand, i.e., INVPCID_TYPE > 3. 
If bits 63:12 of INVPCID_DESC are not all zero. 
If INVPCID_TYPE is either 0 or 1 and INVPCID_DESC[11:0] is not zero. 
If INVPCID_TYPE is 0 and the linear address in INVPCID_DESC[127:64] is not canonical. 
#PF(fault-code) If a page fault occurs in accessing the memory operand. 


#SS(0) If the memory operand effective address is outside the SS segment limit. 
If the SS register contains an unusable segment. 
#UD If if CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. 


If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP 


#UD 


If an invalid type is specified in the register operand, i.e., INVPCID_TYPE > 3. 

If bits 63:12 of INVPCID_DESC are not all zero. 

If INVPCID_TYPE is either 0 or 1 and INVPCID_DESC[11:0] is not zero. 

If INVPCID_TYPE is 0 and the linear address in INVPCID_DESC[127:64] is not canonical. 
If CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 


The INVPCID instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#PF(fault-code) 
#SS(0) 


#UD 
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If the current privilege level is not 0. 


If the memory operand is in the CS, DS, ES, FS, or GS segments and the memory address is 
in a non-canonical form. 


If an invalid type is specified in the register operand, i.e., INVPCID_TYPE > 3. 

If bits 63:12 of INVPCID_DESC are not all zero. 

If CR4.PCIDE=0, INVPCID_TYPE is either 0 or 1, and INVPCID_DESC[11:0] is not zero. 
If INVPCID_TYPE is 0 and the linear address in INVPCID_DESC[127:64] is not canonical. 
If a page fault occurs in accessing the memory operand. 


If the memory destination operand is in the SS segment and the memory address is in a non- 
canonical form. 


If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. 
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IRET/IRETD/IRETQ—Interrupt Return 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
CF IRET ZO | Valid Valid Interrupt return (16-bit operand size). 
CF IRETD ZO ‘| Valid Valid Interrupt return (32-bit operand size). 
REX.W + CF IRETQ ZO ‘| Valid N.E. Interrupt return (64-bit operand size). 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Returns program control from an exception or interrupt handler to a program or procedure that was interrupted by 
an exception, an external interrupt, or a software-generated interrupt. These instructions are also used to perform 
a return from a nested task. (A nested task is created when a CALL instruction is used to initiate a task switch or 
when an interrupt or exception causes a task switch to an interrupt or exception handler.) See the section titled 
“Task Linking” in Chapter 7 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


IRET and IRETD are mnemonics for the same opcode. The IRETD mnemonic (interrupt return double) is intended 
for use when returning from an interrupt when using the 32-bit operand size; however, most assemblers use the 
IRET mnemonic interchangeably for both operand sizes. 


In Real-Address Mode, the IRET instruction performs a far return to the interrupted program or procedure. During 
this operation, the processor pops the return instruction pointer, return code segment selector, and EFLAGS image 
from the stack to the EIP, CS, and EFLAGS registers, respectively, and then resumes execution of the interrupted 
program or procedure. 


In Protected Mode, the action of the IRET instruction depends on the settings of the NT (nested task) and VM flags 
in the EFLAGS register and the VM flag in the EFLAGS image stored on the current stack. Depending on the setting 
of these flags, the processor performs the following types of interrupt returns: 


¢ Return from virtual-8086 mode. 

¢ Return to virtual-8086 mode. 

¢ Intra-privilege level return. 

¢ Inter-privilege level return. 

¢ Return from nested task (task switch). 


If the NT flag (EFLAGS register) is cleared, the IRET instruction performs a far return from the interrupt procedure, 
without a task switch. The code segment being returned to must be equally or less privileged than the interrupt 
handler routine (as indicated by the RPL field of the code segment selector popped from the stack). 


As with a real-address mode interrupt return, the IRET instruction pops the return instruction pointer, return code 
segment selector, and EFLAGS image from the stack to the EIP, CS, and EFLAGS registers, respectively, and then 
resumes execution of the interrupted program or procedure. If the return is to another privilege level, the IRET 
instruction also pops the stack pointer and SS from the stack, before resuming program execution. If the return is 
to virtual-8086 mode, the processor also pops the data segment registers from the stack. 


If the NT flag is set, the IRET instruction performs a task switch (return) from a nested task (a task called with a 
CALL instruction, an interrupt, or an exception) back to the calling or interrupted task. The updated state of the 
task executing the IRET instruction is saved in its TSS. If the task is re-entered later, the code that follows the IRET 
instruction is executed. 


If the NT flag is set and the processor is in IA-32e mode, the IRET instruction causes a general protection excep- 
tion. 


If nonmaskable interrupts (NMIs) are blocked (see Section 6.7.1, “Handling Multiple NMIs” in the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A), execution of the IRET instruction unblocks NMIs. 
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This unblocking occurs even if the instruction causes a fault. In such a case, NMIs are unmasked before the excep- 


tion handler is invoked. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.W prefix promotes operation to 64 
bits (IRETQ). See the summary chart at the beginning of this section for encoding data and limits. 


Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Tech- 
nology (CET)” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET details. 


Instruction ordering. IRET is a serializing instruction. See Section 8.3 of the Inte/® 64 and IA-32 Architectures Soft- 


ware Developer’s Manual, Volume 3A. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 


VMX non-root operation. 


Operation 


IF PE=0 
THEN GOTO REAL-ADDRESS-MODE; 
ELSIF (IA32_EFER.LMA = 0) 
THEN 
IF (EFLAGS.VM = 1) 
THEN GOTO RETURN-FROM-VIRTUAL-8086-MODE; 
ELSE GOTO PROTECTED-MODE; 
Fl; 
ELSE GOTO IA-32e-MODE; 
Fl; 


REAL-ADDRESS-MODE; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
tempEFLAGS := Pop(); 
EFLAGS := (tempEFLAGS AND 257FD5H) OR (EFLAGS AND 1A0000H); 
ELSE (* OperandSize = 16 *) 
EIP := Pop(); (* 16-bit pop; clear upper 16 bits *) 
CS := Pop(); (* 16-bit pop *) 
EFLAGS[15:0] := Pop(); 
Fl; 
END; 


RETURN-FROM-VIRTUAL-8086-MODE: 


(* Processor is in virtual-8086 mode when IRET is executed and stays in virtual-8086 mode *) 


IF IOPL = 3 (* Virtual mode: PE= 1, VM= 1, lOPL = 3 *) 
THEN IF OperandSize = 32 

THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
EFLAGS := Pop(); 
(* VM, lIOPL,VIP and VIF EFLAG bits not modified by pop *) 
IF EIP not within CS limit 

THEN #GP(0); FI; 

ELSE (* OperandSize = 16 *) 
EIP := Pop(); (* 16-bit pop; clear upper 16 bits *) 
CS := Pop(); (* 16-bit pop *) 
EFLAGS[15:0] := Pop(); (* IOPL in EFLAGS not modified by pop *) 
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IF EIP not within CS limit 
THEN #GP(0); Fl; 
Fl; 
ELSE 
#GP(0); (* Trap to virtual-8086 monitor: PE = 1, VM = 1, IOPL < 3 *) 
Fl; 
END; 


PROTECTED-MODE: 
IF NT=1 
THEN GOTO TASK-RETURN; (* PE = 1, VM=0, NT = 1 *) 
Fl; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
tempEFLAGS := Pop(); 
ELSE (* OperandSize = 16 *) 
EIP := Pop(); (* 16-bit pop; clear upper bits *) 
CS := Pop(); (* 16-bit pop *) 
tempEFLAGS := Pop(); (* 16-bit pop; clear upper bits *) 
Fl; 
IF tempEFLAGS(VM) = 1 and CPL=0 
THEN GOTO RETURN-TO-VIRTUAL-8086-MODE; 
ELSE GOTO PROTECTED-MODE-RETURN; 
Fl; 


TASK-RETURN: (* PE= 1, VM = 0, NT = 1 *) 
SWITCH-TASKS (without nesting) to TSS specified in link field of current TSS; 
Mark the task just abandoned as NOT BUSY; 
IF EIP is not within CS limit 
THEN #GP(0); Fl; 
END; 


RETURN-TO-VIRTUAL-8086-MODE: 

(* Interrupted procedure was in virtual-8086 mode: PE = 1, CPL=0, VM = 1 in flag image *) 
(* If shadow stack or indirect branch tracking at CPL3 then #GP(0) *) 
IF CR4.CET AND (IA32_U_CET.ENDBR_EN OR IA32_U_CET.SHSTK_EN) 

THEN #GP(0); Fl; 
shadowStackEnabled = ShadowStackEnabled(CPL) 
IF EIP not within CS limit 

THEN #GP(0); Fl; 
EFLAGS := tempEFLAGS; 
ESP := Pop(); 
SS := Pop(); (* Pop 2 words; throw away high-order word *) 
ES := Pop(); (* Pop 2 words; throw away high-order word *) 
DS := Pop(); (* Pop 2 words; throw away high-order word *) 
FS := Pop(); (* Pop 2 words; throw away high-order word *) 
GS := Pop(); (* Pop 2 words; throw away high-order word *) 
IF shadowStackEnabled 

(* check if 8 byte aligned *) 

IF SSP AND 0x7 != 0 

THEN #CP(FAR-RET/IRET); Fl; 

Fl; 
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CPL := 3; 

(* Resume execution in Virtual-8086 mode *) 

tempOldSSP = SSP; 

(* Now past all faulting points; safe to free the token. The token free is done using the old SSP 
* and using a supervisor override as old CPL was a supervisor privilege level *) 


IF shadowStackEnabled 
expected_token_value = tempOldSSP | BUSY_BIT —(* busy bit - bit position O - must be set *) 
new_token_value = tempOldSSP (* clear the busy bit *) 
shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value) 
Fl; 
END; 


PROTECTED-MODE-RETURN: (* PE = 1 *) 
IF CS(RPL) > CPL 
THEN GOTO RETURN-TO-OUTER-PRIVILEGE-LEVEL; 
ELSE GOTO RETURN-TO-SAME-PRIVILEGE-LEVEL, Fl; 
END; 


RETURN-TO-OUTER-PRIVILEGE-LEVEL: 
IF OperandSize = 32 
THEN 
temp€SP := Pop(); 
tempSS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
ELSE IF OperandSize = 16 
THEN 
temp€SP := Pop(); (* 16-bit pop; clear upper bits *) 
tempSS := Pop(); (* 16-bit pop *) 
ELSE (* OperandSize = 64 *) 
tempRSP := Pop(); 
tempSS := Pop(); (* 64-bit pop, high-order 48 bits discarded *) 


Fl; 
IF new mode # 64-Bit Mode 
THEN 
IF EIP is not within CS limit 
THEN #GP(0); FI; 
ELSE (* new mode = 64-bit mode *) 
IF RIP is non-canonical 
THEN #GP(0); Fl; 
Fl; 


EFLAGS (CF, PF, AF, ZF, SF, TF, DF, OF, NT) := tempEFLAGS; 
IF OperandSize = 32 or OperandSize = 64 
THEN EFLAGS(RF, AC, ID) := tempEFLAGS; FI; 
IF CPL < IOPL 
THEN EFLAGS(IF) := tempEFLAGS; Fl; 
IF CPL= 0 
THEN 
EFLAGS(IOPL) := tempEFLAGS; 
IF OperandSize = 32 or OperandSize = 64 
THEN EFLAGS(VIF, VIP) := tempEFLAGS; Fl; 
Fl; 
IF ShadowStackEnabled(CPL) 
(* check if 8 byte aligned *) 
IF SSP AND 0x7 != 0 
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THEN #CP(FAR-RET/IRET); Fl; 
IF CS(RPL) != 3 
THEN 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
tempSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 
(* Do 64 bit compare to detect bits beyond 15 being set *) 
tempCS = CS; (* zero padded to 64 bit *) 
IF tempCs != tempSsCS 
THEN #CP(FAR-RET/IRET); FI; 
(* Do 64 bit compare; pad CSBASE+RIP with O for 32 bit LIP *) 
IF CSBASE + RIP != tempSsEIP 
THEN #CP(FAR-RET/IRET); FI; 
(* check if 4 byte aligned *) 
IF tempSSP AND 0x3 != 0 
THEN #CP(FAR-RET/IRET); FI; 
Fl; 
Fl; 
tempOldCPL = CPL; 
CPL := CS(RPL); 
IF OperandSize = 64 
THEN 
RSP := tempRSP; 
SS := tempSS; 
ELSE 
ESP := tempESP; 
SS := tempSS; 
Fl; 
IF new mode != 64-Bit Mode 
THEN 
IF EIP is not within CS limit 
THEN #GP(0); Fl; 
ELSE (* new mode = 64-bit mode *) 
IF RIP is non-canonical 
THEN #GP(0); Fl; 
Fl; 
tempOldSSP = SSP; 
IF ShadowStackEnabled(CPL) 
IF CPL = 3 
THEN tempSSP := [A32_PL3_SSP; Fl; 
IF ((IA32_EFER.LMA AND CS.L) = 0 AND tempSSP[63:32] != 0) OR 
((IA32_EFER.LMA AND CS.L) = 1 AND tempSSP is not canonical relative to the current paging mode) 
THEN #GP(0); Fl; 
SSP := tempSSP 
Fl; 
(* Now past all faulting points; safe to free the token. The token free is done using the old SSP 
* and using a supervisor override as old CPL was a supervisor privilege level *) 
IF ShadowStackEnabled(tempOldCPL) 
expected_token_value = tempOldSSP | BUSY_BIT (* busy bit - bit position O - must be set *) 
new_token_value = tempOldSSP (* clear the busy bit *) 
shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value) 
Fl; 
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FOR each SegReg in (ES, FS, GS, and DS) 

DO 
tempDesc := descriptor cache for SegReg (* hidden part of segment register *) 
IF (SegmentSelector == NULL) OR (tempDesc(DPL) < CPL AND tempDesc(Type) is (data or non-conforming code))) 

THEN (* Segment register invalid *) 
SegmentSelector := 0; (*Segment selector becomes null*) 

FI; 

OD; 

END; 


RETURN-TO-SAME-PRIVILEGE-LEVEL: (* PE = 1, RPL = CPL *) 
IF new mode # 64-Bit Mode 
THEN 
IF EIP is not within CS limit 
THEN #GP(0); FI; 
ELSE (* new mode = 64-bit mode *) 
IF RIP is non-canonical 
THEN #GP(0); FI; 
Fl; 
EFLAGS (CF, PF, AF, ZF, SF, TF, DF, OF, NT) := tempEFLAGS; 
IF OperandSize = 32 or OperandSize = 64 
THEN EFLAGS(RF, AC, ID) := tempEFLAGS; Fl; 
IF CPL < IOPL 
THEN EFLAGS(IF) := tempEFLAGS; Fl; 
IF CPL = 0 
THEN 
EFLAGS(IOPL) := tempEFLAGS; 
IF OperandSize = 32 or OperandSize = 64 
THEN EFLAGS(VIF, VIP) := tempEFLAGS; Fl; 
Fl; 
IF ShadowStackEnabled(CPL) 
IF SSP AND 0x7 != 0 (* check if aligned to 8 bytes *) 
THEN #CP(FAR-RET/IRET); FI; 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
tempSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 
tempCS = CS; (* zero padded to 64 bit *) 
IF tempCS != tempSsCS (* 64 bit compare; CS zero padded to 64 bits *) 
THEN #CP(FAR-RET/IRET); FI; 
IF CSBASE + RIP != tempSsLIP (* 64 bit compare; CSBASE+RIP zero padded to 64 bit for 32 bit LIP *) 
THEN #CP(FAR-RET/IRET); FI; 
IF tempSSP AND 0x3 != 0 (* check if aligned to 4 bytes *) 
THEN #CP(FAR-RET/IRET); Fl; 
IF ((IA32_EFER.LMA AND CS.L) = 0 AND tempSSP[63:32] != 0) OR 
((IA32_EFER.LMA AND CS.L) = 1 AND tempSSP is not canonical relative to the current paging mode) 
THEN #GP(0); FI; 
Fl; 
IF ShadowStackEnabled(CPL) 
IF IA32_EFER.LMA = 1 
(* In IA-32e-mode the IRET may be switching stacks if the interrupt/exception was delivered 
through an IDT with a non-zero IST *) 
(* In IA-32e mode for same CPL IRET there is always a stack switch. The below check verifies if the 
stack switch was to self stack and if so, do not try to free the token on this shadow stack. If the 
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tempSSP was not to same stack then there was a stack switch so do attempt to free the token *) 
IF tempSSP != SSP 
THEN 
expected_token_value = SSP | BUSY_BIT (* busy bit - bit position O - must be set *) 
new_token_value = SSP (* clear the busy bit *) 
shadow_stack_lock_cmpxchg8b(SSP, new_token_value, expected_token_value) 
Fl; 
Fl; 
SSP := tempSSP 
Fl; 
END; 


IA-32e-MODE: 
IF NT =1 
THEN #GP(0); 
ELSE IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); 
tempEFLAGS := Pop(); 
ELSE IF OperandSize = 16 
THEN 
EIP := Pop(); (* 16-bit pop; clear upper bits *) 
CS := Pop(); (* 16-bit pop *) 
tempEFLAGS := Pop(); (* 16-bit pop; clear upper bits *) 
Fl; 
ELSE (* OperandSize = 64 *) 
THEN 
RIP := Pop(); 
CS := Pop(); (* 64-bit pop, high-order 48 bits discarded *) 
tempRFLAGS := Pop(); 
Fl; 
IF CS.RPL > CPL 
THEN GOTO RETURN-TO-OUTER-PRIVILEGE-LEVEL; 
ELSE 
IF instruction began in 64-Bit Mode 
THEN 
IF OperandSize = 32 
THEN 
ESP := Pop(); 
SS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
ELSE IF OperandSize = 16 
THEN 
ESP := Pop(); (* 16-bit pop; clear upper bits *) 
SS := Pop(); (* 16-bit pop *) 
ELSE (* OperandSize = 64 *) 
RSP := Pop(); 
SS := Pop(); (* 64-bit pop, high-order 48 bits discarded *) 
Fl; 
Fl; 
GOTO RETURN-TO-SAME-PRIVILEGE-LEVEL; Fl; 
END; 
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Flags Affected 


All the flags and fields in the EFLAGS register are potentially modified, depending on the mode of operation of the 
processor. If performing a return from a nested task to a previous task, the EFLAGS register will be modified 
according to the EFLAGS image stored in the previous task’s TSS. 


Protected Mode Exceptions 


#GP(0) If the return code or stack segment selector is NULL. 
If the return instruction pointer is not within the return code segment limit. 
#GP(selector) If a segment selector index is outside its descriptor table limits. 


If the return code segment selector RPL is less than the CPL. 


If the DPL of a conforming-code segment is greater than the return code segment selector 
RPL. 


If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment 
selector. 


If the stack segment descriptor DPL is not equal to the RPL of the return code segment 
selector. 


If the stack segment is not a writable data segment. 

If the stack segment selector RPL is not equal to the RPL of the return code segment selector. 
If the segment descriptor for a code segment does not indicate it is a code segment. 

If the segment selector for a TSS has its local/global bit set for local. 

If a TSS segment descriptor specifies that the TSS is not busy. 

If a TSS segment descriptor specifies that the TSS is not available. 


#SS(0) If the top bytes of stack are not within stack limits. 
If the return stack segment is not present. 

#NP (selector) If the return code segment is not present. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference occurs when the CPL is 3 and alignment checking is 
enabled. 

#UD If the LOCK prefix is used. 


#CP (Far-RET/IRET) If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP 
(returning to CPL 3) is not 4 byte aligned. 


If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when 
returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB. 


If return instruction pointer from stack and shadow stack do not match. 


Real-Address Mode Exceptions 
#GP If the return instruction pointer is not within the return code segment limit. 
#SS If the top bytes of stack are not within stack limits. 


Virtual-8086 Mode Exceptions 

#GP(0) If the return instruction pointer is not within the return code segment limit. 
IF IOPL not equal to 3. 

#PF(fault-code) If a page fault occurs. 


#SS(0) If the top bytes of stack are not within stack limits. 
#AC(0) If an unaligned memory reference occurs and alignment checking is enabled. 
#UD If the LOCK prefix is used. 
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Compatibility Mode Exceptions 
#GP(0) If EFLAGS.NT[bit 14] = 1. 
Other exceptions same as in Protected Mode. 


64-Bit Mode Exceptions 
#GP(0) If EFLAGS.NT[bit 14] = 1. 
If the return code segment selector is NULL. 
If the stack segment selector is NULL going back to compatibility mode. 
If the stack segment selector is NULL going back to CPL3 64-bit mode. 
If a NULL stack segment selector RPL is not equal to CPL going back to non-CPL3 64-bit mode. 
If the return instruction pointer is not within the return code segment limit. 
If the return instruction pointer is non-canonical. 
#GP(Selector) If a segment selector index is outside its descriptor table limits. 
If a segment descriptor memory address is non-canonical. 
If the segment descriptor for a code segment does not indicate it is a code segment. 
If the proposed new code segment descriptor has both the D-bit and L-bit set. 


If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment 
selector. 


If CPL is greater than the RPL of the code segment selector. 


If the DPL of a conforming-code segment is greater than the return code segment selector 
RPL. 


If the stack segment is not a writable data segment. 


If the stack segment descriptor DPL is not equal to the RPL of the return code segment 
selector. 


If the stack segment selector RPL is not equal to the RPL of the return code segment selector. 
#SS(0) If an attempt to pop a value off the stack violates the SS limit. 

If an attempt to pop a value off the stack causes a non-canonical address to be referenced. 

If the return stack segment is not present. 


#NP (selector) If the return code segment is not present. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference occurs when the CPL is 3 and alignment checking is 
enabled. 

#UD If the LOCK prefix is used. 


#CP (Far-RET/IRET) If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP 
(returning to CPL 3) is not 4 byte aligned. 


If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when 
returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB. 


If return instruction pointer from stack and shadow stack do not match. 
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Jcc—Jump if Condition Is Met 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
77 cb JA relg D Valid Valid Jump short if above (CF=0 and ZF=0). 
73 cb JAE rel8 D Valid Valid Jump short if above or equal (CF=0). 
72 cb JB relg D Valid Valid Jump short if below (CF=1). 
76 cb JBE relg D Valid Valid Jump short if below or equal (CF=1 or ZF=1). 
72 cb JC relg D Valid Valid Jump short if carry (CF=1). 
E3 cb JCXZ rel8 D N.E. Valid Jump short if CX register is 0. 
E3 cb JECXZ rel8 D Valid Valid Jump short if ECX register is O. 
E3 cb JRCXZ rel8 D Valid N.E. Jump short if RCX register is 0. 
74 cb JE relg D Valid Valid Jump short if equal (ZF=1). 
7F cb JG rel8 D Valid Valid Jump short if greater (ZF=0 and SF=OF). 
7D cb JGE relg D Valid Valid Jump short if greater or equal (SF=OF). 
7C cb JL relg D Valid Valid Jump short if less (SF# OF). 
7E cb JLE relg D Valid Valid Jump short if less or equal (ZF=1 or SF# OF). 
76 cb JNA rel8 D Valid Valid Jump short if not above (CF=1 or ZF=1). 
72 cb JNAE rel8 D Valid Valid Jump short if not above or equal (CF=1). 
73 cb JNB rel8 D Valid Valid Jump short if not below (CF=0). 
77 cb JNBE re/8 D Valid Valid Jump short if not below or equal (CF=0 and 
ZF=0). 
73 cb JNC relg D Valid Valid Jump short if not carry (CF=0). 
75 cb JNE re/g D Valid Valid Jump short if not equal (ZF=0). 
7E cb JNG rel8 D Valid Valid Jump short if not greater (ZF=1 or SF# OF). 
7C cb JNGE re/8 D Valid Valid Jump short if not greater or equal (SF# OF). 
7D cb JNL rela D Valid Valid Jump short if not less (SF=OF). 
7F cb JNLE re/8 D Valid Valid Jump short if not less or equal (ZF=0 and 
SF=OF). 
71 cb JNO re/l8 D Valid Valid Jump short if not overflow (OF=0). 
7B cb JNP rel8 D Valid Valid Jump short if not parity (PF=0). 
79 cb JNS re/8 D Valid Valid Jump short if not sign (SF=0). 
75 cb JNZ relg D Valid Valid Jump short if not zero (ZF=0). 
70 cb JO rela D Valid Valid Jump short if overflow (OF=1). 
7A cb JP rel8 D Valid Valid Jump short if parity (PF=1). 
7A cb JPE rel8 D Valid Valid Jump short if parity even (PF=1). 
7B cb JPO rel8 D Valid Valid Jump short if parity odd (PF=0). 
78 cb JS rel8 D Valid Valid Jump short if sign (SF=1). 
74 cb JZ rel8 D Valid Valid Jump short if zero (ZF = 1). 
OF 87 cw JA rel16 D NS. Valid Jump near if above (CF=0 and ZF=0). Not 
supported in 64-bit mode. 
OF 87 cd JA rel32 D Valid Valid Jump near if above (CF=0 and ZF=0). 
OF 83 cw JAE rel16 D NS. Valid Jump near if above or equal (CF=0). Not 
supported in 64-bit mode. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF 83 cd JAE rel32 D Valid Valid Jump near if above or equal (CF=0). 

OF 82 cw JB rel16 D NS. Valid Jump near if below (CF=1). Not supported in 
64-bit mode. 

OF 82 cd JB rel32 D Valid Valid Jump near if below (CF=1). 

OF 86 cw JBE rel76 D NS. Valid Jump near if below or equal (CF=1 or ZF=1). 
Not supported in 64-bit mode. 

OF 86 cd JBE rel32 D Valid Valid Jump near if below or equal (CF=1 or ZF=1). 

OF 82 cw JC rel16 D N.S. Valid Jump near if carry (CF=1). Not supported in 
64-bit mode. 

OF 82 cd JC rel32 D Valid Valid Jump near if carry (CF=1). 

OF 84 cw JE rel16 D N.S. Valid Jump near if equal (ZF=1). Not supported in 
64-bit mode. 

OF 84 cd JE rel32 D Valid Valid Jump near if equal (ZF=1). 

OF 84 cw JZ rel16 D N.S. Valid Jump near if O (ZF=1), Not supported in 64-bit 
mode. 

OF 84 cd JZ rel32 D Valid Valid Jump near if O (ZF=1). 

OF 8F cw JG rel16 D N.S. Valid Jump near if greater (ZF=0 and SF=OF). Not 
supported in 64-bit mode. 

OF 8F cd JG rel32 D Valid Valid Jump near if greater (ZF=0 and SF=OF). 

OF 8D cw JGE rel76 D N.S. Valid Jump near if greater or equal (SF=OF), Not 
supported in 64-bit mode. 

OF 8D cd JGE rel32 D Valid Valid Jump near if greater or equal (SF=OF). 

OF 8C cw JL rel16 D N.S. Valid Jump near if less (SF4 OF). Not supported in 
64-bit mode. 

OF 8C cd JL rel32 D Valid Valid Jump near if less (SF# OF). 

OF 8E cw JLE rel16 D N.S. Valid Jump near if less or equal (ZF=1 or SF# OF). 
Not supported in 64-bit mode. 

OF 8E cd JLE rel32 D Valid Valid Jump near if less or equal (ZF=1 or SF# OF). 

OF 86 cw JNA rel16 D N.S. Valid Jump near if not above (CF=1 or ZF=1). Not 
supported in 64-bit mode. 

OF 86 cd JNA rel32 D Valid Valid Jump near if not above (CF=1 or ZF=1). 

OF 82 cw JNAE rel76 D N.S. Valid Jump near if not above or equal (CF=1). Not 
supported in 64-bit mode. 

OF 82 cd JNAE rel32 D Valid Valid Jump near if not above or equal (CF=1). 

OF 83 cw JNB rel16 D NS. Valid Jump near if not below (CF=0). Not supported 
in 64-bit mode. 

OF 83 cd JNB re/32 D Valid Valid Jump near if not below (CF=0). 

OF 87 cw JNBE rel76 D NS. Valid Jump near if not below or equal (CF=0 and 
ZF=0). Not supported in 64-bit mode. 

OF 87 cd JNBE rel32 D Valid Valid Jump near if not below or equal (CF=0 and 
ZF=0). 

OF 83 cw JNC rel16 D N.S. Valid Jump near if not carry (CF=0). Not supported 
in 64-bit mode. 

OF 83 cd JNC rel32 D Valid Valid Jump near if not carry (CF=0). 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF 85 cw JNE rel16 D N.S. Valid Jump near if not equal (ZF=0). Not supported 
in 64-bit mode. 

OF 85 cd JNE rel32 D Valid Valid Jump near if not equal (ZF=0). 

OF 8E cw JNG rel76 D NS. Valid Jump near if not greater (ZF=1 or SF# OF). 
Not supported in 64-bit mode. 

OF 8E cd JNG rel32 D Valid Valid Jump near if not greater (ZF=1 or SF# OF). 

OF 8C cw JNGE re/76 D N.S. Valid Jump near if not greater or equal (SF# OF). 
Not supported in 64-bit mode. 

OF 8C cd JNGE re/32 D Valid Valid Jump near if not greater or equal (SF# OF). 

OF 8D cw JNL rel76 D N.S. Valid Jump near if not less (SF=OF), Not supported 
in 64-bit mode. 

OF 8D cd JNL rel32 D Valid Valid Jump near if not less (SF=OF). 

OF 8F cw JNLE re/16 D NS. Valid Jump near if not less or equal (ZF=0 and 
SF=OF). Not supported in 64-bit mode. 

OF 8F cd JNLE re/32 D Valid Valid Jump near if not less or equal (ZF=0 and 
SF=OF). 

OF 81 cw JNO rel16 D N.S. Valid Jump near if not overflow (OF=0). Not 
supported in 64-bit mode. 

OF 81 cd JNO rel32 D Valid Valid Jump near if not overflow (OF=0). 

OF 8B cw JNP rel76 D N.S. Valid Jump near if not parity (PF=0). Not supported 
in 64-bit mode. 

OF 8B cd JNP rel32 D Valid Valid Jump near if not parity (PF=0). 

OF 89 cw JNS rel16 D N.S. Valid Jump near if not sign (SF=0). Not supported in 
64-bit mode. 

OF 89 cd JNS rel32 D Valid Valid Jump near if not sign (SF=0). 

OF 85 cw JNZ rel16 D NS. Valid Jump near if not zero (ZF=0). Not supported in 
64-bit mode. 

OF 85 cd JNZ rel32 D Valid Valid Jump near if not zero (ZF=0). 

OF 80 cw JO rel16 D N.S. Valid Jump near if overflow (OF=1). Not supported 
in 64-bit mode. 

OF 80 cd JO rel32 D Valid Valid Jump near if overflow (OF=1). 

OF 8A cw JP rel16 D NS. Valid Jump near if parity (PF=1). Not supported in 
64-bit mode. 

OF 8A cd JP rel32 D Valid Valid Jump near if parity (PF=1). 

OF 8A cw JPE rel16 D NS. Valid Jump near if parity even (PF=1). Not 
supported in 64-bit mode. 

OF 8A cd JPE rel32 D Valid Valid Jump near if parity even (PF=1). 

OF 8B cw JPO rel16 D N.S. Valid Jump near if parity odd (PF=0). Not supported 
in 64-bit mode. 

OF 8B cd JPO rel32 D Valid Valid Jump near if parity odd (PF=0). 

OF 88 cw JS rel16 D NS. Valid Jump near if sign (SF=1). Not supported in 64- 
bit mode. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 88 cd JS rel32 D Valid Valid Jump near if sign (SF=1). 
OF 84 cw JZ rel16 D NS. Valid Jump near if O (ZF=1). Not supported in 64-bit 
mode. 
OF 84 cd JZ rel32 D Valid Valid Jump near if O (ZF=1). 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
D Offset NA NA NA 
Description 


Checks the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF, and ZF) and, if the flags 
are in the specified state (condition), performs a jump to the target instruction specified by the destination 
operand. A condition code (cc) is associated with each instruction to indicate the condition being tested for. If the 
condition is not satisfied, the jump is not performed and execution continues with the instruction following the Jcc 
instruction. 


The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc- 
tion pointer in the EIP register). A relative offset (re/8, re/16, or rel32) is generally specified as a label in assembly 
code, but at the machine code level, it is encoded as a signed, 8-bit or 32-bit immediate value, which is added to 

the instruction pointer. Instruction coding is most efficient for offsets of -128 to +127. If the operand-size attribute 
is 16, the upper two bytes of the EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits. 


The conditions for each Jcc mnemonic are given in the “Description” column of the table on the preceding page. The 
terms “less” and “greater” are used for comparisons of signed integers and the terms “above” and “below” are used 
for unsigned integers. 

Because a particular state of the status flags can sometimes be interpreted in two ways, two mnemonics are 


defined for some opcodes. For example, the JA (jump if above) instruction and the JNBE (jump if not below or 
equal) instruction are alternate mnemonics for the opcode 77H. 


The Jcc instruction does not support far jumps (jumps to other code segments). When the target for the conditional 
jump is in a different segment, use the opposite condition from the condition being tested for the Jcc instruction, 
and then access the target with an unconditional far jump (JMP instruction) to the other segment. For example, the 
following conditional far jump is illegal: 


JZ FARLABEL; 
To accomplish this far jump, use the following two instructions: 
JNZ BEYOND; 


JMP FARLABEL; 
BEYOND: 


The JRCXZ, JECXZ and JCXZ instructions differ from other Jcc instructions because they do not check status flags. 
Instead, they check RCX, ECX or CX for 0. The register checked is determined by the address-size attribute. These 
instructions are useful when used at the beginning of a loop that terminates with a conditional loop instruction 
(such as LOOPNE). They can be used to prevent an instruction sequence from entering a loop when RCX, ECX or 
CX is 0. This would cause the loop to execute 264, 232 or 64K times (not zero times). 


All conditional jumps are converted to code fetches of one or two cache lines, regardless of jump address or cache- 
ability. 


In 64-bit mode, operand size is fixed at 64 bits. JMP Short is RIP = RIP + 8-bit offset sign extended to 64 bits. JMP 
Near is RIP = RIP + 32-bit offset sign extended to 64 bits. 
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Operation 


IF condition 
THEN 
tempEIP := EIP + SignExtend(DEST); 
IF OperandSize = 16 
THEN tempElP := tempEIP AND OOOOFFFFH; 
Fl; 
IF tempEIP is not within code segment limit 
THEN #GP(0); 
ELSE EIP := temp€IP 
Fl; 
Fl; 


Flags Affected 
None 


Protected Mode Exceptions 
#GP(0) If the offset being jumped to is beyond the limits of the CS segment. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If the offset being jumped to is beyond the limits of the CS segment or is outside of the effec- 
tive address space from 0 to FFFFH. This condition can occur if a 32-bit address size override 
prefix is used. 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(0) If the memory address is in a non-canonical form. 
#UD If the LOCK prefix is used. 
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JMP—jJump 
Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
EB cb JMP rel8 D Valid Valid Jump short, RIP = RIP + 8-bit displacement sign 
extended to 64-bits 
ES cw JMP rel76 D N.S. Valid Jump near, relative, displacement relative to 
next instruction. Not supported in 64-bit 
mode. 
E9 cd JMP rel32 D Valid Valid Jump near, relative, RIP = RIP + 32-bit 
displacement sign extended to 64-bits 
FF /4 JMP r/m16 M N.S. Valid Jump near, absolute indirect, address = zero- 
extended r/m76. Not supported in 64-bit 
mode. 
FF /4 JMP r/m32 M N.S. Valid Jump near, absolute indirect, address given in 
r/m32. Not supported in 64-bit mode. 
FF /4 JMP r/m64 M Valid N.E. Jump near, absolute indirect, RIP = 64-Bit 
offset from register or memory 
EA cd JMP ptr16:16 S Inv. Valid Jump far, absolute, address given in operand 
EA cp JMP ptr16:32 S Inv. Valid Jump far, absolute, address given in operand 
FF /5 JMP m16:16 M Valid Valid Jump far, absolute indirect, address given in 
m16:16 
FF /5 JMP m16:32 M Valid Valid Jump far, absolute indirect, address given in 
m16:32. 
REX.W FF /5 JMP m16:64 M Valid N.E. Jump far, absolute indirect, address given in 
m16:64. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
S Segment + Absolute Address NA NA NA 
D Offset NA NA NA 
M ModRM:r/m (r) NA NA NA 
Description 


Transfers program control to a different point in the instruction stream without recording return information. The 
destination (target) operand specifies the address of the instruction being jumped to. This operand can be an 
immediate value, a general-purpose register, or a memory location. 


This instruction can be used to execute four different types of jumps: 


¢ Near jump—A jump to an instruction within the current code segment (the segment currently pointed to by the 
CS register), sometimes referred to as an intrasegment jump. 


¢ Short jump—A near jump where the jump range is limited to -128 to +127 from the current EIP value. 


¢ Far jump—A jump to an instruction located in a different segment than the current code segment but at the 
same privilege level, sometimes referred to as an intersegment jump. 


° Task switch—A jump to an instruction located in a different task. 


A task switch can only be executed in protected mode (see Chapter 7, in the Inte/® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3A, for information on performing task switches with the JMP instruction). 


Near and Short Jumps. When executing a near jump, the processor jumps to the address (within the current code 
segment) that is specified with the target operand. The target operand specifies either an absolute offset (that is 
an offset from the base of the code segment) or a relative offset (a signed displacement relative to the current 
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value of the instruction pointer in the EIP register). A near jump to a relative offset of 8-bits (re/8) is referred to as 
a short jump. The CS register is not changed on near and short jumps. 


An absolute offset is specified indirectly in a general-purpose register or a memory location (r/m16 or r/m32). The 
operand-size attribute determines the size of the target operand (16 or 32 bits). Absolute offsets are loaded 
directly into the EIP register. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared, 
resulting in a maximum instruction pointer size of 16 bits. 


A relative offset (re/8, re/16, or re/32) is generally specified as a label in assembly code, but at the machine code 
level, it is encoded as a signed 8-, 16-, or 32-bit immediate value. This value is added to the value in the EIP 
register. (Here, the EIP register contains the address of the instruction following the JMP instruction). When using 
relative offsets, the opcode (for short vs. near jumps) and the operand-size attribute (for near relative jumps) 
determines the size of the target operand (8, 16, or 32 bits). 


Far Jumps in Real-Address or Virtual-8086 Mode. When executing a far jump in real-address or virtual-8086 mode, 
the processor jumps to the code segment and offset specified with the target operand. Here the target operand 
specifies an absolute far address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory 
location (m16:16 or m16:32). With the pointer method, the segment and address of the called procedure is 
encoded in the instruction, using a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address imme- 
diate. With the indirect method, the target operand specifies a memory location that contains a 4-byte (16-bit 
operand size) or 6-byte (32-bit operand size) far address. The far address is loaded directly into the CS and EIP 
registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared. 


Far Jumps in Protected Mode. When the processor is operating in protected mode, the JMP instruction can be used 
to perform the following three types of far jumps: 


¢ Afar jump to a conforming or non-conforming code segment. 

¢ A far jump through a call gate. 

¢ A task switch. 

(The JMP instruction cannot be used to perform inter-privilege-level far jumps.) 


In protected mode, the processor always uses the segment selector part of the far address to access the corre- 
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access 
rights determine the type of jump to be performed. 


If the selected descriptor is for a code segment, a far jump to a code segment at the same privilege level is 
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming, 
a general-protection exception is generated.) A far jump to the same privilege level in protected mode is very 
similar to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far 
address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or 
m16:32). The operand-size attribute determines the size of the offset (16 or 32 bits) in the far address. The new 
code segment selector and its descriptor are loaded into CS register, and the offset from the instruction is loaded 
into the EIP register. Note that a call gate (described in the next paragraph) can also be used to perform far call to 
a code segment at the same privilege level. Using this mechanism provides an extra level of indirection and is the 
preferred method of making jumps between 16-bit and 32-bit code segments. 


When executing a far jump through a call gate, the segment selector specified by the target operand identifies the 
call gate. (The offset part of the target operand is ignored.) The processor then jumps to the code segment speci- 
fied in the call gate descriptor and begins executing the instruction at the offset specified in the call gate. No stack 
switch occurs. Here again, the target operand can specify the far address of the call gate either directly with a 
pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). 


Executing a task switch with the JMP instruction is somewhat similar to executing a jump through a call gate. Here 
the target operand specifies the segment selector of the task gate for the task being switched to (and the offset 
part of the target operand is ignored). The task gate in turn points to the TSS for the task, which contains the 
segment selectors for the task’s code and stack segments. The TSS also contains the EIP value for the next instruc- 
tion that was to be executed before the task was suspended. This instruction pointer value is loaded into the EIP 
register so that the task begins executing again at this next instruction. 


The JMP instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of the 
task gate. See Chapter 7 in Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for 
detailed information on the mechanics of a task switch. 
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Note that when you execute at task switch with a JMP instruction, the nested task flag (NT) is not set in the EFLAGS 
register and the new TSS's previous task link field is not loaded with the old task’s TSS selector. A return to the 
previous task can thus not be carried out by executing the IRET instruction. Switching tasks with the JMP instruc- 
tion differs in this regard from the CALL instruction which does set the NT flag and save the previous task link infor- 
mation, allowing a return to the calling task with an IRET instruction. 


Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement 
Technology (CET)” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET 
details. 


In 64-Bit Mode. The instruction’s operation size is fixed at 64 bits. If a selector points to a gate, then RIP equals the 
64-bit displacement taken from gate; else RIP equals the zero-extended offset from the far pointer referenced in 
the instruction. 


See the summary chart at the beginning of this section for encoding data and limits. 


Instruction ordering. Instructions following a far jump may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the far jump have 
completed execution (the later instructions may execute before data stored by the earlier instructions have 
become globally visible). 


Certain situations may lead to the next sequential instruction after a near indirect JMP being speculatively 
executed. If software needs to prevent this (e.g., in order to prevent a speculative execution side channel), then an 
INT3 or LFENCE instruction opcode can be placed after the near indirect JMP in order to block speculative execu- 
tion. 


Operation 


IF near jump 
IF 64-bit Mode 
THEN 
IF near relative jump 
THEN 
tempRIP := RIP + DEST; (* RIP is instruction following JMP instruction*) 
ELSE (* Near absolute jump *) 
tempRIP := DEST; 
Fl; 
ELSE 
IF near relative jump 
THEN 
tempEIP := EIP + DEST; (* EIP is instruction following JMP instruction*) 
ELSE (* Near absolute jump *) 
tempEIP := DEST; 
Fl; 
Fl; 
IF ([A32_EFER.LMA = 0 or target mode = Compatibility mode) 
and tempEIP outside code segment limit 
THEN #GP(0); FI 
IF 64-bit mode and tempRIP is not canonical 


THEN #GP(0); 
Fl; 
IF OperandSize = 32 
THEN 
EIP := tempEIP; 
ELSE 


IF OperandSize = 16 
THEN (* OperandSize = 16 *) 
EIP := tempElP AND OOOOFFFFH; 
ELSE (* OperandSize = 64) 
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RIP := tempRIP; 
FI; 
FI; 
IF (IMP near indirect, absolute indirect) 
IF EndbranchEnabledAndNotSuppressed(CPL) 


IF CPL = 3 
THEN 
IF (no 3EH prefix OR IA32_U_CET.NO_TRACK_EN == 0 ) 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 
Fl; 
ELSE 
IF (no 3EH prefix OR IA32_S_CET.NO_TRACK_EN == 0 ) 
THEN 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
Fl; 
Fl; 


Fl; 
Fl; 
Fl; 


IF far jump and (PE = O or (PE= 1 AND VM = 1)) (* Real-address or virtual-8086 mode *) 


THEN 
tempElP := DEST(Offset); (* DEST is ptr76:32 or [m16:32] *) 
IF tempEIP is beyond code segment limit 
THEN #GP(0); FI; 
CS := DEST(segment selector); (* DEST is ptr76:32 or [m16:32] *) 
IF OperandSize = 32 
THEN 
EIP := tempEIP; (* DEST is ptr16:32 or [m16:32] *) 
ELSE (* OperandSize = 16 *) 
EIP := tempElIP AND OOOOFFFFH; (* Clear upper 16 bits *) 
Fl; 
Fl; 
IF far jump and (PE= 1 and VM=0) 
(* IA-32e mode or protected mode, not virtual-8086 mode *) 
THEN 
IF effective address in the CS, DS, ES, FS, GS, or SS segment is illegal 
or segment selector in target operand NULL 
THEN #GP(0); Fl; 
IF segment selector index not within descriptor table limits 
THEN #GP(new selector); Fl; 
Read type and access rights of segment descriptor; 
IF (IA32_EFER.LMA = 0) 
THEN 
IF segment type is not a conforming or nonconforming code 
segment, call gate, task gate, or TSS 
THEN #GP(segment selector); Fl; 
ELSE 
IF segment type is not a conforming or nonconforming code segment 
call gate 
THEN #GP(segment selector); Fl; 
Fl; 
Depending on type and access rights: 
GO TO CONFORMING-CODE-SEGMENT; 
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GO TO NONCONFORMING-CODE-SEGMENT; 
GO TO CALL-GATE; 
GO TO TASK-GATE; 
GO TO TASK-STATE-SEGMENT; 
ELSE 
#GP(segment selector); 
Fl; 
CONFORMING-CODE-SEGMENT: 
IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1 
THEN GP(new code segment selector); FI; 
IF DPL > CPL 
THEN #GP(segment selector); Fl; 
IF segment not present 
THEN #NP(segment selector); Fl; 
tempEIP := DEST(Offset); 
IF OperandSize = 16 
THEN tempEIP := tempEIP AND OOOOFFFFH; 
Fl; 
IF (IA32_EFER.LMA = 0 or target mode = Compatibility mode) and 
tempEIP outside code segment limit 
THEN #GP(0); FI 
IF tempElP is non-canonical 
THEN #GP(0); Fl; 
IF ShadowStackEnabled(CPL) 
IF ([A32_EFER.LMA and DEST(segment selector).L) = 0 
(* If target is legacy or compatibility mode then the SSP must be in low 4GB *) 
IF (SSP & OxFFFFFFFFOOO00000 != 0) 
THEN #GP(0); Fl; 
Fl; 
Fl; 
CS := DEST[segment selector]; (* Segment descriptor information also loaded *) 
CS(RPL) := CPL 
EIP := tempEIP; 
IF EndbranchEnabled(CPL) 
IF CPL = 3 
THEN 
IA32_U_CET. TRACKER = WAIT_FOR_ENDBRANCH 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 
END; 
NONCONFORMING-CODE-SEGMENT: 
IF L-Bit= 1 and D-BIT = 1 and IA32_EFER.LMA = 1 
THEN GP(new code segment selector); FI; 
IF (RPL > CPL) OR (DPL + CPL) 
THEN #GP(code segment selector); Fl; 
IF segment not present 
THEN #NP(segment selector); Fl; 
tempEIP := DEST(Offset); 
IF OperandSize = 16 
THEN tempEIP := tempEIP AND OOOOFFFFH; FI; 


JMP—Jump Vol.2A 3-543 


INSTRUCTION SET REFERENCE, A-L 


IF ([A32_EFER.LMA = O OR target mode = Compatibility mode) 
and tempEIP outside code segment limit 
THEN #GP(0); FI 
IF tempEIP is non-canonical THEN #GP(0); Fl; 
IF ShadowStackEnabled(CPL) 
IF (IA32_EFER.LMA and DEST(segment selector).L) = 0 
(* If target is legacy or compatibility mode then the SSP must be in low 4GB *) 
IF (SSP & OxFFFFFFFFOOOO000N != 0) 
THEN #GP(0); Fl; 
Fl; 
Fl; 
CS := DEST[segment selector]; (* Segment descriptor information also loaded *) 
CS(RPL) := CPL; 
EIP := tempElP; 
IF EndbranchEnabled(CPL) 
IF CPL = 3 
THEN 
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 


Fl; 
Fl; 
END; 
CALL-GATE: 


IF call gate DPL < CPL 
or call gate DPL < call gate segment-selector RPL 
THEN #GP(call gate selector); Fl; 
IF call gate not present 
THEN #NP(call gate selector); Fl; 
IF call gate code-segment selector is NULL 
THEN #GP(0); FI; 
IF call gate code-segment selector index outside descriptor table limits 
THEN #GP(code segment selector); Fl; 
Read code segment descriptor; 
IF code-segment segment descriptor does not indicate a code segment 
or code-segment segment descriptor is conforming and DPL > CPL 
or code-segment segment descriptor is non-conforming and DPL # CPL 
THEN #GP(code segment selector); Fl; 
IF IA32_EFER.LMA = 1 and (code-segment descriptor is not a 64-bit code segment 
or code-segment segment descriptor has both L-Bit and D-bit set) 
THEN #GP(code segment selector); Fl; 
IF code segment is not present 
THEN #NP(code-segment selector); Fl; 
tempEIP := DEST(Offset); 
IF GateSize = 16 
THEN tempElP := tempEIP AND OOOOFFFFH; FI; 
IF ([A32_EFER.LMA = O OR target mode = Compatibility mode) AND tempEIP 
outside code segment limit 
THEN #GP(0); FI 
CS := DEST[SegmentSelector]; (* Segment descriptor information also loaded *) 
CS(RPL) := CPL; 
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EIP := tempElP; 
IF EndbranchEnabled(CPL) 
IF CPL = 3 
THEN 
IA32_U_CET. TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_U_CET.SUPPRESS = 0 
ELSE 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH; 
IA32_S_CET.SUPPRESS = 0 
Fl; 
Fl; 
END; 
TASK-GATE: 
IF task gate DPL < CPL 
or task gate DPL < task gate segment-selector RPL 
THEN #GP(task gate selector); FI; 
IF task gate not present 
THEN #NP(gate selector); FI; 
Read the TSS segment selector in the task-gate descriptor; 
IF TSS segment selector local/global bit is set to local 
or index not within GDT limits 
or descriptor is not a TSS segment 
or TSS descriptor specifies that the TSS is busy 
THEN #GP(TSS selector); Fl; 
IF TSS not present 
THEN #NP(TSS selector); Fl; 
SWITCH-TASKS to TSS; 
IF EIP not within code segment limit 
THEN #GP(0); Fl; 
END; 
TASK-STATE-SEGMENT: 
IF TSS DPL < CPL 
or TSS DPL < TSS segment-selector RPL 
or TSS descriptor indicates TSS not available 
THEN #GP(TSS selector); Fl; 
IF TSS is not present 
THEN #NP(TSS selector); Fl; 
SWITCH-TASKS to TSS; 
IF EIP not within code segment limit 
THEN #GP(0); Fl; 
END; 


Flags Affected 
All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur. 


Protected Mode Exceptions 
#GP(0) If offset in target operand, call gate, or TSS is beyond the code segment limits. 
If the segment selector in the destination operand, call gate, task gate, or TSS is NULL. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If target mode is compatibility mode and SSP is not in low 4GB. 
#GP(selector) If the segment selector index is outside descriptor table limits. 
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#SS(0) 
#NP (selector) 


#PF(fault-code) 
#AC(0) 


#UD 


If the segment descriptor pointed to by the segment selector in the destination operand is not 
for a conforming-code segment, nonconforming-code segment, call gate, task gate, or task 
state segment. 


If the DPL for a nonconforming-code segment is not equal to the CPL 


(When not using a call gate.) If the RPL for the segment’s segment selector is greater than the 
CPL. 


If the DPL for a conforming-code segment is greater than the CPL. 


If the DPL from a call-gate, task-gate, or TSS segment descriptor is less than the CPL or than 
the RPL of the call-gate, task-gate, or TSS’s segment selector. 


If the segment descriptor for selector in a call gate does not indicate it is a code segment. 


If the segment descriptor for the segment selector in a task gate does not indicate an available 
TSS. 


If the segment selector for a TSS has its local/global bit set for local. 

If a TSS segment descriptor specifies that the TSS is busy or not available. 
If a memory operand effective address is outside the SS segment limit. 

If the code segment being accessed is not present. 

If call gate, task gate, or TSS not present. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. (Only occurs when fetching target from memory.) 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 


#SS 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 
#SS(0) 
#PF(fault-code) 
#AC(0) 


#UD 


If the target operand is beyond the code segment limits. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made. (Only occurs 
when fetching target from memory.) 


If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as 64-bit mode exceptions. 


64-Bit Mode Exceptions 


#GP(0) 


#GP(selector) 
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If the segment descriptor from a 64-bit call gate is in non-canonical space. 


If the segment descriptor pointed to by the segment selector in the destination operand is not 
for a conforming-code segment, nonconforming-code segment, 64-bit call gate. 


If the segment descriptor pointed to by the segment selector in the destination operand is a 
code segment, and has both the D-bit and the L-bit set. 


If the DPL for a nonconforming-code segment is not equal to the CPL, or the RPL for the 
segment’s segment selector is greater than the CPL. 


If the DPL for a conforming-code segment is greater than the CPL. 

If the DPL from a 64-bit call-gate is less than the CPL or than the RPL of the 64-bit call-gate. 
If the upper type field of a 64-bit call gate is not Ox0. 

If the segment selector from a 64-bit call gate is beyond the descriptor table limits. 


If the code segment descriptor pointed to by the selector in the 64-bit gate doesn't have the 
L-bit set and the D-bit clear. 


If the segment descriptor for a segment selector from the 64-bit call gate does not indicate it 
is a code segment. 


If the code segment is non-conforming and CPL #DPL. 

If the code segment is confirming and CPL < DPL. 

If a code segment or 64-bit call gate is not present. 

(64-bit mode only) If a far jump is direct to an absolute address in memory. 
If the LOCK prefix is used. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
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KADDW/KADDB/KADDQ/KADDD—ADD Two Masks 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
VEX.L1.0F.WO 4A /r RVR VIN AVX512DQ | Add 16 bits masks in k2 and k3 and place result in k1. 
KADDW k1, k2, k3 
VEX.L1.66.0F.WO 4A /r RVR VIN AVX512DQ | Add 8 bits masks in k2 and k3 and place result in k1. 
KADDB k1, k2, k3 
VEX.L1.0F.W1 4A /r RVR VIV AVX512BW | Add 64 bits masks in k2 and k3 and place result in k1. 
KADDQ k1, k2, k3 
VEX.L1.66.0F.W1 4A /r RVR VIV AVX512BW | Add 32 bits masks in k2 and k3 and place result in k1. 
KADDD k1, k2, k3 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 1 1b) 
Description 


Adds the vector mask k2 and the vector mask k3, and writes the result into vector mask k1. 


Operation 
KADDW 


DEST[15:0] := SRC1[15:0] + SRC2[15:0] 


DEST[MAX_KL-1:16] := 0 


KADDB 


DEST[7:0] = SRC1[7:0] + SRC2[7:0] 


DEST[MAX_KL-1:8] := 0 


KADDQ 


DEST[63:0] := SRC1[63:0] + SRC2[63:0] 


DEST[MAX_KL-1:64] := 0 


KADDD 


DEST[31:0] := SRC1[31:0] + SRC2[31:0] 


DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KANDW/KANDB/KANDQ/KANDD—Bitwise Logical AND Masks 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
VEX.L1.0F.WO 41 /r RVR VIV AVX512F Bitwise AND 16 bits masks k2 and k3 and place result in k1. 
KANDW k1, k2, k3 
VEX.L1.66.0F.WO 41 /r RVR VV AVX512DQ_ | Bitwise AND 8 bits masks k2 and k3 and place result in k1. 
KANDB k1, k2, k3 
VEX.L1.0F.W1 41 /r RVR VIV AVX512BW | Bitwise AND 64 bits masks k2 and k3 and place result in k1. 
KANDQ k1, k2, k3 
VEX.L1.66.0F.W1 41 /r RVR VIV AVX512BW | Bitwise AND 32 bits masks k2 and k3 and place result in k1. 
KANDD k1, k2, k3 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise AND between the vector mask k2 and the vector mask k3, and writes the result into vector mask 
k1. 


Operation 

KANDW 

DEST[15:0] := SRC1[15:0] BITWISE AND SRC2[15:0] 
DEST[MAX_KL-1:16] := 0 


KANDB 
DEST[7:0] = SRC1[7:0] BITWISE AND SRC2[7:0] 
DEST[MAX_KL-1:8] := 0 


KANDQ 
DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0] 
DEST[MAX_KL-1:64] := 0 


KANDD 
DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0] 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


KANDW __mmask16_mm512_kand(__mmask16 a,__ mmask16 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KANDNW/KANDNB/KANDNQ/KANDND-—Bitwise Logical AND NOT Masks 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
VEX.L1.0F.WO 42 /r RVR VIV AVX512F Bitwise AND NOT 16 bits masks k2 and k3 and place result in 
KANDNW k1, k2, k3 k1, 
VEX.L1.66.0F.WO 42 /r RVR VN AVX512DQ_ | Bitwise AND NOT 8 bits masks k1 and k2 and place result in k1. 
KANDNB k1, k2, k3 
VEX.L1.0F.W1 42 /r RVR VIV AVX512BW | Bitwise AND NOT 64 bits masks k2 and k3 and place result in 
KANDNQ k1, k2, k3 k1, 
VEX.L1.66.0F.W1 42 /r RVR VIV AVX512BW | Bitwise AND NOT 32 bits masks k2 and k3 and place result in 
KANDND k1, k2, k3 k1, 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1 vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise AND NOT between the vector mask k2 and the vector mask k3, and writes the result into vector 
mask ki. 


Operation 

KANDNW 

DEST[15:0] := (BITWISE NOT SRC1[15:0]) BITWISE AND SRC2[15:0] 
DEST[MAX_KL-1:16] := 0 


KANDNB 
DEST[7:0] := (BITWISE NOT SRC1[7:0]) BITWISE AND SRC2[7:0] 
DEST[MAX_KL-1:8] := 0 


KANDNQ 
DEST[63:0] := (BITWISE NOT SRC1[63:0]) BITWISE AND SRC2[63:0] 
DEST[MAX_KL-1:64] := 0 


KANDND 
DEST[31:0] := (BITWISE NOT SRC1[31:0]) BITWISE AND SRC2[31:0] 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
KANDNW __mmask16 _mm512_kandn(__mmask16 a,__mmask16 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KMOVW/KMOVB/KMOVQ/KMOVD—Move from and to Mask Registers 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support Flag 
VEX.LO.OF.WO 90 /r RM VIN AVX512F Move 16 bits mask from k2/m16 and store the result in k1. 
KMOVW k1, k2/m16 
VEX.LO.66.0F.WO 90 /r RM VIV AVX512DQ Move 8 bits mask from k2/m8 and store the result in k1. 
KMOVB k1, k2/m8 
VEX.LO.OF.W1 90 /r RM VIN AVX512BW Move 64 bits mask from k2/m64 and store the result in k1. 
KMOVQ k1, k2/m64 
VEX.LO.66.0F.W1 90 /r RM VIN AVX512BW Move 32 bits mask from k2/m32 and store the result in k1. 
KMOVD k1, k2/m32 
VEX.LO.OF.WO 91 /r MR VIN AVX512F Move 16 bits mask from k1 and store the result in m16. 
KMOVW m16, k1 
VEX.LO.66.0F.WO 91 /r MR VIV AVX512DQ Move 8 bits mask from k1 and store the result in m8. 
KMOVB m8, k1 
VEX.LO.OF.W1 91 /r MR VIV AVX512BW_ | Move 64 bits mask from k1 and store the result in m64. 
KMOVQ m64, k1 
VEX.LO.66.0F.W1 91 /r MR VIN AVX512BW Move 32 bits mask from k1 and store the result in m32. 
KMOVD m32, k1 
VEX.LO.OF.WO 92 /r RR VIV AVX512F Move 16 bits mask from r32 to k1. 
KMOVW k1, r32 
VEX.LO.66.0F.WO 92 /r RR VIV AVX512DQ Move 8 bits mask from r32 to k1. 
KMOVB k1, r32 
VEX.LO.F2.0F.W1 92 /r RR V/I AVX512BW | Move 64 bits mask from r64 to k1. 
KMOVQ k1, r64 
VEX.LO.F2.0F.WO 92 /r RR VIV AVX512BW | Move 32 bits mask from r32 to k1. 
KMOVD k1, r32 
VEX.LO.OF.WO 93 /r RR VIV AVX512F Move 16 bits mask from k1 to r32. 
KMOVW r32, k1 
VEX.LO.66.0F.WO 93 /r RR VIN AVX512DQ Move 8 bits mask from k1 to r32. 
KMOVB r32, k1 
VEX.LO.F2.0F.W1 93 /r RR V/I AVX512BW | Move 64 bits mask from k1 to r64. 
KMOVQ r64, k1 
VEX.LO.F2.0F.WO 93 /r RR VIV AVX512BW | Move 32 bits mask from k1 to r32. 
KMOVD r32, k1 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 
RM ModRM:reg (w) ModRM:r/m (r) 
MR ModRM:r/m (w, ModRM:[7:6] must not be 11b) ModRM:reg (r) 
RR ModRM:reg (w) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Copies values from the source operand (second operand) to the destination operand (first operand). The source 
and destination operands can be mask registers, memory location or general purpose. The instruction cannot be 
used to transfer data between general purpose registers and or memory locations. 


When moving to a mask register, the result is zero extended to MAX_KL size (i.e., 64 bits currently). When moving 
to a general-purpose register (GPR), the result is zero-extended to the size of the destination. In 32-bit mode, the 
default GPR destination’s size is 32 bits. In 64-bit mode, the default GPR destination’s size is 64 bits. Note that 
VEX.W can only be used to modify the size of the GPR operand in 64b mode. 
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Operation 


KMOVW 

IF *destination is a memory location* 
DEST[15:0] := SRC[15:0] 

IF *destination is a mask register or a GPR * 
DEST := ZeroExtension(SRC[15:0]) 


KMOVB 

IF *destination is a memory location* 
DEST[7:0] := SRC[7:0] 

IF *destination is a mask register or a GPR * 
DEST := ZeroExtension(SRC[7:0]) 


KMOVQ 

IF *destination is a memory location or a GPR* 
DEST[63:0] := SRC[63:0] 

IF *destination is a mask register* 
DEST := ZeroExtension(SRC[63:0]) 


KMOVD 

IF *destination is a memory location* 
DEST[31:0] := SRC[31:0] 

IF *destination is a mask register or a GPR * 
DEST := ZeroExtension(SRC[31:0]) 


Intel C/C++ Compiler Intrinsic Equivalent 
KMOVW __mmask16 _mm512_kmov(__mmask16 a); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Instructions with RR operand encoding, see Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask 


Instructions w/o Memory Arg)”. 


Instructions with RM or MR operand encoding, see Table 2-64, “TYPE K21 Exception Definition (VEX-Encoded 


OpMask Instructions Addressing Memory)”. 
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KNOTW/KNOTB/KNOTQ/KNOTD—NOT Mask Register 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bit Mode | Feature Flag 

Support 
VEX.LO.OF.WO 44 /r RR VN AVX512F Bitwise NOT of 16 bits mask k2. 
KNOTW k1, k2 
VEX.LO.66.0F.WO 44 /r RR VV AVX512DQ Bitwise NOT of 8 bits mask k2. 
KNOTB k1, k2 
VEX.LO.OF.W1 44 /r RR VV AVX512BW Bitwise NOT of 64 bits mask k2. 
KNOTQ k1, k2 
VEX.LO.66.0F.W1 44 /r RR VN AVX512BW Bitwise NOT of 32 bits mask k2. 
KNOTD k1, k2 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 
RR ModRM:reg (w) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise NOT of vector mask k2 and writes the result into vector mask k1. 


Operation 


KNOTW 
DEST[15:0] := BITWISE NOT SRC[15:0] 
DEST[MAX_KL-1:16] := 0 


KNOTB 
DEST[7:0] := BITWISE NOT SRC[7:0] 
DEST[MAX_KL-1:8] := 0 


KNOTQ 
DEST[63:0] := BITWISE NOT SRC[63:0] 
DEST[MAX_KL-1:64] := 0 


KNOTD 
DEST[31:0] := BITWISE NOT SRC[31:0] 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
KNOTW __mmask16 _mm512_knot(__mmask16 a); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KORW/KORB/KORQ/KORD—Bitwise Logical OR Masks 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
VEX.L1.0F.WO 45 /r RVR VIV AVX512F Bitwise OR 16 bits masks k2 and k3 and place result in k1. 
KORW k1, k2, k3 
VEX.L1.66.0F.WO 45 /r RVR VIV AVX512DQ Bitwise OR 8 bits masks k2 and k3 and place result in k1. 
KORB k1, k2, k3 
VEX.L1.0F.W1 45 /r RVR VIV AVX512BW | Bitwise OR 64 bits masks k2 and k3 and place result in k1. 
KORQ k1, k2, k3 
VEX.L1.66.0F.W1 45 /r RVR VIV AVX512BW | Bitwise OR 32 bits masks k2 and k3 and place result in k1. 
KORD k1, k2, k3 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise OR between the vector mask k2 and the vector mask k3, and writes the result into vector mask 
k1 (three-operand form). 


Operation 

KORW 

DEST[15:0] := SRC1[15:0] BITWISE OR SRC2[15:0] 
DEST[MAX_KL-1:16] := 0 


KORB 
DEST[7:0] = SRC1[7:0] BITWISE OR SRC2[7:0] 
DEST[MAX_KL-1:8] := 0 


KORQ 
DEST[63:0] := SRC1[63:0] BITWISE OR SRC2[63:0] 
DEST[MAX_KL-1:64] := 0 


KORD 
DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0] 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


KORW __mmask16_mm512_kor(__mmask16 a,__ mmask16 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KORTESTW/KORTESTB/KORTESTQ/KORTESTD—OR Masks And Set Flags 


Instruction En bit Mode | Feature 
Support | Flag 


Opcode/ Op/ | 64/32 CPUID Description 


KORTESTW k1, k2 


VEX.LO.OF.WO 98 /r RR VIV AVX512F Bitwise OR 16 bits masks k1 and k2 and update ZF and CF accordingly. 


KORTESTB k1, k2 


VEX.LO.66.0F.WO 98 /r_ | RR VIN AVX512DQ | Bitwise OR 8 bits masks k1 and k2 and update ZF and CF accordingly. 


KORTESTQ k1, k2 


VEX.LO.OF.W1 98 /r RR VIV AVX512BW | Bitwise OR 64 bits masks k1 and k2 and update ZF and CF accordingly. 


KORTESTD k1, k2 


VEX.LO.66.0F.W1 98 /r | RR VIV AVX512BW | Bitwise OR 32 bits masks k1 and k2 and update ZF and CF accordingly. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 
RR ModRM:reg (w) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise OR between the vector mask register k2, and the vector mask register k1, and sets CF and ZF 


based on the operation result. 


ZF flag is set if both sources are Ox0. CF is set if, after the OR operation is done, the operation result is all 1’s. 


Operation 


KORTESTW 
TMP[15:0] := DEST[15:0] BITWISE OR SRC[15:0] 
IF(TMP[1 5:0]=0) 
THEN ZF := 1 
ELSE ZF :=0 
Fl; 
IF(TMP[1 5:0]=FFFFh) 
THEN CF := 1 
ELSE CF := 0 
Fl; 


KORTESTB 
TMP[7:0] := DEST[7:0] BITWISE OR SRC[7:0] 
IF(TMP[7:0]=0) 
THEN ZF := 1 
ELSE ZF :=0 
Fl; 
IF(TMP[7:0]==FFh) 
THEN CF := 1 
ELSE CF := 0 


Fl; 


KORTESTW/KORTESTB/KORTESTQ/KORTESTD—OR Masks And Set Flags 
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KORTESTQ 
TMP[63:0] := DEST[63:0] BITWISE OR SRC[63:0] 
IF(TMP[63:0]=0) 
THEN ZF := 1 
ELSE ZF := 0 
Fl; 
IF(TMP[63:0]==FFFFFFFF_FFFFFFFFh) 
THEN CF := 1 
ELSE CF := 0 
Fl; 


KORTESTD 
TMP[31:0] := DEST[31:0] BITWISE OR SRC[31:0] 
IF(TMP[31:0]=0) 
THEN ZF := 1 
ELSE ZF :=0 
Fl; 
IF(TMP[31:0]=FFFFFFFFh) 
THEN CF := 1 
ELSE CF :=0 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 
KORTESTW __mmask16_mm512_kortest[cz](__mmask16 a,__ mmask16 b); 


Flags Affected 

The ZF flag is set if the result of OR-ing both sources is all Os. 
The CF flag is set if the result of OR-ing both sources is all is. 
The OF, SF, AF, and PF flags are set to 0. 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD—Shift Left Mask Registers 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
VEX.LO.66.0F3A.W1 32 /r RRI VIV AVX512F Shift left 16 bits in k2 by immediate and write result in k1. 
KSHIFTLW k1, k2, imm8 
VEX.LO.66.0F3A.WO 32 /r RRI VIN AVX512DQ_| Shift left 8 bits in k2 by immediate and write result in k1. 
KSHIFTLB k1, k2, imm8 
VEX.LO.66.0F3A.W1 33 /r RRI VIV AVX512BW | Shift left 64 bits in k2 by immediate and write result in k1. 
KSHIFTLO k1, k2, imm8 
VEX.LO.66.0F3A.WO 33 /r RRI VV AVX512BW | Shift left 32 bits in k2 by immediate and write result in k1. 
KSHIFTLD k1, k2, imm8 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RRI ModRM:reg (w) ModRM:r/m (r, ModRM:[7:6] must be 11b) Imm8s8 
Description 


Shifts 8/16/32/64 bits in the second operand (source operand) left by the count specified in immediate byte and 
place the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destina- 
tion are zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for 

word shift), 31 (for doubleword shift) or 63 (for quadword shift). 


Operation 

KSHIFTLW 

COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=15 


THEN DEST[15:0] := SRC1[15:0] << COUNT; 


Fl; 


KSHIFTLB 

COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=7 


THEN — DEST[7:0] := SRC1[7:0] << COUNT; 


Fl; 


KSHIFTLOQ 

COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=63 


THEN —DEST[63:0] := SRC1[63:0] << COUNT; 


Fl; 


KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD—Shift Left Mask Registers 
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KSHIFTLD 

COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=31 


THEN = DEST[31:0] := SRC1[31:0] << COUNT; 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 
Compiler auto generates KSHIFTLW when needed. 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD—Shift Right Mask Registers 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 

VEX.LO.66.0F3A.W1 30 /r RRI VIV AVX512F Shift right 16 bits in k2 by immediate and write result in k1. 
KSHIFTRW k1, k2, imm8 
VEX.LO.66.0F3A.WO 30 /r RRI VN AVX512DQ_ | Shift right 8 bits in k2 by immediate and write result in k1. 
KSHIFTRB k1, k2, imm8 
VEX.LO.66.0F3A.W1 31 /r RRI VIV AVX512BW | Shift right 64 bits in k2 by immediate and write result in k1. 
KSHIFTRQ k1, k2, imm8 
VEX.LO.66.0F3A.WO 31 /r RRI VIV AVX512BW | Shift right 32 bits in k2 by immediate and write result in k1. 
KSHIFTRD k1, k2, imm8 

Instruction Operand Encoding 

Op/En Operand 1 Operand 2 Operand 3 
RRI ModRM:reg (w) ModRM:r/m (r, ModRM:[7:6] must be 11b) Imm8 
Description 


Shifts 8/16/32/64 bits in the second operand (source operand) right by the count specified in immediate and place 
the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destination are 
zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for word shift), 
31 (for doubleword shift) or 63 (for quadword shift). 


Operation 
KSHIFTRW 

COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=15 


THEN DEST[15:0] := SRC1[15:0] >> COUNT; 


Fl; 


KSHIFTRB 
COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=7 


THEN 
Fl; 


KSHIFTRQ 

COUNT := imm8[7:0] 

DEST[MAX_KL-1:0] := 0 

IF COUNT <=63 
THEN 

Fl; 


DEST[7:0] := SRC1[7:0] >> COUNT; 


DEST[63:0] := SRC1[63:0] >> COUNT; 


KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD—Shift Right Mask Registers 
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KSHIFTRD 
COUNT := imm8[7:0] 
DEST[MAX_KL-1:0] := 0 
IF COUNT <=31 
THEN DEST[31:0] := SRC1[31:0] >> COUNT; 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 
Compiler auto generates KSHIFTRW when needed. 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KTESTW/KTESTB/KTESTQ/KTESTD—Packed Bit Test Masks and Set Flags 


Opcode/ Op 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.LO.OF.WO 99 /r RR VV AVX512DQ Set ZF and CF depending on sign bit AND and ANDN of 16 bits mask 
KTESTW k1, k2 register sources. 
VEX.LO.66.0F.WO 99 /r RR VV AVX512DQ Set ZF and CF depending on sign bit AND and ANDN of 8 bits mask 
KTESTB k1, k2 register sources. 
VEX.LO.OF.W1 99 /r RR VIV AVX512BW_ | Set ZF and CF depending on sign bit AND and ANDN of 64 bits mask 
KTESTQ k1, k2 register sources. 
VEX.LO.66.0F.W1 99 /r RR VIV AVX512BW_ | Set ZF and CF depending on sign bit AND and ANDN of 32 bits mask 
KTESTD k1, k2 register sources. 


Instruction Operand Encoding 


Op/En Operand 1 
RR ModRM:reg (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise comparison of the bits of the first source operand and corresponding bits in the second source 
operand. If the AND operation produces all zeros, the ZF is set else the ZF is clear. If the bitwise AND operation of 
the inverted first source operand with the second source operand produces all zeros the CF is set else the CF is 


clear. Only the EFLAGS register is updated. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


KTESTW 
TEMP[15:0] := SRC2[15:0] AND SRC1[15:0] 
IF (TEMP[15:0] = = 0) 
THEN ZF :=1; 
ELSE ZF := 0; 
Fl; 
TEMP[15:0] := SRC2[15:0] AND NOT SRC1[15:0] 
IF (TEMP[15:0] = = 0) 
THEN CF :=1; 
ELSE CF := 0; 
Fl; 
AF := OF := PF := SF := 0; 


KTESTB 
TEMP[7:0] := SRC2[7:0] AND SRC1[7:0] 
IF (TEMP[7:0] = = 0) 
THEN ZF :=1; 
ELSE ZF := 0; 
Fl; 
TEMP[7:0] := SRC2[7:0] AND NOT SRC1[7:0] 
IF (TEMP[7:0] = = 0) 
THEN CF :=1; 
ELSE CF := 0; 
Fl; 
AF := OF := PF := SF := 0; 


KTESTW/KTESTB/KTESTQ/KTESTD—Packed Bit Test Masks and Set Flags 
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KTESTQ 
TEMP[63:0] := SRC2[63:0] AND SRC1[63:0] 
IF (TEMP[63:0] = = 0) 
THEN ZF :=1; 
ELSE ZF := 0; 
Fl; 
TEMP[63:0] := SRC2[63:0] AND NOT SRC1[63:0] 
IF (TEMP[63:0] = = 0) 
THEN CF :=1; 
ELSE CF := 0; 
Fl; 
AF := OF := PF := SF := 0; 


KTESTD 
TEMP[31:0] := SRC2[31:0] AND SRC1[31:0] 
IF (TEMP[3 1:0] = = 0) 
THEN ZF :=1; 
ELSE ZF := 0; 
Fl; 
TEMP[31:0] := SRC2[31:0] AND NOT SRC1[31:0] 
IF (TEMP[3 1:0] = = 0) 
THEN CF :=1; 
ELSE CF := 0; 
Fl; 
AF := OF := PF := SF := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KUNPCKBW/KUNPCKWD/KUNPCKDQ—Unpack for Mask Registers 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
VEX.L1.66.0F.WO 4B /r RVR VIV AVX512F Unpack 8-bit masks in k2 and k3 and write word result in k1. 
KUNPCKBW k1, k2, k3 
VEX.L1.0F.WO 4B /r RVR VIV AVX512BW | Unpack 16-bit masks in k2 and k3 and write doubleword result 
KUNPCKWD k1, k2, k3 ink. 
VEX.L1.0F.W1 4B /r RVR VIV AVX512BW | Unpack 32-bit masks in k2 and k3 and write quadword result 
KUNPCKDQ k1, k2, k3 ink. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1 vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Unpacks the lower 8/16/32 bits of the second and third operands (source operands) into the low part of the first 
operand (destination operand), starting from the low bytes. The result is zero-extended in the destination. 


Operation 

KUNPCKBW 

DEST[7:0] := SRC2[7:0] 
DEST[15:8] := SRC1[7:0] 
DEST[MAX_KL-1:16] := 0 


KUNPCKWD 
DEST[15:0] := SRC2[15:0] 


DEST[31:16] := SRC1[15:0] 
DEST[MAX_KL-1:32] := 0 


KUNPCKDQ 
DEST[31:0] := SRC2[31:0] 


DEST[63:32] = SRC1[31:0] 
DEST[MAX_KL-1:64] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

KUNPCKBW __mmask16 _mm512_kunpackb(__mmask16 a, ___mmask16 b); 
KUNPCKDQ __mmask64 _mm512_kunpackd(__mmask64 a, __mmask64 b); 

KUNPCKWD __mmask32 _mm512_kunpackw(__mmask32 a, __mmask32 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KXNORW/KXNORB/KXNORQ/KXNORD—Bitwise Logical XNOR Masks 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
VEX.L1.0F.WO 46 /r RVR VIV AVX512F Bitwise XNOR 16-bit masks k2 and k3 and place result in k1. 
KXNORW k1, k2, k3 
VEX.L1.66.0F.WO 46 /r RVR VN AVX512DQ_ | Bitwise XNOR 8-bit masks k2 and k3 and place result in k1. 
KXNORB k1, k2, k3 
VEX.L1.0F.W1 46 /r RVR VV AVX512BW | Bitwise XNOR 64-bit masks k2 and k3 and place result in k1. 
KXNORQ k1, k2, k3 
VEX.L1.66.0F.W1 46 /r RVR VIN AVX512BW | Bitwise XNOR 32-bit masks k2 and k3 and place result in k1. 
KXNORD k1, k2, k3 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1 vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise XNOR between the vector mask k2 and the vector mask k3, and writes the result into vector 
mask ki (three-operand form). 


Operation 

KXNORW 

DEST[15:0] := NOT (SRC1[15:0] BITWISE XOR SRC2[15:0)) 
DEST[MAX_KL-1:16] := 0 


KXNORB 
DEST[7:0] := NOT (SRC1[7:0] BITWISE XOR SRC2[7:0]) 
DEST[MAX_KL-1:8] := 0 


KXNORQ 
DEST[63:0] := NOT (SRC1[63:0] BITWISE XOR SRC2[63:0]) 
DEST[MAX_KL-1:64] := 0 


KXNORD 
DEST[31:0] := NOT (SRC1[31:0] BITWISE XOR SRC2[31:0]) 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


KXNORW __mmask16 _mm512_kxnor(__mmask16 a, __mmask16 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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KXORW/KXORB/KXORQ/KXORD—Bitwise Logical XOR Masks 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
VEX.L1.0F.WO 47 /r RVR VIV AVX512F Bitwise XOR 16-bit masks k2 and k3 and place result in k1. 
KXORW k1, k2, k3 
VEX.L1.66.0F.WO 47 /r RVR VIV AVX512DQ Bitwise XOR 8-bit masks k2 and k3 and place result in k1. 
KXORB k1, k2, k3 
VEX.L1.0F.W1 47 /r RVR VIV AVX512BW | Bitwise XOR 64-bit masks k2 and k3 and place result in k1. 
KXORQ k1, k2, k3 
VEX.L1.66.0F.W1 47 /r RVR VIV AVX512BW | Bitwise XOR 32-bit masks k2 and k3 and place result in k1. 
KXORD k1, k2, k3 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RVR ModRM:reg (w) VEX.1 vvv (r) ModRM:r/m (r, ModRM:[7:6] must be 11b) 
Description 


Performs a bitwise XOR between the vector mask k2 and the vector mask k3, and writes the result into vector mask 
k1 (three-operand form). 


Operation 

KXORW 

DEST[15:0] := SRC1[15:0] BITWISE XOR SRC2[15:0] 
DEST[MAX_KL-1:16] := 0 


KXORB 
DEST[7:0] = SRC1[7:0] BITWISE XOR SRC2[7:0] 
DEST[MAX_KL-1:8] := 0 


KXORQ 
DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0] 
DEST[MAX_KL-1:64] := 0 


KXORD 
DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0] 
DEST[MAX_KL-1:32] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


KXORW __mmask16 _mm512_kxor(__mmask16 a, __mmask16 b); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”. 
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LAHF—Load Status Flags into AH Register 


Opcode Instruction Op/ |64-Bit |Compat/ |Description 

En |Mode Leg Mode 
OF LAHF ZO | Invalid* | Valid Load: AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF). 
NOTES: 


*Valid in specific steppings. See Description section. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only 
if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1. 


Operation 


IF 64-Bit Mode 
THEN 
IF CPUID.8Z0000001 H:ECX.LAHF-SAHF[bit 0] = 1; 
THEN AH := RFLAGS(SF:ZF:0:AF:0:PF:1 :CF); 
ELSE #UD; 
Fl; 
ELSE 
AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF); 
Fl; 


Flags Affected 
None. The state of the flags in the EFLAGS register is not affected. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 0. 
If the LOCK prefix is used. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF O2 /r LAR r16, r16/m16 RM_ | Valid Valid r16:= access rights referenced by r16/m16 
OF O2 /r LAR reg, r32/m16" RM_ | Valid Valid reg := access rights referenced by r32/m16 
NOTES: 


1. For all loads (regardless of source or destination sizing) only bits 16-0 are used. Other bits are ignored. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Loads the access rights from the segment descriptor specified by the second operand (source operand) into the 
first operand (destination operand) and sets the ZF flag in the flag register. The source operand (which can bea 
register or a memory location) contains the segment selector for the segment descriptor being accessed. If the 
source operand is a memory address, only 16 bits of data are accessed. The destination operand is a general- 
purpose register. 


The processor performs access checks as part of the loading process. Once loaded in the destination register, soft- 
ware can perform additional checks on the access rights information. 


The access rights for a segment descriptor include fields located in the second doubleword (bytes 4-7) of the 
segment descriptor. The following fields are loaded by the LAR instruction: 


Bits 7:0 are returned as 0 
Bits 11:8 return the segment type. 
Bit 12 returns the S flag. 


¢ Bits 14:13 return the DPL. 
¢ Bit 15 returns the P flag. 
¢ The following fields are returned only if the operand size is greater than 16 bits: 
— Bits 19:16 are undefined. 
— Bit 20 returns the software-available bit in the descriptor. 
— Bit 21 returns the L flag. 
— Bit 22 returns the D/B flag. 
— Bit 23 returns the G flag. 
— Bits 31:24 are returned as 0. 
This instruction performs the following checks before it loads the access rights in the destination register: 
° Checks that the segment selector is not NULL. 


¢ Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being 
accessed 


¢ Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for 
(can be accessed with) the LAR instruction. The valid system segment and gate descriptor types are given in 
Table 3-53. 


¢ If the segment is not a conforming code segment, it checks that the specified segment descriptor is visible at 
the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of the segment 
selector). 


If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no 
access rights are loaded in the destination operand. 
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The LAR instruction can only be executed in protected mode and IA-32e mode. 
Table 3-53. Segment and Gate Types 


Type Protected Mode IA-32e Mode 
Name Valid Name Valid 
0 Reserved No Reserved No 
1 Available 16-bit TSS Yes Reserved No 
2 LDT Yes LDT Yes 
3 Busy 16-bit TSS Yes Reserved No 
4 16-bit call gate Yes Reserved No 
5 16-bit/32-bit task gate Yes Reserved No 
6 16-bit interrupt gate No Reserved No 
7 16-bit trap gate No Reserved No 
8 Reserved No Reserved No 
9 Available 32-bit TSS Yes Available 64-bit TSS Yes 
A Reserved No Reserved No 
B Busy 32-bit TSS Yes Busy 64-bit TSS Yes 
Cc 32-bit call gate Yes 64-bit call gate Yes 
D Reserved No Reserved No 
E 32-bit interrupt gate No 64-bit interrupt gate No 
F 32-bit trap gate No 64-bit trap gate No 
Operation 
IF Offset(SRC) > descriptor table limit 
THEN 
ZF :=0; 
ELSE 


SegmentDescriptor := descriptor referenced by SRC; 

IF SegmentDescriptor(Type) 4 conforming code segment 
and (CPL > DPL) or (RPL > DPL) 

or SegmentDescriptor(Type) is not valid for instruction 


THEN 
ZF := 0; 
ELSE 
DEST := access rights from SegmentDescriptor as given in Description section; 
ZF := 1; 
Fl; 
Fl; 
Flags Affected 


The ZF flag is set to 1 if the access rights are loaded successfully; otherwise, it is cleared to 0. 
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Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and the memory operand effective address is unaligned while 
the current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The LAR instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The LAR instruction cannot be executed in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If the memory operand effective address referencing the SS segment is in a non-canonical 
form. 

#GP(0) If the memory operand effective address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and the memory operand effective address is unaligned while 
the current privilege level is 3. 

#UD If the LOCK prefix is used. 
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LDDQU—Load Unaligned Integer 128 Bits 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
F2 OF FO /r RM |V/V SSE3 Load unaligned data from mem and return 
LDDQU xmm1, mem double quadword in xmm1. 
VEX.128.F2.0F.WIG FO /r RM |V/V AVX Load unaligned packed integer values from 
VLDDQU xmm1, m128 mem to xmm1. 
VEX.256.F2.0F.WIG FO /r RM |V/V AVX Load unaligned packed integer values from 
VLDDQU ymm1, m256 mem to ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


The instruction is functionally similar to (V)MOVDQU ymm/xmm, m256/m128 for loading from memory. That is: 
32/16 bytes of data starting at an address specified by the source memory operand (second operand) are fetched 
from memory and placed in a destination register (first operand). The source operand need not be aligned ona 
32/16-byte boundary. Up to 64/32 bytes may be loaded from memory; this is implementation dependent. 


This instruction may improve performance relative to (V)MOVDQU if the source operand crosses a cache line 
boundary. In situations that require the data loaded by (V)LDDQU be modified and stored to the same location, use 
(V)MOVDQU or (V)MOVDQA instead of (V)LDDQU. To move a double quadword to or from memory locations that 
are known to be aligned on 16-byte boundaries, use the (V)MOVDQA instruction. 


Implementation Notes 

e If the source is aligned to a 32/16-byte boundary, based on the implementation, the 32/16 bytes may be 
loaded more than once. For that reason, the usage of (V)LDDQU should be avoided when using uncached or 
write-combining (WC) memory regions. For uncached or WC memory regions, keep using (V)MOVDQU. 

¢ This instruction is a replacement for (V)MOVDQU (load) in situations where cache line splits significantly affect 
performance. It should not be used in situations where store-load forwarding is performance critical. If 
performance of store-load forwarding is critical to the application, use (V)MOVDQA store-load pairs when data 
is 256/128-bit aligned or (V)MOVDQU store-load pairs when data is 256/128-bit unaligned. 

e If the memory address is not aligned on 32/16-byte boundary, some implementations may load up to 64/32 
bytes and return 32/16 bytes in the destination. Some processor implementations may issue multiple loads to 
access the appropriate 32/16 bytes. Developers of multi-threaded or multi-processor software should be aware 
that on these processors the loads will be performed in a non-atomic way. 

¢ If alignment checking is enabled (CRO.AM = 1, RFLAGS.AC = 1, and CPL = 3), an alignment-check exception 
(#AC) may or may not be generated (depending on processor implementation) when the memory address is 
not aligned on an 8-byte boundary. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 

LDDQU (128-bit Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


3-570 Vol. 2A LDDQU—Load Unaligned Integer 128 Bits 


VLDDQU (VEX.128 encoded version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


VLDDQU (VEX.256 encoded version) 
DEST[255:0] := SRC[255:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


LDDQU: m128i__mm_Iddqu_si128 (__m128i * p); 


VLDDQU: __m256i__mm256_Iddqu_si256 (__m256i * p); 


Numeric Exceptions 
None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”. 


Note treatment of #AC varies. 
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LDMXCSR—Load MXCSR Register 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
NP OF AE /2 M VIV SSE Load MXCSR register from m32. 
LDMXCSR m32 
VEX.LZ.OF.WIG AE /2 M VN AVX Load MXCSR register from m32. 
VLDMXCSR m32 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the source operand into the MXCSR control/status register. The source operand is a 32-bit memory location. 
See “MXCSR Control and Status Register” in Chapter 10, of the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 1, for a description of the MXCSR register and its contents. 


The LDMXCSR instruction is typically used in conjunction with the (V)STMXCSR instruction, which stores the 
contents of the MXCSR register in memory. 


The default MXCSR value at reset is 1F80H. 


If a (V)LDMXCSR instruction clears a SIMD floating-point exception mask bit and sets the corresponding exception 
flag bit, a SIMD floating-point exception will not be immediately generated. The exception will be generated only 
upon the execution of the next instruction that meets both conditions below: 


° the instruction must operate on an XMM or YMM register operand, 
°¢ the instruction causes that particular SIMD floating-point exception to be reported. 
This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


If VLDMXCSR is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an 
#UD exception. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 
Operation 
MXCSR := m32; 


C/C++ Compiler Intrinsic Equivalent 


_mm_setcsr(unsigned int i) 


Numeric Exceptions 
None 


Other Exceptions 

See Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#GP For an attempt to set reserved bits in MXCSR. 
#UD If VEX.vvvv # 1111B. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

C5 /r LDS r76,m16:16 RM_ | Invalid Valid Load DS:r76 with far pointer from memory. 
C5 /r LDS r32,m16:32 RM_ | Invalid Valid Load DS:r32 with far pointer from memory. 
OF B2 /r LSS r76,m16:16 RM_ | Valid Valid Load SS:r76 with far pointer from memory. 
OF B2 /r LSS r32,m16:32 RM_ | Valid Valid Load SS:r32 with far pointer from memory. 
REX + OF B2 /r LSS r64,m16:64 RM_ | Valid N.E. Load SS:r64 with far pointer from memory. 
C4 /r LES r16,m16:16 RM_ | Invalid Valid Load ES:r76 with far pointer from memory. 
C4 /r LES r32,m16:32 RM_ | Invalid Valid Load ES:r32 with far pointer from memory. 
OF B4 /r LFS r16,m16:16 RM_ | Valid Valid Load FS:r76 with far pointer from memory. 
OF B4 /r LFS r32,m16:32 RM_ | Valid Valid Load FS:r32 with far pointer from memory. 
REX + OF B4 /r LFS r64,m16:64 RM_ | Valid N.E. Load FS:r64 with far pointer from memory. 
OF B5 /r LGS r16,m16:16 RM_ | Valid Valid Load GS:r76 with far pointer from memory. 
OF B5 /r LGS r32,m16:32 RM_ | Valid Valid Load GS:r32 with far pointer from memory. 
REX + OF B5 /r LGS r64,m16:64 RM_ | Valid N.E. Load GS:r64 with far pointer from memory. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Loads a far pointer (segment selector and offset) from the second operand (source operand) into a segment 
register and the first operand (destination operand). The source operand specifies a 48-bit or a 32-bit pointer in 
memory depending on the current setting of the operand-size attribute (32 bits or 16 bits, respectively). The 
instruction opcode and the destination operand specify a segment register/general-purpose register pair. The 16- 
bit segment selector from the source operand is loaded into the segment register specified with the opcode (DS, 
SS, ES, FS, or GS). The 32-bit or 16-bit offset is loaded into the register specified with the destination operand. 


If one of these instructions is executed in protected mode, additional information from the segment descriptor 
pointed to by the segment selector in the source operand is loaded in the hidden part of the selected segment 
register. 


Also in protected mode, a NULL selector (values 0000 through 0003) can be loaded into DS, ES, FS, or GS registers 
without causing a protection exception. (Any subsequent reference to a segment whose corresponding segment 
register is loaded with a NULL selector, causes a general-protection exception (#GP) and no memory reference to 
the segment occurs. ) 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.W promotes 
operation to specify a source operand referencing an 80-bit pointer (16-bit selector, 64-bit offset) in memory. Using 
a REX prefix in the form of REX.R permits access to additional registers (R8-R15). See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 
64-BIT_MODE 
IF SS is loaded 
THEN 
IF SegmentSelector = NULL and ( (RPL = 3) or 
(RPL 4 3 and RPL + CPL) ) 
THEN #GP(0); 


ELSE IF descriptor is in non-canonical space 
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THEN #GP(0); Fl; 
ELSE IF Segment selector index is not within descriptor table limits 
or segment selector RPL # CPL 
or access rights indicate nonwritable data segment 
or DPL# CPL 
THEN #GP(selector); Fl; 
ELSE IF Segment marked not present 
THEN #SS(selector); Fl; 
Fl; 
SS := SegmentSelector(SRC); 
SS := SegmentDescriptor([SRC]); 
ELSE IF attempt to load DS, or ES 
THEN #UD; 
ELSE IF FS, or GS is loaded with non-NULL segment selector 
THEN IF Segment selector index is not within descriptor table limits 
or access rights indicate segment neither data nor readable code segment 
or segment is data or nonconforming-code segment 
and (RPL > DPL or CPL > DPL) 
THEN #GP(selector); Fl; 
ELSE IF Segment marked not present 
THEN #NP(selector); Fl; 
Fl; 
SegmentRegister := SegmentSelector(SRC) ; 
SegmentRegister := SegmentDescriptor([SRC]); 
Fl; 
ELSE IF FS, or GS is loaded with a NULL selector: 
THEN 
SegmentRegister := NULLSelector; 
SegmentRegister(DescriptorValidBit) := 0; Fl; (* Hidden flag; 
not accessible by software *) 
Fl; 
DEST := Offset(SRQ); 


PREOTECTED MODE OR COMPATIBILITY MODE; 
IF SS is loaded 
THEN 
IF SegementSelector = NULL 
THEN #GP(0); 
ELSE IF Segment selector index is not within descriptor table limits 
or segment selector RPL # CPL 
or access rights indicate nonwritable data segment 
or DPL #4 CPL 
THEN #GP(selector); Fl; 
ELSE IF Segment marked not present 
THEN #SS(selector); Fl; 
Fl; 
SS := SegmentSelector(SRC); 
SS := SegmentDescriptor([SRC]); 
ELSE IF DS, ES, FS, or GS is loaded with non-NULL segment selector 
THEN IF Segment selector index is not within descriptor table limits 
or access rights indicate segment neither data nor readable code segment 
or segment is data or nonconforming-code segment 
and (RPL > DPL or CPL > DPL) 
THEN #GP(selector); Fl; 
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ELSE IF Segment marked not present 
THEN #NP(selector); Fl; 


Fl; 


SegmentRegister := SegmentSelector(SRC) AND RPL; 
SegmentRegister := SegmentDescriptor([SRC]); 


Fl; 


ELSE IF DS, ES, FS, or GS is loaded with a NULL selector: 


THEN 


SegmentRegister := NULLSelector; 
SegmentRegister(DescriptorValidBit) := 0; Fl; (* Hidden flag; 
not accessible by software *) 


Fl; 


DEST := Offset(SRC); 


Real-Address or Virtual-8086 Mode 
SegmentRegister := SegmentSelector(SRC); Fl; 


DEST := Offset(SRQ); 


Flags Affected 
None 


Protected Mode Exceptions 


#UD 


#GP(0) 


#GP(selector) 


#SS(0) 
#SS(selector) 
#NP(selector) 


#PF(fault-code) 
#AC(0) 


If source operand is not a memory location. 

If the LOCK prefix is used. 

If a NULL selector is loaded into the SS register. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

If the SS register is being loaded and any of the following is true: the segment selector index 
is not within the descriptor table limits, the segment selector RPL is not equal to CPL, the 
segment is a non-writable data segment, or DPL is not equal to CPL. 


If the DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and any of 
the following is true: the segment selector index is not within descriptor table limits, the 
segment is neither a data nor a readable code segment, or the segment is a data or noncon- 
forming-code segment and both RPL and CPL are greater than DPL. 


If a memory operand effective address is outside the SS segment limit. 
If the SS register is being loaded and the segment is marked not present. 


If DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and the 
segment is marked not present. 


If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


Real-Address Mode Exceptions 


#GP 
#SS 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If source operand is not a memory location. 

If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#UD 


#GP(0) 
#SS(0) 
#PF(fault-code) 
#AC(0) 


If source operand is not a memory location. 

If the LOCK prefix is used. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#GP(Selector) 


#SS(0) 
#SS(Selector) 
#NP(selector) 


#PF(fault-code) 
#AC(0) 


#UD 
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If the memory address is in a non-canonical form. 
If a NULL selector is attempted to be loaded into the SS register in compatibility mode. 
If a NULL selector is attempted to be loaded into the SS register in CPL3 and 64-bit mode. 


If a NULL selector is attempted to be loaded into the SS register in non-CPL3 and 64-bit mode 
where its RPL is not equal to CPL. 


If the FS, or GS register is being loaded with a non-NULL segment selector and any of the 
following is true: the segment selector index is not within descriptor table limits, the memory 
address of the descriptor is non-canonical, the segment is neither a data nor a readable code 
segment, or the segment is a data or nonconforming-code segment and both RPL and CPL are 
greater than DPL. 


If the SS register is being loaded and any of the following is true: the segment selector index 
is not within the descriptor table limits, the memory address of the descriptor is non-canonical, 
the segment selector RPL is not equal to CPL, the segment is a nonwritable data segment, or 
DPL is not equal to CPL. 


If a memory operand effective address is non-canonical 
If the SS register is being loaded and the segment is marked not present. 


If FS, or GS register is being loaded with a non-NULL segment selector and the segment is 
marked not present. 


If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If source operand is not a memory location. 
If the LOCK prefix is used. 
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LEA—Load Effective Address 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
8D /r LEA r16,m RM | Valid Valid Store effective address for min register r76. 
8D /r LEA r32,m RM | Valid Valid Store effective address for min register r32. 
REX.W + 8D /r LEA r64,m RM_ | Valid N.E. Store effective address for min register r64. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 

Description 


Computes the effective address of the second operand (the source operand) and stores it in the first operand 
(destination operand). The source operand is a memory address (offset part) specified with one of the processors 
addressing modes; the destination operand is a general-purpose register. The address-size and operand-size attri- 
butes affect the action performed by this instruction, as shown in the following table. The operand-size attribute of 
the instruction is determined by the chosen register; the address-size attribute is determined by the attribute of 
the code segment. 


Table 3-54. Non-64-bit Mode LEA Operation with Address and Operand Size Attributes 


Operand Size Address Size Action Performed 
16 16 16-bit effective address is calculated and stored in requested 16-bit register destination. 
16 32 32-bit effective address is calculated. The lower 16 bits of the address are stored in the 
requested 16-bit register destination. 
32 16 16-bit effective address is calculated. The 16-bit address is zero-extended and stored in the 
requested 32-bit register destination. 
32 32 32-bit effective address is calculated and stored in the requested 32-bit register destination. 


Different assemblers may use different algorithms based on the size attribute and symbolic reference of the source 
operand. 


In 64-bit mode, the instruction’s destination operand is governed by operand size attribute, the default operand 
size is 32 bits. Address calculation is governed by address size attribute, the default address size is 64-bits. In 64- 
bit mode, address size of 16 bits is not encodable. See Table 3-55. 


Table 3-55. 64-bit Mode LEA Operation with Address and Operand Size Attributes 


Operand Size Address Size Action Performed 

16 32 32-bit effective address is calculated (using 67H prefix). The lower 16 bits of the address are 
stored in the requested 16-bit register destination (using 66H prefix). 

16 64 64-bit effective address is calculated (default address size). The lower 16 bits of the address 
are stored in the requested 16-bit register destination (using 66H prefix). 

32 32 32-bit effective address is calculated (using 67H prefix) and stored in the requested 32-bit 
register destination. 

32 64 64-bit effective address is calculated (default address size) and the lower 32 bits of the 
address are stored in the requested 32-bit register destination. 

64 32 32-bit effective address is calculated (using 67H prefix), zero-extended to 64-bits, and stored 
in the requested 64-bit register destination (using REX.W). 

64 64 64-bit effective address is calculated (default address size) and all 64-bits of the address are 
stored in the requested 64-bit register destination (using REX.W). 
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Operation 


IF OperandSize = 16 and AddressSize = 16 


Fl; 


THEN 
DEST := EffectiveAddress(SRC); (* 16-bit address *) 
ELSE IF OperandSize = 16 and AddressSize = 32 
THEN 
temp := EffectiveAddress(SRC); (* 32-bit address *) 
DEST := temp[0:15]; (* 16-bit address *) 
Fl; 
ELSE IF OperandSize = 32 and AddressSize = 16 
THEN 
temp := EffectiveAddress(SRC); (* 16-bit address *) 
DEST := ZeroExtend(temp); (* 32-bit address *) 
Fl; 
ELSE IF OperandSize = 32 and AddressSize = 32 
THEN 
DEST := EffectiveAddress(SRC); (* 32-bit address *) 
Fl; 
ELSE IF OperandSize = 16 and AddressSize = 64 
THEN 
temp := EffectiveAddress(SRC); (* 64-bit address *) 
DEST := temp[0:15]; (* 16-bit address *) 
Fl; 
ELSE IF OperandSize = 32 and AddressSize = 64 
THEN 
temp := EffectiveAddress(SRC); (* 64-bit address *) 
DEST := temp[0:31]; (* 16-bit address *) 
Fl; 
ELSE IF OperandSize = 64 and AddressSize = 64 
THEN 
DEST := EffectiveAddress(SRC); (* 64-bit address *) 
Fl; 


Flags Affected 
None 


Protected Mode Exceptions 


#UD 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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If source operand is not a memory location. 
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LEAVE—High Level Procedure Exit 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
cg LEAVE ZO | Valid Valid Set SP to BP, then pop BP. 
cg LEAVE ZO |N.E. Valid Set ESP to EBP, then pop EBP. 
c9 LEAVE ZO | Valid N.E. Set RSP to RBP, then pop RBP. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Releases the stack frame set up by an earlier ENTER instruction. The LEAVE instruction copies the frame pointer (in 
the EBP register) into the stack pointer register (ESP), which releases the stack space allocated to the stack frame. 
The old frame pointer (the frame pointer for the calling procedure that was saved by the ENTER instruction) is then 
popped from the stack into the EBP register, restoring the calling procedure’s stack frame. 


A RET instruction is commonly executed following a LEAVE instruction to return program control to the calling 
procedure. 


See “Procedure Calls for Block-Structured Languages” in Chapter 7 of the Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1, for detailed information on the use of the ENTER and LEAVE instructions. 


In 64-bit mode, the instruction’s default operation size is 64 bits; 32-bit operation cannot be encoded. See the 
summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF StackAddressSize = 32 
THEN 
ESP := EBP; 
ELSE IF StackAddressSize = 64 
THEN RSP := RBP; FI; 
ELSE IF StackAddressSize = 16 
THEN SP := BP; FI; 
Fl; 


IF OperandSize = 32 
THEN EBP := Pop(); 
ELSE IF OperandSize = 64 
THEN RBP := Pop(); FI; 
ELSE IF OperandSize = 16 
THEN BP := Pop(); Fl; 
Fl; 


Flags Affected 
None 
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Protected Mode Exceptions 


#SS(0) 


#PF(fault-code) 
#AC(0) 


#UD 


If the EBP register points to a location that is not within the limits of the current stack 
segment. 


If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#UD 


If the EBP register points to a location outside of the effective address space from 0 to FFFFH. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 
#PF(fault-code) 
#AC(0) 

#UD 


If the EBP register points to a location outside of the effective address space from 0 to FFFFH. 
If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#AC(0) 


#UD 
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If the stack address is in a non-canonical form. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


LEAVE—High Level Procedure Exit 


INSTRUCTION SET REFERENCE, A-L 


LFENCE—Load Fence 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En | Mode Feature 
Support | Flag 
NP OF AE E8 ZO |VIV SSE2 Serializes load operations. 
LFENCE 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Performs a serializing operation on all load-from-memory instructions that were issued prior the LFENCE instruc- 
tion. Specifically, LFENCE does not execute until all prior instructions have completed locally, and no later instruc- 
tion begins execution until LFENCE completes. In particular, an instruction that loads from memory and that 
precedes an LFENCE receives data from memory prior to completion of the LFENCE. (An LFENCE that follows an 
instruction that stores to memory might complete before the data being stored have become globally visible. ) 
Instructions following an LFENCE may be fetched from memory before the LFENCE, but they will not execute (even 
speculatively) until the LFENCE completes. 


Weakly ordered memory types can be used to achieve higher processor performance through such techniques as 
out-of-order issue and speculative reads. The degree to which a consumer of data recognizes or knows that the 
data is weakly ordered varies among applications and may be unknown to the producer of this data. The LFENCE 
instruction provides a performance-efficient way of ensuring load ordering between routines that produce weakly- 
ordered results and routines that consume that data. 


Processors are free to fetch and cache data speculatively from regions of system memory that use the WB, WC, 
and WT memory types. This speculative fetching can occur at any time and is not tied to instruction execution. 
Thus, it is not ordered with respect to executions of the LFENCE instruction; data can be brought into the caches 
speculatively just before, during, or after the execution of an LFENCE instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Specification of the instruction's opcode above indicates a ModR/M byte of E8. For this instruction, the processor 
ignores the r/m field of the ModR/M byte. Thus, LFENCE is encoded by any opcode of the form OF AE Ex, where x is 
in the range 8-F. 


Operation 
Wait_On_Following_Instructions_Until(preceding_instructions_complete); 
Intel C/C++ Compiler Intrinsic Equivalent 

void _mm_Ifence(void) 


Exceptions (All Modes of Operation) 
#UD If CPUID.O1H:EDX.SSE2[bit 26] = 0. 
If the LOCK prefix is used. 
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LGDT/LIDT—Load Global/Interrupt Descriptor Table Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF 01 /2 LGDT m16&32 M NE. Valid Load minto GDTR. 
OF 01 /3 LIDT m16&32 M NE. Valid Load minto IDTR. 
OF 01 /2 LGDT m16&64 M Valid NE. Load minto GDTR. 
OF 01 /3 LIDT m16&64 M Valid NE. Load minto IDTR. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the values in the source operand into the global descriptor table register (GDTR) or the interrupt descriptor 
table register (IDTR). The source operand specifies a 6-byte memory location that contains the base address (a 
linear address) and the limit (size of table in bytes) of the global descriptor table (GDT) or the interrupt descriptor 
table (IDT). If operand-size attribute is 32 bits, a 16-bit limit (lower 2 bytes of the 6-byte data operand) and a 32- 
bit base address (upper 4 bytes of the data operand) are loaded into the register. If the operand-size attribute 
is 16 bits, a 16-bit limit (lower 2 bytes) and a 24-bit base address (third, fourth, and fifth byte) are loaded. Here, 
the high-order byte of the operand is not used and the high-order byte of the base address in the GDTR or IDTR is 
filled with zeros. 


The LGDT and LIDT instructions are used only in operating-system software; they are not used in application 
programs. They are the only instructions that directly load a linear address (that is, not a segment-relative 
address) and a limit in protected mode. They are commonly executed in real-address mode to allow processor 
initialization prior to switching to protected mode. 


In 64-bit mode, the instruction’s operand size is fixed at 8+2 bytes (an 8-byte base and a 2-byte limit). See the 
summary chart at the beginning of this section for encoding data and limits. 


See “SGDT—Store Global Descriptor Table Register” in Chapter 4, Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2B, for information on storing the contents of the GDTR and IDTR. 
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Operation 
IF Instruction is LIDT 
THEN 
IF OperandSize = 16 
THEN 
IDTR(Limit) := SRC[O:1 5]; 
IDTR(Base) := SRC[16:47] AND OOFFFFFFH; 
ELSE IF 32-bit Operand Size 
THEN 
IDTR(Limit) := SRC[O:1 5]; 
IDTR(Base) := SRC[16:47]; 
Fl; 
ELSE IF 64-bit Operand Size (* In 64-Bit Mode *) 
THEN 
IDTR(Limit) := SRC[O:1 5]; 
IDTR(Base) := SRC[16:79]; 
Fl; 
Fl; 


ELSE (* Instruction is LGDT *) 
IF OperandSize = 16 
THEN 
GDTR(Limit) := SRC[O:1 5]; 
GDTR(Base) := SRC[16:47] AND OOFFFFFFH; 
ELSE IF 32-bit Operand Size 
THEN 
GDTR(Limit) := SRC[O:1 5]; 
GDTR(Base) := SRC[16:47]; 


Fl; 
ELSE IF 64-bit Operand Size (* In 64-Bit Mode *) 
THEN 
GDTR(Limit) := SRC[O:1 5]; 
GDTR(Base) := SRC[16:79]; 
Fl; 
FI; 
FI; 
Flags Affected 
None 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
#GP(0) If the current privilege level is not 0. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
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Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 


Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 
#GP If the current privilege level is not 0. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the current privilege level is not 0. 

If the memory address is in a non-canonical form. 
#UD If the LOCK prefix is used. 


#PF(fault-code) If a page fault occurs. 
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LLDT—Load Local Descriptor Table Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 00 /2 LLDT r/m16 M Valid Valid Load segment selector r/m16 into LDTR. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the source operand into the segment selector field of the local descriptor table register (LDTR). The source 
operand (a general-purpose register or a memory location) contains a segment selector that points to a local 
descriptor table (LDT). After the segment selector is loaded in the LDTR, the processor uses the segment selector 
to locate the segment descriptor for the LDT in the global descriptor table (GDT). It then loads the segment limit 
and base address for the LDT from the segment descriptor into the LDTR. The segment registers DS, ES, SS, FS, 
GS, and CS are not affected by this instruction, nor is the LDTR field in the task state segment (TSS) for the current 
task. 


If bits 2-15 of the source operand are 0, LDTR is marked invalid and the LLDT instruction completes silently. 
However, all subsequent references to descriptors in the LDT (except by the LAR, VERR, VERW or LSL instructions) 
cause a general protection exception (#GP). 


The operand-size attribute has no effect on this instruction. 


The LLDT instruction is provided for use in operating-system software; it should not be used in application 
programs. This instruction can only be executed in protected mode or 64-bit mode. 


In 64-bit mode, the operand size is fixed at 16 bits. 


Operation 


IF SRC(Offset) > descriptor table limit 
THEN #GP(segment selector); Fl; 


IF segment selector is valid 
Read segment descriptor; 


IF SegmentDescriptor(Type) #4 LDT 
THEN #GP(segment selector); Fl; 

IF segment descriptor is not present 
THEN #NP(segment selector); Fl; 


LDTR(SegmentSelector) := SRC; 
LDTR(SegmentDescriptor) := GDTSegmentDescriptor; 
ELSE LDTR := INVALID 
Fl; 


Flags Affected 
None 
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Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


#SS(0) 
#NP(selector) 
#PF(fault-code) 
#UD 


If the current privilege level is not 0. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT 
is not a Local Descriptor Table. 


Segment selector is beyond GDT limit. 

If a memory operand effective address is outside the SS segment limit. 
If the LDT descriptor is not present. 

If a page fault occurs. 

If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD 


The LLDT instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD 


The LLDT instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 


#GP(selector) 


#NP(selector) 
#PF(fault-code) 
#UD 
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If a memory address referencing the SS segment is in a non-canonical form. 
If the current privilege level is not 0. 
If the memory address is in a non-canonical form. 


If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT 
is not a Local Descriptor Table. 


Segment selector is beyond GDT limit. 
If the LDT descriptor is not present. 

If a page fault occurs. 

If the LOCK prefix is used. 
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LMSW—Load Machine Status Word 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 01 /6 LMSW r/m16 M Valid Valid Loads r/m16 in machine status word of CRO. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the source operand into the machine status word, bits 0 through 15 of register CRO. The source operand can 
be a 16-bit general-purpose register or a memory location. Only the low-order 4 bits of the source operand (which 
contains the PE, MP, EM, and TS flags) are loaded into CRO. The PG, CD, NW, AM, WP, NE, and ET flags of CRO are 
not affected. The operand-size attribute has no effect on this instruction. 


If the PE flag of the source operand (bit 0) is set to 1, the instruction causes the processor to switch to protected 
mode. While in protected mode, the LMSW instruction cannot be used to clear the PE flag and force a switch back 
to real-address mode. 


The LMSW instruction is provided for use in operating-system software; it should not be used in application 
programs. In protected or virtual-8086 mode, it can only be executed at CPL 0. 


This instruction is provided for compatibility with the Intel 286 processor; programs and procedures intended to 
run on IA-32 and Intel 64 processors beginning with Intel386 processors should use the MOV (control registers) 
instruction to load the whole CRO register. The MOV CRO instruction can be used to set and clear the PE flag in CRO, 
allowing a procedure or program to switch between protected and real-address modes. 


This instruction is a serializing instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. Note that the operand size is fixed 
at 16 bits. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 
CRO[0:3] := SRC[O:3]; 


Flags Affected 
None 


Protected Mode Exceptions 

#GP(0) If the current privilege level is not 0. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 
#GP(0) The LMSW instruction is not recognized in virtual-8086 mode. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the current privilege level is not 0. 
If the memory address is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 
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LOADIWKEY—Load Internal Wrapping Key with Key Locker 


Opcode/ Op/ |64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF 38 DC 11:rrr:bbb A VIV KL Load internal wrapping key from xmm1, xmm_z, and 
LOADIWKEY xmm1, xmm2, <EAX>, <XMMO> XMMO. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r) ModRM:r/m (r) Implicit EAX (r) Implicit XMMO (r) 
Description 


The LOADIWKEY! instruction writes the Key Locker internal wrapping key, which is called IWKey. This IWKey is 
used by the ENCODEKEY* instructions to wrap keys into handles. Conversely, the AESENC/DEC*KL instructions 
use IWKey to unwrap those keys from the handles and help verify the handle integrity. For security reasons, no 
instruction is designed to allow software to directly read the IWKey value. 


IWkKey includes two cryptographic keys as well as metadata. The two cryptographic keys are loaded from register 
sources so that LOADIWKEY can be executed without the keys ever being in memory. 


The key input operands are: 

¢ The 256-bit encryption key is loaded from the two explicit operands. 

¢ The 128-bit integrity key is loaded from the implicit operand XMMO. 

The implicit operand EAX specifies the KeySource and whether backing up the key is permitted: 


¢ EAX[0] - When set, the wrapping key being initialized is not permitted to be backed up to platform-scoped 
storage. 


° EAX[4:1] - This specifies the KeySource, which is the type of key. Currently only two encodings are supported. 
A KeySource of 0 indicates that the key input operands described above should be directly stored as the 
internal wrapping keys. LOADIWKEY with a KeySource of 1 will have random numbers from the on-chip random 
number generator XORed with the source registers (including XMMO) so that the software that executes the 
LOADIWKEY does not know the actual IWKey encryption and integrity keys. Software can choose to put 
additional random data into the source registers so that other sources of random data are combined with the 
hardware random number generator supplied value. Software should always check ZF after executing 
LOADIWKEY with KeySource of 1 as this operation may fail due to it being unable to get sufficient full-entropy 
data from the on-chip random number generator. Both KeySource of 0 and 1 specify that IWKey be used with 
the AES-GCM-SIV algorithm. CPUID.19H.ECX[1] enumerates support for KeySource of 1. All other KeySource 
encodings are reserved. 


° EAX[31:5] - Reserved. 


1. Further details on Key Locker and usage of this instruction can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 
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Operation 


LOADIWKEY 
IF CPL > O // LOADKWKEY only allowed at ring 0 (supervisor mode) 
THEN #GP (0); FI; 
IF EAX[4:1] > 1 // Reserved KeySource encoding used 
THEN #GP (0); FI; 
IF EAX[31:5] != 0 // Reserved bit in EAX is set 
THEN #GP (0); Fl; 
IF EAX[O] AND (CPUID.19H.ECX[0] == 0) // NoBackup is not supported on this part 
THEN #GP (0); FI; 
IF (EAX[4:1] == 1) AND (CPUID.19H.ECX[1] == 0) // KeySource of 1 is not supported on this part 
THEN #GP (0); Fl; 
IF (EAX[4:1] == 0) // KeySource of 0 
THEN 
IWKey.Encryption Key[1 27:0] := SRC2[127:0]: 
IWKey.Encryption Key[255:1 28] := SRC1[127:0]; 
IWKey.IntegrityKey[1 27:0] := XMMO[127:0)]; 
IWKey.NoBackup = EAX [0]; 
IWKey.KeySource = EAX [4:1]; 


RFLAGS.ZF := 0; 
ELSE // KeySource of 1. See RDSEED definition for details of randomness 
IF HW_NRND_GEN.ready == // Full-entropy random data from RDSEED hardware block was received 
THEN 


IWKey.Encryption Key[1 27:0] := SRC2[127:0] XOR HW_NRND_GEN.data[1 27:0]; 
IWKey.Encryption Key[255:1 28] := SRC1[127:0] XOR HW_NRND_GEN.data[255:1 28]; 
IwKey.IntegrityKey[1 27:0] := XMMO[1 27:0] XOR HW_NRND_GEN.data[383:256]; 
IWKey.NoBackup = EAX [0]; 
IWKey.KeySource = EAX [4:1]; 
RFLAGS.ZF := 0; 
ELSE // Random data was not returned from RDSEED hardware block. IWKey was not loaded 
RFLAGS.ZF := 1; 
Fl; 
Fl; 
RFLAGS.OF, SF, AF, PF, CF := 0; 


Flags Affected 


ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to full-entropy random data not 
being received from RDSEED. The other arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0. 


Intel C/C++ Compiler Intrinsic Equivalent 


LOADIWKEY void _mm_loadiwkey(unsigned int ctl,__m128i intkey,__m128i enkey_lo,__m128i enkey_hi); 
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Exceptions (All Operating Modes) 
#GP If CPL > 0. (Does not apply in real-address mode.) 
If EAX[4:1] > 1. 
If EAX[31:5] != 0. 
If (EAX[0] == 1) AND (CPUID.19H.ECX[0] == 0). 
If (EAX[4:1] == 1) AND (CPUID.19H.ECX[1] == 0). 
#UD If the LOCK prefix is used. 
If CPUID.O7H:ECX.KL [bit 23] = 0. 
If CR4.KL = 0. 
If CRO.EM = 1. 
If CR4.OSFXSR = 0. 
#NM If CRO.TS = 1. 
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LOCK—Assert LOCK# Signal Prefix 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
FO LOCK ZO | Valid Valid Asserts LOCK# signal for duration of the 
accompanying instruction. 


NOTES: 
* See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Causes the processor’s LOCK# signal to be asserted during execution of the accompanying instruction (turns the 
instruction into an atomic instruction). In a multiprocessor environment, the LOCK# signal ensures that the 
processor has exclusive use of any shared memory while the signal is asserted. 


In most IA-32 and all Intel 64 processors, locking may occur without the LOCK# signal being asserted. See the “IA- 
32 Architecture Compatibility” section below for more details. 


The LOCK prefix can be prepended only to the following instructions and only to those forms of the instructions 
where the destination operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCH8B, 
CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, and XCHG. If the LOCK prefix is used with one of 
these instructions and the source operand is a memory operand, an undefined opcode exception (#UD) may be 
generated. An undefined opcode exception will also be generated if the LOCK prefix is used with any instruction not 
in the above list. The XCHG instruction always asserts the LOCK# signal regardless of the presence or absence of 
the LOCK prefix. 


The LOCK prefix is typically used with the BTS instruction to perform a read-modify-write operation on a memory 
location in shared memory environment. 


The integrity of the LOCK prefix is not affected by the alignment of the memory field. Memory locking is observed 
for arbitrarily misaligned fields. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


Beginning with the P6 family processors, when the LOCK prefix is prefixed to an instruction and the memory area 
being accessed is cached internally in the processor, the LOCK# signal is generally not asserted. Instead, only the 
processor's cache is locked. Here, the processor’s cache coherency mechanism ensures that the operation is 
carried out atomically with regards to memory. See “Effects of a Locked Operation on Internal Processor Caches” 
in Chapter 8 of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, the for more informa- 
tion on locking of caches. 


Operation 


AssertLOCK#(DurationOfAccompaninglnstruction); 


Flags Affected 
None 


Protected Mode Exceptions 


#UD If the LOCK prefix is used with an instruction not listed: ADD, ADC, AND, BTC, BTR, BTS, 
CMPXCHG, CMPXCH8B, CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, 
XCHG. 


Other exceptions can be generated by the instruction when the LOCK prefix is applied. 
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Real-Address Mode Exceptions 


Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 


Same exceptions as in protected mode. 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 
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LODS/LODSB/LODSW/LODSD/LODSQ—Load String 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
AC LODS m8 ZO ‘| Valid Valid For legacy mode, Load byte at address DS:(€)SI 
into AL. For 64-bit mode load byte at address 
(R)SI into AL. 
AD LODS m16 ZO | Valid Valid For legacy mode, Load word at address 


DS:(E)SI into AX. For 64-bit mode load word at 
address (R)SI into AX. 


AD LODS m32 ZO | Valid Valid For legacy mode, Load dword at address 
DS:(E)SI into EAX. For 64-bit mode load dword 
at address (R)SI into EAX. 


REX.W + AD LODS m64 ZO ‘| Valid N.E. Load qword at address (R)SI into RAX. 

AC LODSB ZO | Valid Valid For legacy mode, Load byte at address DS:(€)SI 
into AL. For 64-bit mode load byte at address 
(R)SI into AL. 

AD LODSW ZO | Valid Valid For legacy mode, Load word at address 


DS:(E)SI into AX. For 64-bit mode load word at 
address (R)SI into AX. 


AD LODSD ZO | Valid Valid For legacy mode, Load dword at address 
DS:(E)SI into EAX. For 64-bit mode load dword 
at address (R)SI into EAX. 


REX.W + AD LODSQ ZO ‘| Valid N.E. Load qword at address (R)SI into RAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Loads a byte, word, or doubleword from the source operand into the AL, AX, or EAX register, respectively. The 
source operand is a memory location, the address of which is read from the DS:ESI or the DS:SI registers 
(depending on the address-size attribute of the instruction, 32 or 16, respectively). The DS segment may be over- 
ridden with a segment override prefix. 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the LODS mnemonic) allows the source operand to be 
specified explicitly. Here, the source operand should be a symbol that indicates the size and location of the source 
value. The destination operand is then automatically selected to match the size of the source operand (the AL 
register for byte operands, AX for word operands, and EAX for doubleword operands). This explicit-operands form 
is provided to allow documentation; however, note that the documentation provided by this form can be 
misleading. That is, the source operand symbol must specify the correct type (size) of the operand (byte, word, or 
doubleword), but it does not have to specify the correct location. The location is always specified by the DS:(E)SI 
registers, which must be loaded correctly before the load string instruction is executed. 


The no-operands form provides “short forms” of the byte, word, and doubleword versions of the LODS instructions. 
Here also DS:(E)SI is assumed to be the source operand and the AL, AX, or EAX register is assumed to be the desti- 
nation operand. The size of the source and destination operands is selected with the mnemonic: LODSB (byte 
loaded into register AL), LODSW (word loaded into AX), or LODSD (doubleword loaded into EAX). 


After the byte, word, or doubleword is transferred from the memory location into the AL, AX, or EAX register, the 
(E)SI register is incremented or decremented automatically according to the setting of the DF flag in the EFLAGS 
register. (If the DF flag is 0, the (E)SI register is incremented; if the DF flag is 1, the ESI register is decremented. ) 
The (E)SI register is incremented or decremented by 1 for byte operations, by 2 for word operations, or by 4 for 
doubleword operations. 
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In 64-bit mode, use of the REX.W prefix promotes operation to 64 bits. LODS/LODSQ load the quadword at address 
(R)SI into RAX. The (R)SI register is then incremented or decremented automatically according to the setting of 
the DF flag in the EFLAGS register. 


The LODS, LODSB, LODSW, and LODSD instructions can be preceded by the REP prefix for block loads of ECX 
bytes, words, or doublewords. More often, however, these instructions are used within a LOOP construct because 
further processing of the data moved into the register is usually necessary before the next transfer can be made. 
See “REP/REPE/REPZ /REPNE/REPNZ—Repeat String Operation Prefix” in Chapter 4 of the Inte/® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 2B, for a description of the REP prefix. 


Operation 


IF AL := SRC; (* Byte load *) 
THEN AL := SRC; (* Byte load *) 
IF DF=0 
THEN (E)SI := (E)SI + 1; 
ELSE (E)SI := (€)SI - 1; 
Fl; 
ELSE IF AX := SRC; (* Word load *) 
THEN IF DF= 0 
THEN (E)SI := (E)SI + 2; 
ELSE (E)SI := (€)SI - 2; 
IF; 
Fl; 
ELSE IF EAX := SRC; (* Doubleword load *) 
THEN IF DF =O 
THEN (E)SI := (E)SI + 4; 
ELSE (E)SI := (€)SI - 4; 
Fl; 
Fl; 
ELSE IF RAX := SRC; (* Quadword load *) 
THEN IF DF =0 
THEN (R)SI := (R)SI + 8; 
ELSE (R)SI := (R)SI - 8; 
Fl; 
Fl; 
FI; 


Flags Affected 
None 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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LOOP/LOOPcc—Loop According to ECX Counter 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
E2 cb LOOP re/l8 D Valid Valid Decrement count; jump short if count # 0. 
E1 cb LOOPE re/8 D Valid Valid Decrement count; jump short if count # O and 
ZF =1. 
EO cb LOOPNE re/l8 D Valid Valid Decrement count; jump short if count # O and 
ZF =0. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
D Offset NA NA NA 
Description 


Performs a loop operation using the RCX, ECX or CX register as a counter (depending on whether address size is 64 
bits, 32 bits, or 16 bits). Note that the LOOP instruction ignores REX.W; but 64-bit address size can be over-ridden 
using a 67H prefix. 


Each time the LOOP instruction is executed, the count register is decremented, then checked for 0. If the count is 
0, the loop is terminated and program execution continues with the instruction following the LOOP instruction. If 
the count is not zero, a near jump is performed to the destination (target) operand, which is presumably the 
instruction at the beginning of the loop. 


The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc- 
tion pointer in the IP/EIP/RIP register). This offset is generally specified as a label in assembly code, but at the 
machine code level, it is encoded as a signed, 8-bit immediate value, which is added to the instruction pointer. 
Offsets of -128 to +127 are allowed with this instruction. 


Some forms of the loop instruction (LOOPcc) also accept the ZF flag as a condition for terminating the loop before 
the count reaches zero. With these forms of the instruction, a condition code (cc) is associated with each instruc- 
tion to indicate the condition being tested for. Here, the LOOPcc instruction itself does not affect the state of the ZF 
flag; the ZF flag is changed by other instructions in the loop. 


Operation 


IF (AddressSize = 32) 
THEN Count is ECX; 
ELSE IF (AddressSize = 64) 

Count is RCX; 
ELSE Count is CX; 
Fl; 


Count := Count - 1; 


IF Instruction is not LOOP 
THEN 
IF (Instruction := LOOPE) or (Instruction := LOOPZ) 
THEN IF (ZF = 1) and (Count # 0) 
THEN BranchCond := 1; 
ELSE BranchCond := 0; 
Fl; 
ELSE (Instruction = LOOPNE) or (Instruction = LOOPNZ) 
IF (ZF =O ) and (Count # 0) 
THEN BranchCond := 1; 
ELSE BranchCond := 0; 
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Fl; 
Fl; 
ELSE (* Instruction = LOOP *) 
IF (Count + 0) 
THEN BranchCond := 1; 
ELSE BranchCond := 0; 
Fl; 


Fl; 


IF BranchCond = 1 
THEN 
IF OperandSize = 32 
THEN EIP := EIP + SignExtend(DEST); 
ELSE IF OperandSize = 64 
THEN RIP := RIP + SignExtend(DEST); 
Fl; 
ELSE IF OperandSize = 16 
THEN EIP := EIP AND OOOOFFFFH; 
Fl; 
Fl; 
IF OperandSize = (32 or 64) 
THEN IF (R/E)IP < CS.Base or (R/E)IP > CS.Limit 
#GP; Fl; 
Fl; 
Fl; 
ELSE 
Terminate loop and continue program execution at (R/E)IP; 
Fl; 


Flags Affected 
None 


Protected Mode Exceptions 
#GP(0) If the offset being jumped to is beyond the limits of the CS segment. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If the offset being jumped to is beyond the limits of the CS segment or is outside of the effec- 
tive address space from 0 to FFFFH. This condition can occur if a 32-bit address size override 
prefix is used. 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(0) If the offset being jumped to is in a non-canonical form. 
#UD If the LOCK prefix is used. 
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LSL—Load Segment Limit 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF 03 /r LSL 16, r16/m16 RM_ | Valid Valid Load: r76 := segment limit, selector r16/m16. 
OF 03 /r LSL r32, r32/m16™ RM _ | Valid Valid Load: r32 := segment limit, selector r32/m16. 
REX.W + OF 03 /r LSL r64, r32/m16- RM _ | Valid Valid Load: r64 := segment limit, selector r32/m16 
NOTES: 


* For all loads (regardless of destination sizing), only bits 16-0 are used. Other bits are ignored. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Loads the unscrambled segment limit from the segment descriptor specified with the second operand (source 
operand) into the first operand (destination operand) and sets the ZF flag in the EFLAGS register. The source 
operand (which can be a register or a memory location) contains the segment selector for the segment descriptor 
being accessed. The destination operand is a general-purpose register. 


The processor performs access checks as part of the loading process. Once loaded in the destination register, soft- 
ware can compare the segment limit with the offset of a pointer. 


The segment limit is a 20-bit value contained in bytes 0 and 1 and in the first 4 bits of byte 6 of the segment 
descriptor. If the descriptor has a byte granular segment limit (the granularity flag is set to 0), the destination 
operand is loaded with a byte granular value (byte limit). If the descriptor has a page granular segment limit (the 
granularity flag is set to 1), the LSL instruction will translate the page granular limit (page limit) into a byte limit 
before loading it into the destination operand. The translation is performed by shifting the 20-bit “raw” limit left 12 
bits and filling the low-order 12 bits with 1s. 


When the operand size is 32 bits, the 32-bit byte limit is stored in the destination operand. When the operand size 
is 16 bits, a valid 32-bit limit is computed; however, the upper 16 bits are truncated and only the low-order 16 bits 
are loaded into the destination operand. 


This instruction performs the following checks before it loads the segment limit into the destination register: 
° Checks that the segment selector is not NULL. 


* Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being 
accessed 


¢ Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for 
(can be accessed with) the LSL instruction. The valid special segment and gate descriptor types are given in the 
following table. 


° If the segment is not a conforming code segment, the instruction checks that the specified segment descriptor 
is visible at the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of 
the segment selector). 


If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no 
value is loaded in the destination operand. 
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Table 3-56. Segment and Gate Descriptor Types 


Type Protected Mode IA-32e Mode 

Name Valid Name Valid 
0 Reserved No Reserved No 
1 Available 16-bit TSS Yes Reserved No 
2 LOT Yes LDT! Yes 
3 Busy 16-bit TSS Yes Reserved No 
4 16-bit call gate No Reserved No 
5 16-bit/32-bit task gate No Reserved No 
6 16-bit interrupt gate No Reserved No 
7 16-bit trap gate No Reserved No 
8 Reserved No Reserved No 
9 Available 32-bit TSS Yes 64-bit TSS! Yes 
A Reserved No Reserved No 
B Busy 32-bit TSS Yes Busy 64-bit TSS! Yes 
Cc 32-bit call gate No 64-bit call gate No 
D Reserved No Reserved No 
E 32-bit interrupt gate No 64-bit interrupt gate No 
F 32-bit trap gate No 64-bit trap gate No 

NOTES: 


1. In this case, the descriptor comprises 16 bytes; bits 12:8 of the upper 4 bytes must be 0. 


Operation 


IF SRC(Offset) > descriptor table limit 


THEN ZF 


= 0; Fl; 


Read segment descriptor; 


IF SegmentDescriptor(Type) 4 conforming code segment 
and (CPL > DPL) OR (RPL > DPL) 
or Segment type is not valid for instruction 

THEN 


ELSE 


Fl; 


temp := SegmentLimit([SRC]); 
IF (G:= 1) 
THEN temp := ShiftLeft(12, temp) OR OOOOOFFFH; 
ELSE IF OperandSize = 32 
THEN DEST := temp; FI; 
ELSE IF OperandSize = 64 (* REX.W used *) 
THEN DEST (* Zero-extended *) := temp; Fl; 
ELSE (* OperandSize = 16 *) 
DEST := temp AND FFFFH; 
Fl; 
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Flags Affected 
The ZF flag is set to 1 if the segment limit is loaded successfully; otherwise, it is set to 0. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and the memory operand effective address is unaligned while 
the current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The LSL instruction cannot be executed in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The LSL instruction cannot be executed in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If the memory operand effective address referencing the SS segment is in a non-canonical 
form. 

#GP(0) If the memory operand effective address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and the memory operand effective address is unaligned while 
the current privilege level is 3. 

#UD If the LOCK prefix is used. 
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LTR—Load Task Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 00 /3 LTR r/m16 M Valid Valid Load r/m16 into task register. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the source operand into the segment selector field of the task register. The source operand (a general- 
purpose register or a memory location) contains a segment selector that points to a task state segment (TSS). 
After the segment selector is loaded in the task register, the processor uses the segment selector to locate the 
segment descriptor for the TSS in the global descriptor table (GDT). It then loads the segment limit and base 
address for the TSS from the segment descriptor into the task register. The task pointed to by the task register is 
marked busy, but a switch to the task does not occur. 


The LTR instruction is provided for use in operating-system software; it should not be used in application programs. 
It can only be executed in protected mode when the CPL is O. It is commonly used in initialization code to establish 
the first task to be executed. 


The operand-size attribute has no effect on this instruction. 
In 64-bit mode, the operand size is still fixed at 16 bits. The instruction references a 16-byte descriptor to load the 
64-bit base. 


Operation 


IF SRC is a NULL selector 
THEN #GP(0); 


IF SRC(Offset) > descriptor table limit OR IF SRC(type) 4 global 
THEN #GP(segment selector); Fl; 


Read segment descriptor; 


IF segment descriptor is not for an available TSS 
THEN #GP(segment selector); Fl; 

IF segment descriptor is not present 
THEN #NP(segment selector); Fl; 


TSSsegmentDescriptor(busy) := 1; 
(* Locked read-modify-write operation on the entire descriptor when setting busy flag *) 


TaskRegister(SegmentSelector) := SRC; 
TaskRegister(SegmentDescriptor) := TSSSegmentDescriptor; 


Flags Affected 
None 
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Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


#NP(selector) 
#SS(0) 
#PF(fault-code) 
#UD 


If the current privilege level is not 0. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the source operand contains a NULL segment selector. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If the source selector points to a segment that is not a TSS or to one for a task that is already 
busy. 


If the selector points to LDT or is beyond the GDT limit. 

If the TSS is marked not present. 

If a memory operand effective address is outside the SS segment limit. 
If a page fault occurs. 

If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD 


The LTR instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD 


The LTR instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 


#GP(selector) 


#NP(selector) 
#PF(fault-code) 
#UD 


LTR—Load Task Register 


If a memory address referencing the SS segment is in a non-canonical form. 
If the current privilege level is not 0. 

If the memory address is in a non-canonical form. 

If the source operand contains a NULL segment selector. 


If the source selector points to a segment that is not a TSS or to one for a task that is already 
busy. 


If the selector points to LDT or is beyond the GDT limit. 

If the descriptor type of the upper 8-byte of the 16-byte descriptor is non-zero. 
If the TSS is marked not present. 

If a page fault occurs. 

If the LOCK prefix is used. 
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LZCNT— Count the Number of Leading Zero Bits 


Opcode/Instruction Op/ | 64/32 | CPUID Description 
En -bit Feature 
Mode _ | Flag 

F3 OF BD /r RM VIV LZCNT Count the number of leading zero bits in r/m16, return result in r16. 
LZCNT 116, r/m16 

F3 OF BD /r RM VIV LZCNT Count the number of leading zero bits in r/m32, return result in r32. 
LZCNT 32, r/m32 

F3 REX.W OF BD /r RM V/N.E. | LZCNT Count the number of leading zero bits in r/m64, return result in r64. 
LZCNT 164, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Counts the number of leading most significant zero bits in a source operand (second operand) returning the result 
into a destination (first operand). 


LZCNT differs from BSR. For example, LZCNT will produce the operand size when the input operand is zero. It 
should be noted that on processors that do not support LZCNT, the instruction byte encoding is executed as BSR. 


In 64-bit mode 64-bit operand size requires REX.W=1. 


Operation 
temp := OperandSize - 1 
DEST :=0 
WHILE (temp >= 0) AND (Bit(SRC, temp) = 0) 
DO 
temp := temp - 1 
DEST := DEST+ 1 
OD 


IF DEST = OperandSize 
CF :=1 
ELSE 


Fl 

IF DEST = 0 
ZF := 1 

ELSE 

Fl 


Flags Affected 


ZF flag is set to 1 in case of zero output (most significant bit of the source is set), and to 0 otherwise, CF flag is set 
to 1 if input was zero and cleared otherwise. OF, SF, PF and AF flags are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
LZCNT: unsigned __int32 _Izcnt_u32(unsigned __int32 src); 
LZCNT: unsigned __int64_Izcnt_u64(unsigned __int64 src); 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null segment 
selector. 

#SS(0) For an illegal address in the SS segment. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) For an illegal address in the SS segment. 
#UD If LOCK prefix is used. 


Virtual 8086 Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 

#SS(0) For an illegal address in the SS segment. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in Protected Mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 
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4.1 IMM8 CONTROL BYTE OPERATION FOR PCMPESTRI / PCMPESTRM / 
PCMPISTRI / PCMPISTRM 


The notations introduced in this section are referenced in the reference pages of PCMPESTRI, PCMPESTRM, PCMP- 
ISTRI, PCMPISTRM. The operation of the immediate control byte is common to these four string text processing 
instructions of SSE4.2. This section describes the common operations. 


4.1.1 General Description 


The operation of PCMPESTRI, PCMPESTRM, PCMPISTRI, PCMPISTRM is defined by the combination of the respec- 
tive opcode and the interpretation of an immediate control byte that is part of the instruction encoding. 


The opcode controls the relationship of input bytes/words to each other (determines whether the inputs terminated 
strings or whether lengths are expressed explicitly) as well as the desired output (index or mask). 


The Imm8 Control Byte for PCMPESTRM/PCMPESTRI/PCMPISTRM/PCMPISTRI encodes a significant amount of 
programmable control over the functionality of those instructions. Some functionality is unique to each instruction 
while some is common across some or all of the four instructions. This section describes functionality which is 
common across the four instructions. 


The arithmetic flags (ZF, CF, SF, OF, AF, PF) are set as a result of these instructions. However, the meanings of the 
flags have been overloaded from their typical meanings in order to provide additional information regarding the 
relationships of the two inputs. 


PCMPxSTRx instructions perform arithmetic comparisons between all possible pairs of bytes or words, one from 
each packed input source operand. The boolean results of those comparisons are then aggregated in order to 
produce meaningful results. The Imm8 Control Byte is used to affect the interpretation of individual input elements 
as well as control the arithmetic comparisons used and the specific aggregation scheme. 


Specifically, the Imm8 Control Byte consists of bit fields that control the following attributes: 
* Source data format — Byte/word data element granularity, signed or unsigned elements 


° Aggregation operation — Encodes the mode of per-element comparison operation and the aggregation of 
per-element comparisons into an intermediate result 


* Polarity — Specifies intermediate processing to be performed on the intermediate result 


* Output selection — Specifies final operation to produce the output (depending on index or mask) from the 
intermediate result 


Vol.2B 4-1 


INSTRUCTION SET REFERENCE, M-U 


4.1.2 Source Data Format 
Table 4-1. Source Data Format 
Imm8[1:0] Meaning Description 
O00b Unsigned bytes Both 128-bit sources are treated as packed, unsigned bytes. 
01b Unsigned words Both 128-bit sources are treated as packed, unsigned words. 
10b Signed bytes Both 128-bit sources are treated as packed, signed bytes. 
11b Signed words Both 128-bit sources are treated as packed, signed words. 


If the Imm8 Control Byte has bit[0] cleared, each source contains 16 packed bytes. If the bit is set each source 
contains 8 packed words. If the Imm8 Control Byte has bit[1] cleared, each input contains unsigned data. If the bit 
is set each source contains signed data. 


4.1.3 Aggregation Operation 
Table 4-2. Aggregation Operation 

Imm8[3:2] Mode Comparison 

O00b Equal any The arithmetic comparison is “equal.” 

O1b Ranges Arithmetic comparison is “greater than or equal” between even indexed bytes/words of reg and 
each byte/word of reg/mem. 
Arithmetic comparison is “less than or equal” between odd indexed bytes/words of reg and each 
byte/word of reg/mem. 
(reg/mem[m] >= reg[n] for n = even, reg/mem[m] <= reg[n] for n = odd) 

10b Equal each The arithmetic comparison is “equal.” 

11b Equal ordered The arithmetic comparison is “equal.” 


All 256 (64) possible comparisons are always performed. The individual Boolean results of those comparisons are 
referred by “BoolRes[Reg/Mem element index, Reg element index].” Comparisons evaluating to “True” are repre- 
sented with a 1, False with a 0 (positive logic). The initial results are then aggregated into a 16-bit (8-bit) interme- 
diate result (IntRes1) using one of the modes described in the table below, as determined by Imm8 Control Byte 


bit[3:2]. 
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See Section 4.1.6 for a description of the overrideIfDataInvalid() function used in Table 4-3. 
Table 4-3. Aggregation Operation 


Mode Pseudocode 
Equal any UpperBound = imm8[0] ? 7: 15; 
(find characters from a set) IntRes1 = 0; 


For j = O to UpperBound, j++ 
For i = O to UpperBound, i++ 
IntRes1[j] OR= overridelfDatalnvalid(BoolResjj,i]) 


Ranges UpperBound = imm8[0] ? 7 : 15; 
(find characters from ranges) IntRes1 = 0; 
For j = O to UpperBound, j++ 
For i = O to UpperBound, i+=2 
IntRes1[j] OR= (overridelfDatalnvalid(BoolRes|j,i]) AND 
overridelfDatalnvalid(BoolRes|j,i+ 1])) 
Equal each UpperBound = imm8[0] ? 7 : 15; 
(string compare) IntRes1 = 0; 
For i = O to UpperBound, i++ 
IntRes1[i] = overridelfDatalnvalid(BoolRes{i,i]) 


Equal ordered UpperBound = imm8[0] ? 7 :15; 
(substring search) IntRes1 = imm8[0] ? FFH : FFFFH 
For j = O to UpperBound, j++ 
For i = O to UpperBound-j, k=j to UpperBound, k++, i++ 
IntRes1[j] AND= overridelfDatalnvalid(BoolRes[k,i]) 


4.1.4 Polarity 


IntResi may then be further modified by performing a 1’s complement, according to the value of the Imm8 Control 
Byte bit[4]. Optionally, a mask may be used such that only those IntRes1 bits which correspond to “valid” reg/mem 
input elements are complemented (note that the definition of a valid input element is dependant on the specific 

opcode and is defined in each opcode’s description). The result of the possible negation is referred to as IntRes2. 


Table 4-4. Polarity 


Imm8[5:4] Operation Description 

O00b Positive Polarity (+) IntRes2 = IntRes1 

O1b Negative Polarity (-) IntRes2 = -1 XOR IntRes1 

10b Masked (+) IntRes2 = IntRes1 

11b Masked (-) IntRes2[i] = IntRes1[i] if reg/mem[i] invalid, else = ~IntRes1 [i] 
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4.1.5 Output Selection 


Table 4-5. Output Selection 


Imm8[6] | Operation Description 
Ob Least significant index | The index returned to ECX is of the least significant set bit in IntRes2. 
1b Most significant index | The index returned to ECX is of the most significant set bit in IntRes2. 


For PCMPESTRI/PCMPISTRI, the Imm8 Control Byte bit[6] is used to determine if the index is of the least significant 
or most significant bit of IntRes2. 


Table 4-6. Output Selection 


Imm8[6] | Operation Description 

Ob Bit mask IntRes2 is returned as the mask to the least significant bits of XMMO with zero extension to 128 
bits. 

1b Byte/word mask IntRes2 is expanded into a byte/word mask (based on imm8[1]) and placed in XMMO. The expansion 
is performed by replicating each bit into all of the bits of the byte/word of the same index. 


Specifically for PCMPESTRM/PCMPISTRM, the Imm8 Control Byte bit[6] is used to determine if the mask is a 16 (8) 
bit mask or a 128 bit byte/word mask. 


4.1.6 Valid/Invalid Override of Comparisons 


PCMPxSTRx instructions allow for the possibility that an end-of-string (EOS) situation may occur within the 128-bit 
packed data value (see the instruction descriptions below for details). Any data elements on either source that are 
determined to be past the EOS are considered to be invalid, and the treatment of invalid data within a comparison 
pair varies depending on the aggregation function being performed. 


In general, the individual comparison result for each element pair BoolRes[i.j] can be forced true or false if one or 
more elements in the pair are invalid. See Table 4-7. 


Table 4-7. Comparison Result for Each Element Pair BoolRes[i.j] 


xmm1 xmm2/ m128 Imm8[3:2] = 00b_ | Imm8[3:2]=01b | Imm8[3:2] = 10b Imm8[3:2] = 11b 
byte/ word byte/word (equal any) (ranges) (equal each) (equal ordered) 
Invalid Invalid Force false Force false Force true Force true 

Invalid Valid Force false Force false Force false Force true 

Valid Invalid Force false Force false Force false Force false 

Valid Valid Do not force Do not force Do not force Do not force 
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4.1.7 Summary of Im8 Control byte 
Table 4-8. Summary of Imm8 Control Byte 
Imms Description 
wonneee Ob 128-bit sources treated as 16 packed bytes. 
wonneee 1b 128-bit sources treated as 8 packed words. 
wonnes 0-b Packed bytes/words are unsigned. 
woneee 1-b Packed bytes/words are signed. 
----00--b Mode is equal any. 
----01--b Mode is ranges. 
----10--b Mode is equal each. 
----11--b Mode is equal ordered. 
---Q----b IntRes1 is unmodified. 
---]----b IntRes1 is negated (1's complement). 
--0-----b Negation of IntRes1 is for all 16 (8) bits. 
--]-----bD Negation of IntRes1 is masked by reg/mem validity. 
-0------ b Index of the least significant, set, bit is used (regardless of corresponding input element validity). 
IntRes2 is returned in least significant bits of XMMO. 
-1------ b Index of the most significant, set, bit is used (regardless of corresponding input element validity). 
Each bit of IntRes2 is expanded to byte/word. 
Q------- b This bit currently has no defined effect, should be O. 
]------- b This bit currently has no defined effect, should be O. 
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4.1.8 Diagram Comparison and Aggregation Process 


| String A (xmm1) | String B (xmm2/mem) 


aie ene ere maT > | 
{ imm8[1:0] = 


i} 
EAX/RAX Determine end -of- | oR all pairs ‘| OOB: unsigned byte compares 


| 

| 

| - : 

l ia string and mark . 01B: unsigned word compares 
! EDX/RDX F; invalid elements (A, B) 

| 

| 


10B: signed byte compares 
PCMPESTR* only 


11B: signed word compares 


BoolRes{i,j] 


imm8[3:2] = 
OOB: Equal any 
01B: Ranges 
10B: Equal each 
11B: Equal ordered 


Aggregation function 


|e 


imm8[5:4] = 
. xOB: don’t negate IntRes1 
Optional boolean 01B: negate all bits of IntRes1 


~— 


negation 11B: negate only bits of IntRest 
corresponding to valid 
elements in String B 


IntRes2 


vais sconcodpelleustsignttl mores 
Generate index rantaual bit cfmes2 Generate mask Oe Remmizere-oyenced Inthees 
Me ee 1: expand IntRes2 to byte (word) 
1: index encodes most signif mask 
cant true bit of IntRes 2 


ECX(RCX) 


PCMP*STRI only PCMP*STRM only 


Figure 4-1. Operation of PCMPSTRx and PCMPESTRx 


4.2 COMMON TRANSFORMATION AND PRIMITIVE FUNCTIONS FOR SHA1 XXX 
AND SHA256XXX 


The following primitive functions and transformations are used in the algorithmic descriptions of SHA1 and SHA256 
instruction extensions SHAINEXTE, SHA1RNDS4, SHAIMSG1, SHA1MSG2, SHA256RNDS4, SHA256MSGi1 and 
SHA256MSGz2. The operands of these primitives and transformation are generally 32-bit DWORD integers. 


° =f0(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This 
function is used in SHA1 round 1 to 20 processing. 


f0(B,C,D) := (B AND C) XOR ((NOT(B) AND D) 


¢ f1(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This 
function is used in SHA1 round 21 to 40 processing. 


f1(B,C,D) := B XOR C XOR D 


° f2(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This 
function is used in SHA1 round 41 to 60 processing. 


f2(B,C,D) := (B AND C) XOR (B AND D) XOR (C AND D) 
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e =6f3(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This 
function is used in SHA1i round 61 to 80 processing. It is the same as f1(). 


f3(B,C,D) := B XOR C XOR D 


¢ Ch(): A bit oriented logical operation that derives a new dword from three SHA256 state variables (dword). 
Ch(E,F,G) := (E AND F) XOR ((NOT E) AND G) 


° = Maj(): A bit oriented logical operation that derives a new dword from three SHA256 state variables (dword). 
Maj(A,B,C) := (A AND B) XOR (A AND C) XOR (B AND C) 


ROR is rotate right operation 
(A ROR N) := A[N-1:0] || A[Width-1:N] 


ROL is rotate left operation 
(A ROL N) :=A ROR (Width-N) 


SHR is the right shift operation 
(A SHR N) := ZEROES[N-1:0] || A[Width-1:N] 


* Xp( ): A bit oriented logical and rotational transformation performed on a dword SHA256 state variable. 
Xo(A) := (A ROR 2) XOR (A ROR 13) XOR (A ROR 22) 


¢ %(): A bit oriented logical and rotational transformation performed on a dword SHA256 state variable. 
x,(E) = (E ROR 6) XOR (E ROR 11) XOR (E ROR 25) 


* ~69( ): A bit oriented logical and rotational transformation performed on a SHA256 message dword used in the 
message scheduling. 


6o(W) := (W ROR 7) XOR (W ROR 18) XOR (W SHR 3) 


* o,( ): A bit oriented logical and rotational transformation performed on a SHA256 message dword used in the 
message scheduling. 


o,(W) := (W ROR 17) XOR (W ROR 19) XOR (W SHR 10) 


¢ Kj: SHA1 Constants dependent on immediate i. 
KO = 0x5A827999 
K1 = Ox6ED9EBA1 
K2 = O0X8F1BBCDC 
K3 = 0xCA62C1D6 


4.3. INSTRUCTIONS (M-U) 


Chapter 4 continues an alphabetical discussion of Intel® 64 and IA-32 instructions (M-U). See also: Chapter 3, 
“Instruction Set Reference, A-L,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
2A, and Chapter 5, “Instruction Set Reference, V-Z,” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2C. 
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MASKMOVDQU-—Store Selected Bytes of Double Quadword 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF F7 /r RM | V/V SSE2 Selectively write bytes from xmm1 to 
MASKMOVDQU xmm1, xmm2 memory location using the byte mask in 
xmm_e. The default memory location is 
specified by DS:DI/EDI/RDI. 
VEX.128.66.0F.WIG F7 /r RM | V/V AVX Selectively write bytes from xmm7 to 
VMASKMOVDQU xmm1, xmm2 memory location using the byte mask in 
xmm_e. The default memory location is 
specified by DS:DI/EDI/RDI. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


Stores selected bytes from the source operand (first operand) into an 128-bit memory location. The mask operand 
(second operand) selects which bytes from the source operand are written to memory. The source and mask oper- 
ands are XMM registers. The memory location specified by the effective address in the DI/EDI/RDI register (the 
default segment register is DS, but this may be overridden with a segment-override prefix). The memory location 
does not need to be aligned on a natural boundary. (The size of the store address depends on the address-size 
attribute. ) 


The most significant bit in each byte of the mask operand determines whether the corresponding byte in the source 
operand is written to the corresponding byte location in memory: O indicates no write and 1 indicates write. 


The MASKMOVDQU instruction generates a non-temporal hint to the processor to minimize cache pollution. The 
non-temporal hint is implemented by using a write combining (WC) memory type protocol (see “Caching of 
Temporal vs. Non-Temporal Data” in Chapter 10, of the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1). Because the WC protocol uses a weakly-ordered memory consistency model, a fencing opera- 
tion implemented with the SFENCE or MFENCE instruction should be used in conjunction with MASKMOVDQU 
instructions if multiple processors might use different memory types to read/write the destination memory loca- 
tions. 


Behavior with a mask of all Os is as follows: 
¢ No data will be written to memory. 


¢ Signaling of breakpoints (code or data) is not guaranteed; different processor implementations may signal or 
not signal these breakpoints. 


° Exceptions associated with addressing memory and page faults may still be signaled (implementation 
dependent). 


° If the destination memory region is mapped as UC or WP, enforcement of associated semantics for these 
memory types is not guaranteed (that is, is reserved) and is implementation-specific. 


The MASKMOVDQU instruction can be used to improve performance of algorithms that need to merge data ona 
byte-by-byte basis. MASKMOVDQU should not cause a read for ownership; doing so generates unnecessary band- 
width since data is to be written directly using the byte-mask without allocating old data prior to the store. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


If VMASKMOVDQU is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will 
cause an #UD exception. 


1.ModRM.MOD = 011B required 
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Operation 


IF (MASK[7] = 1) 
THEN DEST[DI/EDI] := SRC[7:0] ELSE (* Memory location unchanged *); FI; 

IF (MASK[15] = 1) 
THEN DEST[DI/EDI +1] := SRC[15:8] ELSE (* Memory location unchanged *); FI; 
(* Repeat operation for 3rd through 14th bytes in source operand *) 

IF (MASK[127] = 1) 
THEN DEST[DI/EDI +15] := SRC[127:120] ELSE (* Memory location unchanged *); FI; 


Intel C/C++ Compiler Intrinsic Equivalent 
m128i n, char * p) 


void _mm_maskmoveu_si128(__m128i d, 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L= 1 

If VEX.vvvv # 1111B. 
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MASKMOVQ-—Store Selected Bytes of Quadword 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

NP OF F7 /r RM_ | Valid Valid Selectively write bytes from mm7 to memory 

MASKMOVQ mm1, mm2 location using the byte mask in mm2. The 
default memory location is specified by 
DS:DI/EDI/RDI. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


Stores selected bytes from the source operand (first operand) into a 64-bit memory location. The mask operand 
(second operand) selects which bytes from the source operand are written to memory. The source and mask oper- 
ands are MMX technology registers. The memory location specified by the effective address in the DI/EDI/RDI 
register (the default segment register is DS, but this may be overridden with a segment-override prefix). The 
memory location does not need to be aligned on a natural boundary. (The size of the store address depends on the 
address-size attribute.) 


The most significant bit in each byte of the mask operand determines whether the corresponding byte in the source 
operand is written to the corresponding byte location in memory: O indicates no write and 1 indicates write. 


The MASKMOVQ instruction generates a non-temporal hint to the processor to minimize cache pollution. The non- 
temporal hint is implemented by using a write combining (WC) memory type protocol (see “Caching of Temporal 
vs. Non-Temporal Data” in Chapter 10, of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation imple- 
mented with the SFENCE or MFENCE instruction should be used in conjunction with MASKMOVQ instructions if 
multiple processors might use different memory types to read/write the destination memory locations. 


This instruction causes a transition from x87 FPU to MMX technology state (that is, the x87 FPU top-of-stack pointer 
is set to O and the x87 FPU tag word is set to all Os [valid]). 


The behavior of the MASKMOVQ instruction with a mask of all Os is as follows: 
* No data will be written to memory. 
¢* Transition from x87 FPU to MMX technology state will occur. 


° Exceptions associated with addressing memory and page faults may still be signaled (implementation 
dependent). 


® Signaling of breakpoints (code or data) is not guaranteed (implementation dependent). 


¢ If the destination memory region is mapped as UC or WP, enforcement of associated semantics for these 
memory types is not guaranteed (that is, is reserved) and is implementation-specific. 


The MASKMOVQ instruction can be used to improve performance for algorithms that need to merge data on a byte- 
by-byte basis. It should not cause a read for ownership; doing so generates unnecessary bandwidth since data is 
to be written directly using the byte-mask without allocating old data prior to the store. 


In 64-bit mode, the memory address is specified by DS:RDI. 


4-10 Vol. 2B MASKMOVQ-—Store Selected Bytes of Quadword 


INSTRUCTION SET REFERENCE, M-U 


Operation 


IF (MASK[7] = 1) 
THEN DEST[DI/EDI] := SRC[7:0] ELSE (* Memory location unchanged *); FI; 

IF (MASK[15] = 1) 
THEN DEST[DI/EDI +1] := SRC[15:8] ELSE (* Memory location unchanged *); FI; 
(* Repeat operation for 3rd through 6th bytes in source operand *) 

IF (MASK[63] = 1) 
THEN DEST[DI/EDI +15] := SRC[63:56] ELSE (* Memory location unchanged *); FI; 


Intel C/C++ Compiler Intrinsic Equivalent 


void __mm_maskmove_si64(__m64d,__m64n, char * p) 


Other Exceptions 


See Table 21-8, “Exception Conditions for Legacy SIMD/MMX Instructions without FP Exception” in the Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 3A. 
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MAXPD—Maximum of Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 5F /r A VIV SSE2 Return the maximum double-precision floating-point 
MAXPD xmm1, xmm2/m128 values between xmm1 and xmm2/m1 28. 
VEX.128.66.0F.WIG 5F /r B VIV AVX Return the maximum double-precision floating-point 
VMAXPD xmm1, xmm2, xmm3/m128 values between xmm2 and xmm3/m1 28. 
VEX.256.66.0F.WIG 5F /r B VV AVX Return the maximum packed double-precision 
VMAXPD ymm1, ymm2, ymm3/m256 floating-point values between ymm2 and 
ymm3/m256. 
EVEX.128.66.0F.W1 5F /r C VIV AVX512VL | Return the maximum packed double-precision 
VMAXPD xmm1 {k1}{z}, xmm2, AVX512F floating-point values between xmm2 and 
xmm3/m128/m64bcst xmm3/m128/m64bcst and store result in xmm1 
subject to writemask k1. 
EVEX.256.66.0F.W1 5F /r C VIV AVX512VL | Return the maximum packed double-precision 
VMAXPD ymm1 {k1}{z}, ymm2, AVX512F floating-point values between ymm2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst and store result in ymm1 
subject to writemask k1. 
EVEX.512.66.0F.W1 5F /r C VV AVX512F Return the maximum packed double-precision 
VMAXPD zmm1 {k1}{z}, zmm2, floating-point values between zmm2 and 
zmm3/m512/m64bcst{sae} zmm3/m512/m64bcst and store result in zmm1 
subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed double-precision floating-point values in the first source operand and the 
second source operand and returns the maximum value for each pair of values to the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second operand (source operand) is 
returned. If a value in the second operand is an SNaN, then SNaN is forwarded unchanged to the destination (that 
is, a QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second operand (source operand), either a NaN 
or a valid floating-point value, is written to the result. If instead of this behavior, it is required that the NaN source 
operand (from either the first or second operand) be returned, the action of MAXPD can be emulated using a 
sequence of instructions, such as a comparison followed by AND, ANDN and OR. 


EVEX encoded versions: The first source operand (the second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 
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128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 


Operation 
MAX(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 > SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
FI; 
} 


VMAXPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] := MAX(SRC1[i+63:i], SRC2[63:0]) 
ELSE 
DEST[i+63:i] := MAX(SRC1[i+63:i], SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMAXPD (VEX.256 encoded version) 

DEST[63:0] := MAX(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := MAX(SRC1[127:64], SRC2[127:64]) 
DEST[191:128] := MAX(SRC1[191:128], SRC2[191:128]) 
DEST[255:192] := MAX(SRC1[255:192], SRC2[255:192]) 
DEST[MAXVL-1:256] := 0 


VMAXPD (VEX.128 encoded version) 

DEST[63:0] := MAX(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := MAX(SRC1[127:64], SRC2[127:64]) 
DEST[MAXVL-1:128] := 0 
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MAXPD (128-bit Legacy SSE version) 

DEST[63:0] := MAX(DEST[63:0], SRC[63:0]) 
DEST[127:64] := MAX(DEST[127:64], SRC[127:64]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 
VMAXPD 


m512d_mm512 m512d b); 
m512d_mm512 m512ds,__mmask8 k,__m512da,__m512d,); 
m512d_mm512_maskz_max_pd( m512da,__m512d b); 
m512d_mm512_max_round_pd( m512d b, int); 
m512d_mm512_mask_max_round_pd(__m512ds,__mmask8k,__m512da,__m512d, int); 
m512d_mm512_maskz_max_round_pd(__mmask8 k,__m512d a,__m512db, int); 
m256d_mm256 mmask8 k,__ m256d a,___m256d b); 
m256d __mm256_maskz_max_pd(__mmask8 k,__m256d a, __ m256d b); 
m128d _mm_mask_max_pd(__m128ds,__ mmask8 k,__m128d a,__m128d b); 
m128d _mm_maskz_max_pd(__mmask8 k,___m128d a,__m128d b); 
m256d __mm256_max_pd ( m256d b); 

(V)MAXPD __m128d __mm_max_pd ( m128d b); 


SIMD Floating-Point Exceptions 


Invalid (including QNaN Source Operand), Denormal 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MAXPS—Maximum of Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
NP OF 5F /r A VIV SSE Return the maximum single-precision floating-point values 
MAXPS xmm1, xmm2/m128 between xmm1 and xmm2/mem. 
VEX.128.0F.WIG 5F /r B VIV AVX Return the maximum single-precision floating-point values 
VMAXPS xmm1, xmm2, between xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.0F.WIG 5F /r B VIV AVX Return the maximum single-precision floating-point values 
VMAXPS ymm1, ymm2, between ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.0F.WO 5F /r C VIV AVX512VL | Return the maximum packed single-precision floating-point 
VMAXPS xmm1 {k1}{z}, xmm2, AVX512F values between xmm2 and xmm3/m128/m32bcst and store 
xmm3/m128/m32bcst result in xmm1 subject to writemask k1. 
EVEX.256.0F.WO 5F /r C VIV AVX512VL | Return the maximum packed single-precision floating-point 
VMAXPS ymm1 {k1}{z}, ymm2, AVX512F values between ymm2 and ymm3/m256/m32bcst and store 
ymm3/m256/m32bcst result in ymm1 subject to writemask k1. 
EVEX.512.0F.WO 5F /r C VV AVX512F Return the maximum packed single-precision floating-point 


VMAXPS zmm1 {k1}{z}, zmm2, 
zmm3/m512/m32bcst{sae} 


values between zmm2 and zmm3/m512/m32bcst and store 
result in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed single-precision floating-point values in the first source operand and the 
second source operand and returns the maximum value for each pair of values to the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second operand (source operand) is 
returned. If a value in the second operand is an SNaN, then SNaN is forwarded unchanged to the destination (that 
is, a QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second operand (source operand), either a NaN 
or a valid floating-point value, is written to the result. If instead of this behavior, it is required that the NaN source 
operand (from either the first or second operand) be returned, the action of MAXPS can be emulated using a 
sequence of instructions, such as, a comparison followed by AND, ANDN and OR. 


EVEX encoded versions: The first source operand (the second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


MAX(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 > SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


VMAXPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] := MAX(SRC1[i+31:i], SRC2[31:0]) 
ELSE 
DEST[i+31:i] := MAX(SRC1[i+31:i], SRC2Z[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VMAXPS (VEX.256 encoded version) 

DEST[31:0] := MAX(SRC1[31:0], SRC2[31:0]) 
DEST[63:32] := MAX(SRC1 [63:32], SRC2[63:32]) 
DEST[95:64] := MAX(SRC1[95:64], SRC2[95:64]) 
DEST[127:96] := MAX(SRC1[127:96], SRC2[127:96]) 
DEST[159:128] := MAX(SRC1[159:1 28], SRC2[159:128]) 
DEST[191:160] := MAX(SRC1[191:160], SRC2[191:160]) 
DEST[223:192] := MAX(SRC1[223:192], SRC2[223:192]) 
DEST[255:224] := MAX(SRC1[255:224], SRC2[255:224]) 
DEST[MAXVL-1:256] := 0 


VMAXPS (VEX.128 encoded version) 

DEST[31:0] := MAX(SRC1[31:0], SRC2[31:0]) 
DEST[63:32] := MAX(SRC1[63:32], SRC2[63:32]) 
DEST[95:64] := MAX(SRC1[95:64], SRC2[95:64]) 
DEST[127:96] := MAX(SRC1[127:96], SRC2[127:96]) 
DEST[MAXVL-1:128] := 0 
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MAXPS (128-bit Legacy SSE version) 

DEST[31:0] := MAX(DEST[31:0], SRC[31:0]) 
DEST[63:32] := MAX(DEST[63:32], SRC[63:32]) 
DEST[95:64] := MAX(DEST[95:64], SRC[95:64]) 
DEST[127:96] := MAX(DEST[1 27:96], SRC[127:96]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMAXPS __m512_mm512_max_ps(__m512a,__m512 b); 

VMAXPS __m512_mm512_mask_max_ps(__m512 s,__mmask16 k,__m512 a,__m512 b); 
VMAXPS __m512_mm512_maskz_max_ps(__mmask16 k,__m512 a,__m512 b); 
VMAXPS __m512_mm512_max_round_ps(__m512 a,__m512 D, int); 
VMAXPS __m512 _mm512_mask_max_round_ps(__m512 s,__ mmask16 k, 
VMAXPS __m512_mm512_maskz_max_round_ps(__mmask16 k,__m512 a, 
VMAXPS __m256 __mm256_mask_max_ps(__m256 s,__ mmask8 k,__m256 a, 
VMAXPS __m256 __mm256_maskz_max_ps(__mmask8 k,___m256 a,__m256 b); 
VMAXPS __m128_mm_mask_max_ps(__m128s,__mmask8 k,__m128 a,__m128 b); 
VMAXPS __m128 _mm_maskz_max_ps(__mmask8 k,__m128 a,__m128 b); 
VMAXPS __m256 __mm256_max_ps (__m256 a,__ m256 b); 

MAXPS __m128_mm_max_ps (__m128 a,__m128 b); 


m512a,__m512 5, int); 
m512 b, int); 
m256 b); 


SIMD Floating-Point Exceptions 
Invalid (including QNaN Source Operand), Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MAXSD—Return Maximum Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
Fe OF 5F /r A VIV SSE2 Return the maximum scalar double-precision floating-point 
MAXSD xmm1, xmm2/m64 value between xmm2/m64 and xmm1. 
VEX.LIG.F2.0F.WIG 5F /r B VIV AVX Return the maximum scalar double-precision floating-point 
VMAXSD xmm1, xmm2, value between xmm3/m64 and xmm2. 
xmm3/m64 
EVEX.LLIG.F2.0F.W1 5F /r C VIV AVX512F | Return the maximum scalar double-precision floating-point 
VMAXSD xmm1 {k1}{z}, xmm2, value between xmm3/m64 and xmm_2. 
xmm3/m64{sae} 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Compares the low double-precision floating-point values in the first source operand and the second source 
operand, and returns the maximum value to the low quadword of the destination operand. The second source 
operand can be an XMM register or a 64-bit memory location. The first source and destination operands are XMM 
registers. When the second source operand is a memory operand, only 64 bits are accessed. 


If the values being compared are both 0.0s (of either sign), the value in the second source operand is returned. If 
a value in the second source operand is an SNaN, that SNaN is returned unchanged to the destination (that is, a 
QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second source operand, either a NaN or a valid 
floating-point value, is written to the result. If instead of this behavior, it is required that the NaN of either source 
operand be returned, the action of MAXSD can be emulated using a sequence of instructions, such as, a comparison 
followed by AND, ANDN and OR. 


128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:64) of the 
corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded version: Bits (127:64) of the XMM register destination are copied from corresponding 
bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMAXSD is encoded with VEX.L=0. Encoding VMAXSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 
MAX(SRC1, SRC2) 


IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 > SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


VMAXSD (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN = DEST[63:0] := MAX(SRC1[63:0], SRC2[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl; 


Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VMAXSD (VEX.128 encoded version) 
DEST[63:0] := MAX(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


MAXSD (128-bit Legacy SSE version) 
DEST[63:0] := MAX(DEST[63:0], SRC[63:0]) 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMAXSD __m128d __mm_max_round_sd(__m128d a,__m128d, int); 

VMAXSD __m128d __mm_mask_max_round_sd(__m128ds,__ mmask8 k,___m128d a,__m128d 5, int); 
VMAXSD __m128d __mm_maskz_max_round_sd(__mmask8 k,__m128d a, __m128d 5, int); 

MAXSD __m128d_mm_max_sd(__m128d a,_m128d b) 


SIMD Floating-Point Exceptions 
Invalid (Including QNaN Source Operand), Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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MAXSS—Return Maximum Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF SF /r A VIV SSE Return the maximum scalar single-precision floating-point 
MAXSS xmm1, xmm2/m32 value between xmm2/m32 and xmm1. 
VEX.LIG.F3.0F.WIG 5F /r B VV AVX Return the maximum scalar single-precision floating-point 
VMAXSS xmm1, xmm2, value between xmm3/m32 and xmm2. 
xmm3/m32 
EVEX.LLIG.F3.0F.WO 5F /r C VV AVX512F | Return the maximum scalar single-precision floating-point 
VMAXSS xmm1 {k1}{z}, xmm2, value between xmm3/m32 and xmme2. 
xmm3/m32{sae} 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Compares the low single-precision floating-point values in the first source operand and the second source operand, 
and returns the maximum value to the low doubleword of the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second source operand is returned. If 
a value in the second source operand is an SNaN, that SNaN is returned unchanged to the destination (that is, a 
QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second source operand, either a NaN or a valid 
floating-point value, is written to the result. If instead of this behavior, it is required that the NaN from either source 
operand be returned, the action of MAXSS can be emulated using a sequence of instructions, such as, a comparison 
followed by AND, ANDN and OR. 


The second source operand can be an XMM register or a 32-bit memory location. The first source and destination 
operands are XMM registers. 


128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL:32) of the corre- 
sponding destination register remain unchanged. 


VEX.128 and EVEX encoded version: The first source operand is an xmm register encoded by VEX.vvvv. Bits 
(127:32) of the XMM register destination are copied from corresponding bits in the first source operand. Bits 
(MAXVL:128) of the destination register are zeroed. 


EVEX encoded version: The low doubleword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMAXSS is encoded with VEX.L=0. Encoding VMAXSS with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 
MAX(SRC1, SRC2) 


IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 > SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


VMAXSS (EVEX encoded version) 

IF k1[0] or *no writemask* 
THEN = DEST[31:0] := MAX(SRC1[31:0], SRC2[31:0]) 
ELSE 


IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:1 28] := 0 


VMAXSS (VEX.128 encoded version) 
DEST[31:0] := MAX(SRC1[31:0], SRC2[31:0]) 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


MAXSS (128-bit Legacy SSE version) 
DEST[31:0] := MAX(DEST[31:0], SRC[31:0]) 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMAXSS __m128 _mm_max_round_ss(__m128 a,__m128, int); 
VMAXSS __m128 _mm_mask_max_round_ss(__m128s,__mmask8 k,__m128 a,__m128 5, int); 
VMAXSS __m128 _mm_maskz_max_round_ss(__mmask8 k,__m128 a, 


MAXSS __m128 __mm_max_ss(__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
Invalid (Including QNaN Source Operand), Denormal 


Other Exceptions 


INSTRUCTION SET REFERENCE, M-U 


Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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MFENCE—Memory Fence 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF AE FO ZO |V/V SSE2 Serializes load and store operations. 
MFENCE 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Performs a serializing operation on all load-from-memory and store-to-memory instructions that were issued prior 
the MFENCE instruction. This serializing operation guarantees that every load and store instruction that precedes 
the MFENCE instruction in program order becomes globally visible before any load or store instruction that follows 
the MFENCE instruction.! The MFENCE instruction is ordered with respect to all load and store instructions, other 
MFENCE instructions, any LFENCE and SFENCE instructions, and any serializing instructions (such as the CPUID 
instruction). MFENCE does not serialize the instruction stream. 


Weakly ordered memory types can be used to achieve higher processor performance through such techniques as 
out-of-order issue, speculative reads, write-combining, and write-collapsing. The degree to which a consumer of 
data recognizes or knows that the data is weakly ordered varies among applications and may be unknown to the 
producer of this data. The MFENCE instruction provides a performance-efficient way of ensuring load and store 
ordering between routines that produce weakly-ordered results and routines that consume that data. 


Processors are free to fetch and cache data speculatively from regions of system memory that use the WB, WC, and 
WT memory types. This speculative fetching can occur at any time and is not tied to instruction execution. Thus, it 
is not ordered with respect to executions of the MFENCE instruction; data can be brought into the caches specula- 
tively just before, during, or after the execution of an MFENCE instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Specification of the instruction's opcode above indicates a ModR/M byte of FO. For this instruction, the processor 
ignores the r/m field of the ModR/M byte. Thus, MFENCE is encoded by any opcode of the form OF AE Fx, where x 
is in the range 0-7. 


Operation 


Wait_On_Following_Loads_And_Stores_Until(preceding_loads_and_stores_globally_visible); 


Intel C/C++ Compiler Intrinsic Equivalent 
void _mm_mfence(void) 
Exceptions (All Modes of Operation) 


#UD If CPUID.O1H:EDX.SSE2[bit 26] = 0. 
If the LOCK prefix is used. 


1. Aload instruction is considered to become globally visible when the value to be loaded into its destination register is determined. 
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MINPD—Minimum of Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
66 OF 5D /r A VV SSE2 Return the minimum double-precision floating-point values 
MINPD xmm1, xmm2/m128 between xmm1 and xmm2/mem 
VEX.128.66.0F.WIG 5D /r B VV AVX Return the minimum double-precision floating-point values 
VMINPD xmm1, xmm2, between xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.66.0F.WIG 5D /r B VV AVX Return the minimum packed double-precision floating-point 
VMINPD ymm1, ymm2, values between ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.66.0F.W1 5D /r C VIV AVX512VL | Return the minimum packed double-precision floating-point 
VMINPD xmm1 {k1}{z}, xmm2, AVX512F values between xmm_2 and xmm3/m128/m64bcst and store 
xmm3/m128/m64bcst result in xmm1 subject to writemask k1. 
EVEX.256.66.0F.W1 5D /r C VV AVX512VL | Return the minimum packed double-precision floating-point 
VMINPD ymm1 {k1}{z}, ymm2, AVX512F values between ymm2 and ymm3/m256/m64bcst and store 
ymm3/m256/m64bcst result in ymm1 subject to writemask k1. 
EVEX.512.66.0F.W1 5D /r C VV AVX512F Return the minimum packed double-precision floating-point 
VMINPD zmm1 {k1}{z}, zmm2, values between zmm2 and zmm3/m512/m64bcst and store 
zmm3/m512/m64bcst{sae} result in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed double-precision floating-point values in the first source operand and the 
second source operand and returns the minimum value for each pair of values to the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second operand (source operand) is 
returned. If a value in the second operand is an SNaN, then SNaN is forwarded unchanged to the destination (that 
is, a QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second operand (source operand), either a NaN 
or a valid floating-point value, is written to the result. If instead of this behavior, it is required that the NaN source 
operand (from either the first or second operand) be returned, the action of MINPD can be emulated using a 
sequence of instructions, such as, a comparison followed by AND, ANDN and OR. 


EVEX encoded versions: The first source operand (the second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


MIN(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 < SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


VMINPD (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+63:i] = MIN(SRC1[i+63:i], SRC2[63:0]) 
ELSE 
DEST[i+63:i] = MIN(SRC1[i+63:i], SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VMINPD (VEX.256 encoded version) 

DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := MIN(SRC1[127:64], SRC2[127:64]) 
DEST[191:128] := MIN(SRC1[191:128], SRC2[191:128}) 
DEST[255:192] := MIN(SRC1[255:192], SRC2[255:192]) 


VMINPD (VEX.128 encoded version) 

DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := MIN(SRC1[127:64], SRC2[127:64]) 
DEST[MAXVL-1:128] := 0 


MINPD (128-bit Legacy SSE version) 

DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := MIN(SRC1[127:64], SRC2[127:64]) 
DEST[MAXVL-1:128] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VMINPD __m512d_mm512_min_pd(__m512d a, _m512d b); 

VMINPD __m512d_mm512_mask_min_pd(__m512ds,__ mmask8 k,__m512da,__m512d b); 
VMINPD __m512d_mm512_maskz_min_pd(__mmask8 k,__m512da,__m512d b); 

VMINPD __m512d_mm512_min_round_pd(__m512da,__m512d 5, int); 

VMINPD __m512d_mm512_mask_min_round_pd(__m512ds,__mmask8 k,__m512da,__m512d, int); 
VMINPD __m512d_mm512_maskz_min_round_pd(__mmask8 k,__m512da,__m512db, int); 
VMINPD __m256d_mm256_mask_min_pd(__m256d s,__ mmask8 k,__ m256d a,__ m256d b); 
VMINPD __m256d __mm256_maskz_min_pd(__mmask8 k,___m256d a, ___ m256d b); 

VMINPD __m128d_mm_mask_min_pd(__m128ds,__ mmask8 k,__m128d a,__m128d b); 
VMINPD __m128d_mm_maskz_min_pd( ___mmask8 k,___m128d a, __m128d b); 

VMINPD __m256d __mm256_min_pd (__m256d a, __m256d b); 

MINPD __m128d _mm_min_pd (__m128d a, ___m128d b); 


SIMD Floating-Point Exceptions 
Invalid (including QNaN Source Operand), Denormal 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MINPS—Minimum of Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF 5D /r A VIV SSE Return the minimum single-precision floating-point values 
MINPS xmm1, xmm2/m128 between xmm1 and xmm2/mem. 
VEX.128.0F.WIG 5D /r B VIV AVX Return the minimum single-precision floating-point values 
VMINPS xmm1, xmm2, between xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.0F.WIG 5D /r B VIV AVX Return the minimum single double-precision floating-point 
VMINPS ymm1, ymm2, values between ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.0F.WO 5D /r C VIV AVX512VL | Return the minimum packed single-precision floating-point 
VMINPS xmm1 {k1}{z}, xmme2, AVX512F values between xmm2 and xmm3/m128/m32bcst and store 
xmm3/m1 28/m32bcst result in xmm1 subject to writemask k1. 
EVEX.256.0F.WO0 5D /r C VV AVX512VL | Return the minimum packed single-precision floating-point 
VMINPS ymm1 {k1}{z}, ymm2, AVX512F values between ymm2 and ymm3/m256/m32bcst and store 
ymm3/m256/m32bcst result in ymm1 subject to writemask k1. 
EVEX.512.0F.WO 5D /r C VIV AVX512F Return the minimum packed single-precision floating-point 
VMINPS zmm1 {k1}{z}, zmm2, values between zmm2 and zmm3/m512/m32bcst and store 
zmm3/m512/m32bcst{sae} result in zmm1 subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a SIMD compare of the packed single-precision floating-point values in the first source operand and the 
second source operand and returns the minimum value for each pair of values to the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second operand (source operand) is 
returned. If a value in the second operand is an SNaN, then SNaN is forwarded unchanged to the destination (that 
is, a QNaN version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second operand (source operand), either a NaN 
or a valid floating-point value, is written to the result. If instead of this behavior, it is required that the NaN source 
operand (from either the first or second operand) be returned, the action of MINPS can be emulated using a 
sequence of instructions, such as, a comparison followed by AND, ANDN and OR. 


EVEX encoded versions: The first source operand (the second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


MIN(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 < SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


VMINPS (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+31:i] := MIN(SRC1[i+31:i], SRC2[31:0]) 
ELSE 
DEST[i+31:i] := MIN(SRC1[i+31:i], SRC2[i+3 1:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VMINPS (VEX.256 encoded version) 

DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
DEST[63:32] := MIN(SRC1[63:32], SRC2[63:32]) 
DEST[95:64] := MIN(SRC1[95:64], SRC2[95:64]) 
DEST[127:96] := MIN(SRC1[127:96], SRC2[127:96]) 
DEST[159:1 28] := MIN(SRC1[159:128], SRC2[159:128] 
DEST[191:160] := MIN(SRC1[191:160], SRC2[191:160] 
DEST[223:192] := MIN(SRC1[223:192], SRC2[223:192] 
DEST[255:224] := MIN(SRC1[255:224], SRC2[255:224] 


i) 


VMINPS (VEX.128 encoded version) 

DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
DEST[63:32] := MIN(SRC1[63:32], SRC2[63:32]) 
DEST[95:64] := MIN(SRC1[95:64], SRC2[95:64]) 
DEST[127:96] := MIN(SRC1[127:96], SRC2[127:96]) 
DEST[MAXVL-1:128] := 0 
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MINPS (128-bit Legacy SSE version) 

DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
DEST[63:32] := MIN(SRC1[63:32], SRC2[63:32]) 
DEST[95:64] := MIN(SRC1[95:64], SRC2[95:64]) 
DEST[127:96] := MIN(SRC1[127:96], SRC2[127:96]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMINPS __m512_mm512_min_ps(__m512 a,__m512 b); 

VMINPS __m512_mm512_mask_min_ps(__m512 s,__mmask16 k,__m512 a,__m512 b); 
VMINPS __m512_mm512_maskz_min_ps(__mmask16 k,__m512 a,__m512 b); 

VMINPS __m512_mm512_min_round_ps(__m512 a,__m512 b, int); 


VMINPS __m512_mm512_mask_min_round_ps(__m512s,__ mmask16 k,__m512 a,__m512 5, int); 
VMINPS __m512_mm512_maskz_min_round_ps(__mmask16 k,__m512 a,__m512 5, int); 
VMINPS __m256 __mm256_mask_min_ps(__m256 s,__ mmask8 k,___m256 a,__ m256 b); 


VMINPS __m256 __mm256_maskz_min_ps(__mmask8 k,__m256 a, __m25 b); 
VMINPS __m128_mm_mask_min_ps(__m128 s,__ mmask8 k,___m128a,__m128 b); 
VMINPS __m128_mm_maskz_min_ps(__mmask8 k,__m128 a,__m128 b); 

VMINPS __m256 __mm256_min_ps (__m256 a,__m256 b); 

MINPS __m128_mm_min_ps (__m128 a,_m128 b); 


SIMD Floating-Point Exceptions 
Invalid (including QNaN Source Operand), Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MINSD—Return Minimum Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F2 OF 5D /r A VIV SSE2 Return the minimum scalar double-precision floating- 
MINSD xmm1, xmm2/m64 point value between xmm2/m64 and xmm1. 
VEX.LIG.F2.0F.WIG 5D /r B VIV AVX Return the minimum scalar double-precision floating- 
VMINSD xmm1, xmm2, xmm3/m64 point value between xmm3/m64 and xmm2. 
EVEX.LLIG.F2.0F.W1 5D /r C VIV AVX512F Return the minimum scalar double-precision floating- 
VMINSD xmm1 {k1}{z}, xmm2, point value between xmm3/m64 and xmm2. 
xmm3/m64{sae} 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Compares the low double-precision floating-point values in the first source operand and the second source 
operand, and returns the minimum value to the low quadword of the destination operand. When the source 
operand is a memory operand, only the 64 bits are accessed. 

If the values being compared are both 0.0s (of either sign), the value in the second source operand is returned. If 
a value in the second source operand is an SNaN, then SNaN is returned unchanged to the destination (that is, a 
QNaN version of the SNaN is not returned). 

If only one value is a NaN (SNaN or QNaN) for this instruction, the second source operand, either a NaN or a valid 
floating-point value, is written to the result. If instead of this behavior, it is required that the NaN source operand 
(from either the first or second source) be returned, the action of MINSD can be emulated using a sequence of 
instructions, such as, a comparison followed by AND, ANDN and OR. 


The second source operand can be an XMM register or a 64-bit memory location. The first source and destination 
operands are XMM registers. 


128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:64) of the 
corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded version: Bits (127:64) of the XMM register destination are copied from corresponding 
bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMINSD is encoded with VEX.L=0. Encoding VMINSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


MIN(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 < SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


MINSD (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN  DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


MINSD (VEX.128 encoded version) 
DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


MINSD (128-bit Legacy SSE version) 
DEST[63:0] := MIN(SRC1[63:0], SRC2[63:0]) 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMINSD __m128d_mm_min_round_sd(__m128d a, __m128d 5, int); 

VMINSD __m128d __mm_mask_min_round_sd(__m128ds,___ mmask8 k,__m128d a,__m128d, int); 
VMINSD __m128d __mm_maskz_min_round_sd(__mmask8 k,__m128d a,__m128d, int); 

MINSD __m128d_mm_min_sd(__m128d a, ___m128d b) 


SIMD Floating-Point Exceptions 
Invalid (including QNaN Source Operand), Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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MINSS—Return Minimum Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F3 OF 5D /r A VIV SSE Return the minimum scalar single-precision floating- 
MINSS xmm1,xmm2/m32 point value between xmm2/m32 and xmm1. 
VEX.LIG.F3.0F.WIG 5D /r B VIV AVX Return the minimum scalar single-precision floating- 
VMINSS xmm1,xmm2, xmm3/m32 point value between xmm3/m32 and xmm_2. 
EVEX.LLIG.F3.0F.WO 5D /r C VIV AVX512F Return the minimum scalar single-precision floating- 
VMINSS xmm1 {k1}{z}, xmm2, point value between xmm3/m32 and xmm_2. 
xmm3/m32{sae} 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Compares the low single-precision floating-point values in the first source operand and the second source operand 
and returns the minimum value to the low doubleword of the destination operand. 


If the values being compared are both 0.0s (of either sign), the value in the second source operand is returned. If 
a value in the second operand is an SNaN, that SNaN is returned unchanged to the destination (that is, a QNaN 
version of the SNaN is not returned). 


If only one value is a NaN (SNaN or QNaN) for this instruction, the second source operand, either a NaN or a valid 
floating-point value, is written to the result. If instead of this behavior, it is required that the NaN in either source 
operand be returned, the action of MINSD can be emulated using a sequence of instructions, such as, a comparison 
followed by AND, ANDN and OR. 


The second source operand can be an XMM register or a 32-bit memory location. The first source and destination 
operands are XMM registers. 

128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL:32) of the corre- 
sponding destination register remain unchanged. 


VEX.128 and EVEX encoded version: The first source operand is an xmm register encoded by (E)VEX.vvvv. Bits 
(127:32) of the XMM register destination are copied from corresponding bits in the first source operand. Bits 
(MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low doubleword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMINSS is encoded with VEX.L=0. Encoding VMINSS with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


MIN(SRC1, SRC2) 
{ 
IF ((SRC1 = 0.0) and (SRC2 = 0.0)) THEN DEST := SRC2; 
ELSE IF (SRC1 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC2 = NaN) THEN DEST := SRC2; Fl; 
ELSE IF (SRC1 < SRC2) THEN DEST := SRC1; 
ELSE DEST := SRC2; 
Fl; 
} 


MINSS (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VMINSS (VEX.128 encoded version) 
DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


MINSS (128-bit Legacy SSE version) 
DEST[31:0] := MIN(SRC1[31:0], SRC2[31:0]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
VMINSS __m128 _mm_min_round_ss(__m128 a,__m128 5, int); 


VMINSS __m128 __mm_mask_min_round_ss(__m128 s,__ mmask8 k,__m128 a,__m128 }, int); 


VMINSS __m128 __mm_maskz_min_round_ss(__mmask8 k, 
MINSS __m128_mm_min_ss(__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
Invalid (Including QNaN Source Operand), Denormal 


Other Exceptions 


m128 a, 


m128 b, int); 


Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MONITOR—Set Up Monitor Address 


Opcode Instruction Op/ 64-Bit Compat/ Description 
En Mode Leg Mode 
OF 01 C8 MONITOR ZO Valid Valid Sets up a linear address range to be 


monitored by hardware and activates the 
monitor. The address range should be a write- 
back memory caching type. The address is 


DS:RAX/EAX/AX. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 


Description 


The MONITOR instruction arms address monitoring hardware using an address specified in EAX (the address range 
that the monitoring hardware checks for store operations can be determined by using CPUID). A store to an 
address within the specified address range triggers the monitoring hardware. The state of monitor hardware is 
used by MWAIT. 


The address is specified in RAX/EAX/AX and the size is based on the effective address size of the encoded instruc- 
tion. By default, the DS segment is used to create a linear address that is monitored. Segment overrides can be 
used. 


ECX and EDX are also used. They communicate other information to MONITOR. ECX specifies optional extensions. 
EDX specifies optional hints; it does not change the architectural behavior of the instruction. For the Pentium 4 
processor (family 15, model 3), no extensions or hints are defined. Undefined hints in EDX are ignored by the 
processor; undefined extensions in ECX raises a general protection fault. 


The address range must use memory of the write-back type. Only write-back memory will correctly trigger the 
monitoring hardware. Additional information on determining what address range to use in order to prevent false 
wake-ups is described in Chapter 8, “Multiple-Processor Management” of the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3A. 


The MONITOR instruction is ordered as a load operation with respect to other memory transactions. The instruction 
is subject to the permission checking and faults associated with a byte load. Like a load, MONITOR sets the A-bit 
but not the D-bit in page tables. 


CPUID.01H:ECX.MONITOR[bit 3] indicates the availability of MONITOR and MWAIT in the processor. When set, 
MONITOR may be executed only at privilege level 0 (use at any other privilege level results in an invalid-opcode 
exception). The operating system or system BIOS may disable this instruction by using the IA32_MISC_ENABLE 
MSR; disabling MONITOR clears the CPUID feature flag and causes execution to generate an invalid-opcode excep- 
tion. 


The instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


MONITOR sets up an address range for the monitor hardware using the content of EAX (RAX in 64-bit mode) as an 
effective address and puts the monitor hardware in armed state. Always use memory of the write-back caching 
type. A store to the specified address range will trigger the monitor hardware. The content of ECX and EDX are 
used to communicate other information to the monitor hardware. 


Intel C/C++ Compiler Intrinsic Equivalent 


MONITOR: void _mm_monitor(void const *p, unsigned extensions,unsigned hints) 


Numeric Exceptions 
None 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#UD 


If the value in EAX is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If ECX #0. 

If the value in EAX is outside the SS segment limit. 
For a page fault. 

If CPUID.01H:ECX.MONITOR[bit 3] = 0. 

If current privilege level is not 0. 


Real Address Mode Exceptions 


#GP 


#SS 


#UD 


If the CS, DS, ES, FS, or GS register is used to access memory and the value in EAX is outside 
of the effective address space from 0 to FFFFH. 


If ECX #0. 


If the SS register is used to access memory and the value in EAX is outside of the effective 
address space from 0 to FFFFH. 


If CPUID.O1H:ECX.MONITOR[bit 3] = 0. 


Virtual 8086 Mode Exceptions 


#UD 


The MONITOR instruction is not recognized in virtual-8086 mode (even if 
CPUID.O1H:ECX.MONITOR[bit 3] = 1). 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#UD 
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If the linear address of the operand in the CS, DS, ES, FS, or GS segment is in a non-canonical 
form. 


If RCX #0. 

If the SS register is used to access memory and the value in EAX is in a non-canonical form. 
For a page fault. 

If the current privilege level is not 0. 

If CPUID.OLH:ECX.MONITOR[bit 3] = 0. 
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MOV—Move 
Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

88 /r MOV r/m8&,r8 MR | Valid Valid Move r8 to r/m8. 

REX + 88 /r MOV r/m8 ’r8 MR | Valid NE. Move r8 to r/m8. 

89 /r MOV r/m16,r16 MR | Valid Valid Move r76 to r/m16. 

89 /r MOV r/m32,r32 MR_ | Valid Valid Move r32 to r/m32. 

REX.W + 89 /r MOV r/m64,r64 MR | Valid N.E. Move r64 to r/m64. 

8A /r MOV r8,r/m8 RM | Valid Valid Move r/m8 to r8. 

REX + 8A /r MOV r8***r/m8*** RM | Valid N.E. Move r/m8 to r8. 

8B /r MOV r16,r/m16 RM _ | Valid Valid Move r/m16 to r76. 

8B /r MOV r32,r/m32 RM _ | Valid Valid Move r/m32 to r32. 

REX.W + 8B /r MOV r64,r/m64 RM _ | Valid N.E. Move r/m64 to r64. 

8C/r MOV r/m16,Sreg** MR | Valid Valid Move segment register to r/m76. 

8C/r MOV r16/r32/m16, Sreg** |MR_ | Valid Valid Move zero extended 16-bit segment register 
to r16/r32/m16. 
to r64/m16. 

8E /r MOV Sreg,r/m16** RM _ | Valid Valid Move r/m16 to segment register. 

REX.W + 8E /r MOV Sreg,r/m64** RM_ | Valid Valid Move lower 16 bits of r/m64 to segment 
register. 

AO MOV AL,moffs8* FD | Valid Valid Move byte at (seg-offset) to AL. 

REX.W + AO MOV AL,moffs8* FD Valid N.E. Move byte at (offset) to AL. 

Al MOV AX,moffs 16* FD | Valid Valid Move word at (seg:offset) to AX. 

Al MOV EAX,moffs32* FD | Valid Valid Move doubleword at (seg:offset) to EAX. 

REX.W + Al MOV RAX,moffs64* FD | Valid N.E. Move quadword at (offset) to RAX. 

A2 MOV moffs8,AL TD | Valid Valid Move AL to (seg:offset). 

REX.W + A2 MOV moffs8 AL TD | Valid N.E. Move AL to (offset). 

A3 MOV moffs16*,AX TD | Valid Valid Move AX to (seg:offset). 

A3 MOV moffs32*,EAX TD | Valid Valid Move EAX to (seg-:offset). 

REX.W + A3 MOV moffs64*,RAX TD | Valid N.E. Move RAX to (offset). 

BO+ rb ib MOV r8, imm8& Ol Valid Valid Move imm8 to r8. 

REX + BO+ rb ib MOV r8_, imm8 Ol Valid N.E. Move imm8 to r8. 

B8+ rw iw MOV r716, imm16 Ol Valid Valid Move imm16 to r76. 

B8+ rd id MOV r32, imm32 Ol Valid Valid Move imm32 to r32. 

REX.W + B8+ rd io MOV r64, imm64 Ol Valid N.E. Move imm64 to r64. 

C6 /0 ib MOV r/m8, imm8 MI Valid Valid Move imm8 to r/m8. 

REX + C6 /0 ib MOV r/m8***, imm& MI Valid N.E. Move imm8 to r/m8. 

C7 /0 iw MOV r/m16, imm16 MI Valid Valid Move imm16 to r/m16. 

C7 /0 id MOV r/m32, imm32 MI Valid Valid Move imm32 to r/m32. 

REX.W + C7 /0 id MOV r/m64, imm32 MI Valid N.E. Move imm32 sign extended to 64-bits to 
r/m64. 
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NOTES: 


* The moffs8, moffs16, moffs32 and moffs64 operands specify a simple offset relative to the segment base, where 8, 16, 32 and 64 
refer to the size of the data. The address-size attribute of the instruction determines the size of the offset, either 16, 32 or 64 
bits. 


** In 32-bit mode, the assembler may insert the 16-bit operand-size prefix with this instruction (see the following “Description” sec- 
tion for further information). 


***In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
FD AL/AX/EAX/RAX Moffs NA NA 
TD Moffs (w) AL/AX/EAX/RAX NA NA 
Ol opcode + rd (w) imm8/16/32/64 NA NA 
MI ModRM:r/m (w) imm8/16/32/64 NA NA 
Description 


Copies the second operand (source operand) to the first operand (destination operand). The source operand can be 
an immediate value, general-purpose register, segment register, or memory location; the destination register can 
be a general-purpose register, segment register, or memory location. Both operands must be the same size, which 
can be a byte, a word, a doubleword, or a quadword. 


The MOV instruction cannot be used to load the CS register. Attempting to do so results in an invalid opcode excep- 
tion (#UD). To load the CS register, use the far JMP, CALL, or RET instruction. 


If the destination operand is a segment register (DS, ES, FS, GS, or SS), the source operand must be a valid 
segment selector. In protected mode, moving a segment selector into a segment register automatically causes the 
segment descriptor information associated with that segment selector to be loaded into the hidden (shadow) part 
of the segment register. While loading this information, the segment selector and segment descriptor information 
is validated (see the “Operation” algorithm below). The segment descriptor data is obtained from the GDT or LDT 
entry for the specified segment selector. 


A NULL segment selector (values 0000-0003) can be loaded into the DS, ES, FS, and GS registers without causing 
a protection exception. However, any subsequent attempt to reference a segment whose corresponding segment 
register is loaded with a NULL value causes a general protection exception (#GP) and no memory reference occurs. 


Loading the SS register with a MOV instruction suppresses or inhibits some debug exceptions and inhibits inter- 
rupts on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of 
the next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruc- 
tion (MOV ESP, stack-pointer value) before an event can be delivered. See Section 6.8.3, “Masking Exceptions 
and Interrupts When Switching Stacks,” in Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A. Intel recommends that software use the LSS instruction to load the SS register and ESP together. 


When executing MOV Reg, Sreg, the processor copies the content of Sreg to the 16 least significant bits of the 
general-purpose register. The upper bits of the destination register are zero for most IA-32 processors (Pentium 
Pro processors and later) and all Intel 64 processors, with the exception that bits 31:16 are undefined for Intel 
Quark X1000 processors, Pentium and earlier processors. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 
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Operation 
DEST := SRC; 


Loading a segment register while in protected mode results in special checks and actions, as described in the 
following listing. These checks are performed on the segment selector and the segment descriptor to which it 
points. 


IF SS is loaded 
THEN 
IF segment selector is NULL 
THEN #GP(0); Fl; 
IF segment selector index is outside descriptor table limits 
OR segment selector’s RPL 4 CPL 
OR segment is not a writable data segment 
OR DPL 4 CPL 
THEN #GP(selector); FI; 
IF segment not marked present 
THEN #SS(selector); 
ELSE 
SS := segment selector; 
SS := segment descriptor; Fl; 
Fl; 


IF DS, ES, FS, or GS is loaded with non-NULL selector 
THEN 
IF segment selector index is outside descriptor table limits 
OR segment is not a data or readable code segment 
OR ((segment is a data or nonconforming code segment) AND ((RPL > DPL) or (CPL > DPL))) 
THEN #GP(selector); Fl; 
IF segment not marked present 
THEN #NP(selector); 
ELSE 
SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; Fl; 
Fl; 


IF DS, ES, FS, or GS is loaded with NULL selector 
THEN 
SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; 
Fl; 


Flags Affected 


None 
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Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


#SS(0) 
#SS(selector) 
#NP 


#PF(fault-code) 
#AC(0) 


#UD 


If attempt is made to load SS register with NULL segment selector. 

If the destination operand is in a non-writable segment. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

If segment selector index is outside descriptor table limits. 


If the SS register is being loaded and the segment selector's RPL and the segment descriptor’s 
DPL are not equal to the CPL. 


If the SS register is being loaded and the segment pointed to is a 
non-writable data segment. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is not a data or 
readable code segment. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is a data or 
nonconforming code segment, and either the RPL or the CPL is greater than the DPL. 


If a memory operand effective address is outside the SS segment limit. 
If the SS register is being loaded and the segment pointed to is marked not present. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is marked not 
present. 


If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If attempt is made to load the CS register. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If attempt is made to load the CS register. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If attempt is made to load the CS register. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#GP(0) 


#GP(selector) 


#SS(0) 
#SS(selector) 
#PF(fault-code) 
#AC(0) 


#UD 
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If the memory address is in a non-canonical form. 
If an attempt is made to load SS register with NULL segment selector when CPL = 3. 


If an attempt is made to load SS register with NULL segment selector when CPL < 3 and CPL 
#RPL. 


If segment selector index is outside descriptor table limits. 
If the memory access to the descriptor table is non-canonical. 


If the SS register is being loaded and the segment selector's RPL and the segment descriptor’s 
DPL are not equal to the CPL. 


If the SS register is being loaded and the segment pointed to is a nonwritable data segment. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is not a data or 
readable code segment. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is a data or 
nonconforming code segment, but both the RPL and the CPL are greater than the DPL. 


If the stack address is in a non-canonical form. 
If the SS register is being loaded and the segment pointed to is marked not present. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If attempt is made to load the CS register. 
If the LOCK prefix is used. 
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MOV—Move to/from Control Registers 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

OF 20/r MR |N.E. Valid Move control register to r32. 

MOV r32, CRO-CR7 

OF 20/r MR | Valid N.E. Move extended control register to r64. 
MOV r64, CRO-CR7 

REX.R + OF 20/0 MR | Valid N.E. Move extended CR8 to 164." 

MOV r64, CR8 

OF 22 /r RM |N.E. Valid Move r32 to control register. 

MOV CRO-CR7, r32 

OF 22 /r RM _ | Valid N.E. Move r64 to extended control register. 
MOV CRO-CR7, r64 

REX.R + OF 22 /O RM _ | Valid N.E. Move r64 to extended CR8." 

MOV CR8, r64 

NOTE: 


1. MOV CR* instructions, except for MOV CR8, are serializing instructions. MOV CR8 is not 
architecturally defined as a serializing instruction. For more information, see Chapter 8 in Intel® 64 and IA-32 Architectures Soft- 
ware Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Moves the contents of a control register (CRO, CR2, CR3, CR4, or CR8) to a general-purpose register or the 

contents of a general-purpose register to a control register. The operand size for these instructions is always 32 bits 
in non-64-bit modes, regardless of the operand-size attribute. On a 64-bit capable processor, an execution of MOV 
to CR outside of 64-bit mode zeros the upper 32 bits of the control register. (See “Control Registers” in Chapter 2 
of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for a detailed description of the 
flags and fields in the control registers.) This instruction can be executed only when the current privilege level is 0. 


At the opcode level, the reg field within the ModR/M byte specifies which of the control registers is loaded or read. 
The 2 bits in the mod field are ignored. The r/m field specifies the general-purpose register loaded or read. Some 
of the bits in CRO, CR3 and CR4 are reserved and must be written with zeros. Attempting to set any reserved bits 
in CRO[31:0] is ignored. Attempting to set any reserved bits in CRO[63:32] results in a general-protection excep- 
tion, #GP(0). When PCIDs are not enabled, bits 2:0 and bits 11:5 of CR3 are not used and attempts to set them 
are ignored. Attempting to set any reserved bits in CR3[63:MAXPHYADDR] results in #GP(0). Attempting to set any 
reserved bits in CR4 results in #GP(0). On Pentium 4, Intel Xeon and P6 family processors, CRO.ET remains set 
after any load of CRO; attempts to clear this bit have no impact. 


In certain cases, these instructions have the side effect of invalidating entries in the TLBs and the paging-structure 
caches. See Section 4.10.4.1, “Operations that Invalidate TLBs and Paging-Structure Caches,” in the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A for details. 


The following side effects are implementation-specific for the Pentium 4, Intel Xeon, and P6 processor family: when 
modifying PE or PG in register CRO, or PSE or PAE in register CR4, all TLB entries are flushed, including global 
entries. Software should not depend on this functionality in all Intel 64 or IA-32 processors. 


In 64-bit mode, the instruction’s default operation size is 64 bits. The REX.R prefix must be used to access CR8. Use 
of REX.B permits access to additional registers (R8-R15). Use of the REX.W prefix or 66H prefix is ignored. Use of 
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the REX.R prefix to specify a register other than CR8 causes an invalid-opcode exception. See the summary chart 
at the beginning of this section for encoding data and limits. 


If CR4.PCIDE = 1, bit 63 of the source operand to MOV to CR3 determines whether the instruction invalidates 
entries in the TLBs and the paging-structure caches (see Section 4.10.4.1, “Operations that Invalidate TLBs and 
Paging-Structure Caches,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). The 
instruction does not modify bit 63 of CR3, which is reserved and always 0. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 
DEST := SRC; 


Flags Affected 
The OF, SF, ZF, AF, PF, and CF flags are undefined. 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 


If an attempt is made to write invalid bit combinations in CRO (such as setting the PG flag to 1 
when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1). 


If an attempt is made to write a 1 to any reserved bit in CR4. 
If an attempt is made to write 1 to CR4.PCIDE. 


If any of the reserved bits are set in the page-directory pointers table (PDPT) and the loading 
of a control register causes the PDPT to be loaded into the processor. 


#UD If the LOCK prefix is used. 
If an attempt is made to access CR1, CR5, CR6, CR7, or CR9-CR15. 


Real-Address Mode Exceptions 
#GP If an attempt is made to write a 1 to any reserved bit in CR4. 
If an attempt is made to write 1 to CR4.PCIDE. 


If an attempt is made to write invalid bit combinations in CRO (such as setting the PG flag to 1 
when the PE flag is set to 0). 


#UD If the LOCK prefix is used. 
If an attempt is made to access CR1, CR5, CR6, CR7, or CR9-CR15. 


Virtual-8086 Mode Exceptions 
#GP(0) These instructions cannot be executed in virtual-8086 mode. 


Compatibility Mode Exceptions 
#GP(0) If the current privilege level is not 0. 


If an attempt is made to write invalid bit combinations in CRO (such as setting the PG flag to 1 
when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1). 


If an attempt is made to change CR4.PCIDE from 0 to 1 while CR3[11:0] # OOOH. 
If an attempt is made to clear CRO.PG[bit 31] while CR4.PCIDE = 1. 
If an attempt is made to leave IA-32e mode by clearing CR4.PAE[bit 5]. 
#UD If the LOCK prefix is used. 
If an attempt is made to access CR1, CR5, CR6, CR7, or CR9-CR15. 
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64-Bit Mode Exceptions 


#GP(0) 


#UD 
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If the current privilege level is not 0. 


If an attempt is made to write invalid bit combinations in CRO (such as setting the PG flag to 1 
when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1). 


If an attempt is made to change CR4.PCIDE from 0 to 1 while CR3[11:0] # OOOH. 
If an attempt is made to clear CRO.PG[bit 31]. 

If an attempt is made to write a 1 to any reserved bit in CR4. 

If an attempt is made to write a 1 to any reserved bit in CR8. 

If an attempt is made to write a 1 to any reserved bit in CR3[63:MAXPHYADDR]. 
If an attempt is made to leave IA-32e mode by clearing CR4.PAE[bit 5]. 

If the LOCK prefix is used. 

If an attempt is made to access CR1, CR5, CR6, CR7, or CR9-CR15. 

If the REX.R prefix is used to specify a register other than CR8. 
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MOV—Move to/from Debug Registers 


Opcode/ Op/ | 64-Bit Compat/ |Description 

Instruction En |Mode Leg Mode 

OF 21/r MR |N.E. Valid Move debug register to r32. 

MOV r32, DRO-DR7 

OF 21/r MR | Valid N.E. Move extended debug register to r64. 
MOV r64, DRO-DR7 

OF 23 /r RM |N.E. Valid Move r32 to debug register. 

MOV DRO-DR7, r32 

OF 23 /r RM_ | Valid N.E. Move r64 to extended debug register. 
MOV DRO-DR7, r64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Moves the contents of a debug register (DRO, DR1, DR2, DR3, DR4, DR5, DR6, or DR7) to a general-purpose 
register or vice versa. The operand size for these instructions is always 32 bits in non-64-bit modes, regardless of 
the operand-size attribute. (See Section 17.2, ‘Debug Registers”, of the Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 3A, for a detailed description of the flags and fields in the debug registers. ) 


The instructions must be executed at privilege level 0 or in real-address mode. 


When the debug extension (DE) flag in register CR4 is clear, these instructions operate on debug registers in a 
manner that is compatible with Intel386 and Intel486 processors. In this mode, references to DR4 and DR5 refer 
to DR6 and DR7, respectively. When the DE flag in CR4 is set, attempts to reference DR4 and DRS result in an 
undefined opcode (#UD) exception. (The CR4 register was added to the IA-32 Architecture beginning with the 
Pentium processor.) 


At the opcode level, the reg field within the ModR/M byte specifies which of the debug registers is loaded or read. 
The two bits in the mod field are ignored. The r/m field specifies the general-purpose register loaded or read. 


In 64-bit mode, the instruction’s default operation size is 64 bits. Use of the REX.B prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W or 66H prefix is ignored. Use of the REX.R prefix causes an invalid- 
opcode exception. See the summary chart at the beginning of this section for encoding data and limits. 


Operation 
IF ((DE = 1) and (SRC or DEST = DR4 or DRS)) 
THEN 


#UD; 
ELSE 
DEST := SRC; 
Fl; 
Flags Affected 


The OF, SF, ZF, AF, PF, and CF flags are undefined. 
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Protected Mode Exceptions 


#GP(0) 
#UD 


#DB 


If the current privilege level is not 0. 


If CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or 
DR5. 


If the LOCK prefix is used. 
If any debug register is accessed while the DR7.GD[bit 13] = 1. 


Real-Address Mode Exceptions 


#UD 


#DB 


If CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or 
DR5. 


If the LOCK prefix is used. 
If any debug register is accessed while the DR7.GD[bit 13] = 1. 


Virtual-8086 Mode Exceptions 


#GP(0) 


The debug registers cannot be loaded or read when in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#UD 


#DB 
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If the current privilege level is not 0. 
If an attempt is made to write a 1 to any of bits 63:32 in DR6. 
If an attempt is made to write a 1 to any of bits 63:32 in DR7. 


If CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or 
DR5. 


If the LOCK prefix is used. 
If the REX.R prefix is used. 
If any debug register is accessed while the DR7.GD[bit 13] = 1. 
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Opcode/ Op/En 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 

66 OF 28 /r A VIV SSE2 Move aligned packed double-precision floating- 

MOVAPD xmm1, xmm2/m128 point values from xmm2/mem to xmm1. 

66 OF 29 /r B VIV SSE2 Move aligned packed double-precision floating- 

MOVAPD xmm2/m1 28, xmm1 point values from xmm1 to xmm2/mem. 

VEX.128.66.0F.WIG 28 /r A VV AVX Move aligned packed double-precision floating- 

VMOVAPD xmm1, xmm2/m128 point values from xmm2/mem to xmm1. 

VEX.128.66.0F.WIG 29 /r B VV AVX Move aligned packed double-precision floating- 

VMOVAPD xmm2/m128, xmm1 point values from xmm1 to xmm2/mem. 

VEX.256.66.0F.WIG 28 /r A VN AVX Move aligned packed double-precision floating- 

VMOVAPD ymm1, ymm2/m256 point values from ymm2/mem to ymm1. 

VEX.256.66.0F.WIG 29 /r B VIN AVX Move aligned packed double-precision floating- 

VMOVAPD ymm2/m256, ymm1 point values from ymm1 to ymm2/mem. 

EVEX.128.66.0F.W1 28 /r C VIV AVX512VL | Move aligned packed double-precision floating- 

VMOVAPD xmm1 {k1}{z}, xmm2/m128 AVX512F point values from xmm2/m128 to xmm1 using 
writemask k1. 

EVEX.256.66.0F.W1 28 /r C VIV AVX512VL | Move aligned packed double-precision floating- 

VMOVAPD ymm1 {k1}{z}, ymm2/m256 AVX512F point values from ymm2/m256 to ymm1 using 
writemask k1. 

EVEX.512.66.0F.W1 28 /r C VV AVX512F Move aligned packed double-precision floating- 

VMOVAPD zmm1 {k1}{z}, zmm2/m512 point values from zmm2/m512 to zmm1 using 
writemask k1. 

EVEX.128.66.0F.W1 29 /r D VIV AVX512VL | Move aligned packed double-precision floating- 

VMOVAPD xmm2/m1 28 {k1}{z}, xmm1 AVX512F point values from xmm1 to xmm2/m128 using 
writemask k1. 

EVEX.256.66.0F.W1 29 /r D VIV AVX512VL | Move aligned packed double-precision floating- 

VMOVAPD ymm2/m256 {k1}{z}, ymm1 AVX512F point values from ymm1 to ymm2/m256 using 
writemask k1. 

EVEX.512.66.0F.W1 29 /r D VV AVX512F Move aligned packed double-precision floating- 

VMOVAPD zmm2/m512 {k1}{z}, zmm1 point values from zmm1 to zmm2/m512 using 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
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Description 


Moves 2, 4 or 8 double-precision floating-point values from the source operand (second operand) to the destination 
operand (first operand). This instruction can be used to load an XMM, YMM or ZMM register from an 128-bit, 256- 
bit or 512-bit memory location, to store the contents of an XMM, YMM or ZMM register into a 128-bit, 256-bit or 
512-bit memory location, or to move data between two XMM, two YMM or two ZMM registers. 


When the source or destination operand is a memory operand, the operand must be aligned on a 16-byte (128-bit 
versions), 32-byte (256-bit version) or 64-byte (EVEX.512 encoded version) boundary or a general-protection 
exception (#GP) will be generated. For EVEX encoded versions, the operand must be aligned to the size of the 
memory operand. To move double-precision floating-point values to and from unaligned memory locations, use the 
VMOVUPD instruction. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
EVEX.512 encoded version: 


Moves 512 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a ZMM register from a 512-bit float64 
memory location, to store the contents of a ZMM register into a 512-bit float6é4 memory location, or to move data 
between two ZMM registers. When the source or destination operand is a memory operand, the operand must be 
aligned on a 64-byte boundary or a general-protection exception (#GP) will be generated. To move single-precision 
floating-point values to and from unaligned memory locations, use the VMOVUPD instruction. 


VEX.256 and EVEX.256 encoded versions: 


Moves 256 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a YMM register from a 256-bit memory 
location, to store the contents of a YMM register into a 256-bit memory location, or to move data between two YMM 
registers. When the source or destination operand is a memory operand, the operand must be aligned on a 32-byte 
boundary or a general-protection exception (#GP) will be generated. To move double-precision floating-point 
values to and from unaligned memory locations, use the VMOVUPD instruction. 

128-bit versions: 

Moves 128 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load an XMM register from a 128-bit memory 
location, to store the contents of an XMM register into a 128-bit memory location, or to move data between two 
XMM registers. When the source or destination operand is a memory operand, the operand must be aligned on a 
16-byte boundary or a general-protection exception (#GP) will be generated. To move single-precision floating- 
point values to and from unaligned memory locations, use the VMOVUPD instruction. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding ZMM destination register remain 
unchanged. 


(E)VEX.128 encoded version: Bits (MAXVL-1:128) of the destination ZMM register destination are zeroed. 


Operation 


VMOVAPD (EVEX encoded versions, register-copy form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VMOVAPD (EVEX encoded versions, store-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[i+63:i] 
ELSE 
ELSE *DEST[i+63:i] remains unchanged* ; merging-masking 


Fl; 
ENDFOR; 


VMOVAPD (EVEX encoded versions, load-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVAPD (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVAPD (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0)] 


VMOVAPD (VEX.128 encoded version, load - and register copy) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


MOVAPD (128-bit load- and register-copy- form Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


(V)MOVAPD (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


MOVAPD—Move Aligned Packed Double-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, M-U 


Vol.2B 4-47 


INSTRUCTION SET REFERENCE, M-U 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVAPD __m512d_mm512_load_pd( void * m); 

VMOVAPD __m512d_mm512_mask_load_pd(__m512ds,___mmask8 k, void * m); 
VMOVAPD __m512d_mm512_maskz_load_pd(__mmask8 k, void * m); 
VMOVAPD void __mm512_store_pd( void * d,__m512d a); 

VMOVAPD void __mm512_mask_store_pd( void * d,__ mmask8 k,__m512d a); 
VMOVAPD __m256d __mm256_mask_load_pd(__m256d s,___mmask8 k, void * m); 
VMOVAPD __m256d __mm256_maskz_load_pd(__mmask8 k, void * m); 
VMOVAPD void _mm256_mask_store_pd( void * d,__ mmask8 k,___ m256d a); 
VMOVAPD __m128d _mm_mask_load_pd(__m128d s,___mmask8 k, void * m); 
VMOVAPD __m128d_mm_maskz_load_pd(__mmask8 k, void * m); 

VMOVAPD void _mm_mask_store_pd( void * d,__ mmask8 k, __m128d a); 
MOVAPD __m256d __mm256_load_pd (double * p); 

MOVAPD void __mm256_store_pd(double * p,__m256d a); 

MOVAPD __m128d _mm_load_pd (double * p); 

MOVAPD void _mm_store_pd(double * p,__m128d a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Exceptions Type1.SSE2 in Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-44, “Type E1 Class Exception Conditions”. 

Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 
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MOVAPS—Move Aligned Packed Single-Precision Floating-Point Values 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support Flag 

NP OF 28 /r A VIV SSE Move aligned packed single-precision floating-point 

MOVAPS xmm1, xmm2/m128 values from xmm2/mem to xmm1. 

NP OF 29 /r B VIV SSE Move aligned packed single-precision floating-point 

MOVAPS xmm2/m1 28, xmm1 values from xmm1 to xmm2/mem. 

VEX.128.0F.WIG 28 /r A VIV AVX Move aligned packed single-precision floating-point 

VMOVAPS xmm1, xmm2/m128 values from xmm2/mem to xmm1. 

VEX.128.0F.WIG 29 /r B VIV AVX Move aligned packed single-precision floating-point 

VMOVAPS xmm2/m1 28, xmm1 values from xmm1 to xmm2/mem. 

VEX.256.0F.WIG 28 /r A VIV AVX Move aligned packed single-precision floating-point 

VMOVAPS ymm1, ymm2/m256 values from ymm2/mem to ymm1. 

VEX.256.0F.WIG 29 /r B VIV AVX Move aligned packed single-precision floating-point 

VMOVAPS ymm2/m256, ymm1 values from ymm1 to ymm2/mem. 

EVEX.128.0F.WO 28 /r C VIV AVX512VL | Move aligned packed single-precision floating-point 

VMOVAPS xmm1 {k1}{z}, xmm2/m128 AVX512F values from xmm2/m128 to xmm1 using 
writemask k1. 

EVEX.256.0F.WO 28 /r C VIV AVX512VL | Move aligned packed single-precision floating-point 

VMOVAPS ymm1 {k1}{z}, ymm2/m256 AVX512F values from ymm2/m256 to ymm1 using 
writemask k1. 

EVEX.512.0F.WO 28 /r C VIV AVX512F Move aligned packed single-precision floating-point 

VMOVAPS zmm1 {k1}{z}, zmm2/m512 values from zmm2/m512 to zmm1 using 
writemask k1. 

EVEX.128.0F.WO 29 /r D VIV AVX512VL | Move aligned packed single-precision floating-point 

VMOVAPS xmm2/m1 28 {k1}{z}, xmm1 AVX512F values from xmm1 to xmm2/m128 using 
writemask k1. 

EVEX.256.0F.WO 29 /r D VIV AVX512VL | Move aligned packed single-precision floating-point 

VMOVAPS ymm2/m256 {k1}{z}, ymm1 AVX512F values from ymm1 to ymm2/m256 using 
writemask k1. 

EVEX.512.0F.WO 29 /r D VIV AVX512F Move aligned packed single-precision floating-point 

VMOVAPS zmm2/m51 2 {k1}{z}, zmm1 values from zmm1 to zmm2/m512 using 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves 4, 8 or 16 single-precision floating-point values from the source operand (second operand) to the destina- 
tion operand (first operand). This instruction can be used to load an XMM, YMM or ZMM register from an 128-bit, 

256-bit or 512-bit memory location, to store the contents of an XMM, YMM or ZMM register into a 128-bit, 256-bit 
or 512-bit memory location, or to move data between two XMM, two YMM or two ZMM registers. 


When the source or destination operand is a memory operand, the operand must be aligned on a 16-byte (128-bit 
version), 32-byte (VEX.256 encoded version) or 64-byte (EVEX.512 encoded version) boundary or a general- 
protection exception (#GP) will be generated. For EVEX.512 encoded versions, the operand must be aligned to the 
size of the memory operand. To move single-precision floating-point values to and from unaligned memory loca- 
tions, use the VMOVUPS instruction. 
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Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
EVEX.512 encoded version: 


Moves 512 bits of packed single-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a ZMM register from a 512-bit float32 
memory location, to store the contents of a ZMM register into a float32 memory location, or to move data between 
two ZMM registers. When the source or destination operand is a memory operand, the operand must be aligned on 
a 64-byte boundary or a general-protection exception (#GP) will be generated. To move single-precision floating - 
point values to and from unaligned memory locations, use the VMOVUPS instruction. 


VEX.256 and EVEX.256 encoded version: 


Moves 256 bits of packed single-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a YMM register from a 256-bit memory 
location, to store the contents of a YMM register into a 256-bit memory location, or to move data between two YMM 
registers. When the source or destination operand is a memory operand, the operand must be aligned on a 32-byte 
boundary or a general-protection exception (#GP) will be generated. 

128-bit versions: 

Moves 128 bits of packed single-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load an XMM register from a 128-bit memory 
location, to store the contents of an XMM register into a 128-bit memory location, or to move data between two 
XMM registers. When the source or destination operand is a memory operand, the operand must be aligned on a 
16-byte boundary or a general-protection exception (#GP) will be generated. To move single-precision floating- 
point values to and from unaligned memory locations, use the VMOVUPS instruction. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding ZMM destination register remain 
unchanged. 


(E)VEX.128 encoded version: Bits (MAXVL-1:128) of the destination ZMM register are zeroed. 


Operation 


VMOVAPS (EVEX encoded versions, register-copy form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVAPS (EVEX encoded versions, store-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
SRC[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR; 
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VMOVAPS (EVEX encoded versions, load-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVAPS (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVAPS (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0)] 


VMOVAPS (VEX.128 encoded version, load - and register copy) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


MOVAPS (128-bit load- and register-copy- form Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


(V)MOVAPS (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVAPS __m512 _mm512_load_ps( void * m); 

VMOVAPS __m512_mm512_mask_load_ps(__m512 s,___mmask16 k, void * m); 
VMOVAPS __m512_mm512_maskz_load_ps(__mmask16 k, void * m); 
VMOVAPS void __mm512_store_ps( void * d,__m512 a); 

VMOVAPS void _mm512_mask_store_ps( void * d,__ mmask16 k,___m512 a); 
VMOVAPS __m256 _mm256_mask_load_ps(__m256 a,__mmask8 k, void * s); 
VMOVAPS __m256 _mm256_maskz_load_ps(__mmask8 k, void * s); 
VMOVAPS void _mm256_mask_store_ps( void * d,__ mmask8 k, __m256 a); 
VMOVAPS __m128 _mm_mask_load_ps(__m128 a,__ mmask8 k, void * s); 
VMOVAPS __m128_mm_maskz_load_ps(__mmask8 k, void * s); 

VMOVAPS void _mm_mask_store_ps( void * d,__ mmask8 k,___m128 a); 
MOVAPS __m256_mm256_load_ps (float * p); 

MOVAPS void __mm256_store_ps(float * p,__m256 a); 

MOVAPS __m128_mm_load_ps (float * p); 

MOVAPS void __mm_store_ps(float * p,__m128 a); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 


Non-EVEX-encoded instruction, see Exceptions Type1.SSE in Table 2-18, “Type 1 Class Exception Conditions”; 
additionally: 


#UD If VEX.vvvv != 1111B. 
EVEX-encoded instruction, see Table 2-44, “Type E1 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
OF 38 FO /r RM VIV MOVBE Reverse byte order in m16 and move to r16. 
MOVBE r16,m16 
OF 38 FO /r RM VV MOVBE Reverse byte order in m32 and move to r32. 
MOVBE r32, m32 
REX.W + OF 38 FO /r RM V/N.E. MOVBE Reverse byte order in m64 and move to r64. 
MOVBE r64, m64 
OF 38 F1 /r MR VIV MOVBE Reverse byte order in r76 and move to m16. 
MOVBE m16, r16 
OF 38 F1 /r MR VV MOVBE Reverse byte order in r32 and move to m32. 
MOVBE m32, r32 
REX.W + OF 38 F1 /r MR V/N.E. MOVBE Reverse byte order in r64 and move to m64. 
MOVBE m64, r64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Performs a byte swap operation on the data copied from the second operand (source operand) and store the result 
in the first operand (destination operand). The source operand can be a general-purpose register, or memory loca- 
tion; the destination register can be a general-purpose register, or a memory location; however, both operands can 
not be registers, and only one operand can be a memory location. Both operands must be the same size, which can 


be a word, a doubleword or quadword. 


The MOVBE instruction is provided for swapping the bytes on a read from memory or on a write to memory; thus 


providing support for converting little-endian values to big-endian format and vice versa. 


In 64-bit mode, the instruction's default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 
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Operation 
TEMP := SRC 


IF ( OperandSize = 16) 

THEN 
DEST[7:0] := TEMP[15:8]; 
DEST[15:8] := TEMP[7:0]; 

ELES IF (OperandSize = 32) 
DEST[7:0] := TEMP[31:24]; 
DEST[15:8] := TEMP[23:16]; 
DEST[23:16] := TEMP[1 5:8]; 
DEST[31:23] := TEMP[7:0]; 

ELSE IF ( OperandSize = 64) 
DEST[7:0] := TEMP[63:56]; 
DEST[15:8] := TEMP[55:48]; 
DEST[23:16] := TEMP[47:40]; 
DEST[31:24] := TEMP[39:32]; 
DEST[39:32] := TEMP[31:24]; 
DEST[47:40] := TEMP[23:16]; 
DEST[55:48] := TEMP[1 5:8]; 
DEST[63:56] := TEMP[7:0]; 


Fl; 


Flags Affected 


None 


Protected Mode Exceptions 

#GP(0) If the destination operand is in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If CPUID.01H:ECX.MOVBE[bit 22] = 0. 


If the LOCK prefix is used. 
If REP (F3H) prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If CPUID.01H:ECX.MOVBE[bit 22] = 0. 


If the LOCK prefix is used. 
If REP (F3H) prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If CPUID.01H:ECX.MOVBE[bit 22] = 0. 


If the LOCK prefix is used. 
If REP (F3H) prefix is used. 
If REPNE (F2H) prefix is used and CPUID.01H:ECX.SSE4_2[bit 20] = 0. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If the stack address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If CPUID.01H:ECX.MOVBE[bit 22] = 0. 


If the LOCK prefix is used. 
If REP (F3H) prefix is used. 
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MOVD/MOVQ—Move Doubleword/Move Quadword 


VMOVQ r64/m64, xmm1 


Opcode/ Op/ En | 64/32-bit | CPUID Description 
Instruction Mode Feature 
Flag 
NP OF 6€ /r A VIN MMX Move doubleword from r/m32 to mm. 
MOVD mm, r/m32 
NP REX.W + OF 6E /r A V/N.E. MMX Move quadword from r/m64 to mm. 
MOVQ mm, r/m64 
NP OF 7E /r B VIN MMX Move doubleword from mm to r/m32. 
MOVD r/m32, mm 
NP REX.W + OF 7E/r B V/N.E. MMX Move quadword from mm to r/m64. 
MOVQ r/m64, mm 
66 OF 6E /r A VIN SSE2 Move doubleword from r/m32 to xmm. 
MOVD xmm, r/m32 
66 REX.W OF 6E /r A V/N.E. SSE2 Move quadword from r/m64 to xmm. 
MOVQ xmm, r/m64 
66 OF 7E/r B VIV SSE2 Move doubleword from xmm register to r/m32. 
MOVD r/m32, xmm 
66 REX.W OF 7E /r B V/N.E. SSE2 Move quadword from xmm register to r/m64. 
MOVQ r/m64, xmm 
VEX.128.66.0F.WO 6E / A VIN AVX Move doubleword from r/m32 to xmm1. 
VMOVD xmm1, r32/m32 
VEX.128.66.0F.W1 6E /r A V/N.ET. AVX Move quadword from r/m64 to xmm1. 
VMOVQ xmm7, r64/m64 
VEX.128.66.0F.WO 7E /r B VIV AVX Move doubleword from xmm/1 register to r/m32. 
VMOVD r32/m32, xmm1 
VEX.128.66.0F.W1 7E /r B V/N.ET. AVX Move quadword from xmm1 register to r/m64. 
VMOVQ r64/m64, xmm1 
EVEX.128.66.0F.WO 6E /r C VV AVX512F | Move doubleword from r/m32 to xmm1. 
VMOVD xmm1, r32/m32 
EVEX.128.66.0F.W1 6E /r C VINE. AVX512F | Move quadword from r/m64 to xmm1. 
VMOVQ xmm1, r64/m64 
EVEX.128.66.0F.WO 7E /r D VIV AVX512F | Move doubleword from xmm1 register to r/m32. 
VMOVD r32/m32, xmm1 
EVEX.128.66.0F.W1 7E /r D VINE." AVX512F | Move quadword from xmm1 register to r/m64. 


NOTES: 


1. For this specific instruction, VEX.W/EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO ver- 


sion is used. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
D Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 


Description 


Copies a doubleword from the source operand (second operand) to the destination operand (first operand). The 
source and destination operands can be general-purpose registers, MMX technology registers, XMM registers, or 
32-bit memory locations. This instruction can be used to move a doubleword to and from the low doubleword of an 
MMX technology register and a general-purpose register or a 32-bit memory location, or to and from the low 
doubleword of an XMM register and a general-purpose register or a 32-bit memory location. The instruction cannot 
be used to transfer data between MMX technology registers, between XMM registers, between general-purpose 
registers, or between memory locations. 


When the destination operand is an MMX technology register, the source operand is written to the low doubleword 
of the register, and the register is zero-extended to 64 bits. When the destination operand is an XMM register, the 
source operand is written to the low doubleword of the register, and the register is zero-extended to 128 bits. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


MOVD/Q with XMM destination: 


Moves a dword/qword integer from the source operand and stores it in the low 32/64-bits of the destination XMM 
register. The upper bits of the destination are zeroed. The source operand can be a 32/64-bit register or 32/64-bit 
memory location. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain 
unchanged. Qword operation requires the use of REX.W=1. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. Qword operation requires the 
use of VEX.W=1. 


EVEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. Qword operation requires 
the use of EVEX.W=1. 


MOVD/Q with 32/64 reg/mem destination: 


Stores the low dword/qword of the source XMM register to 32/64-bit memory location or general-purpose register. 
Qword operation requires the use of REX.W=1, VEX.W=1, or EVEX.W=1. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


If VMOVD or VMOVQ is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will 
cause an #UD exception. 


Operation 


MOVD (when destination operand is MMX technology register) 
DEST[31:0] := SRC; 
DEST[63:32] := OOOOO000H; 


MOVD (when destination operand is XMM register) 
DEST[31:0] := SRC; 
DEST[127:32] := OOOOODDDD000000000000000H; 
DEST[MAXVL-1:128] (Unmodified) 
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MOVD (when source operand is MMX technology or XMM register) 
DEST := SRC[31:0]; 


VMOVD (VEX-encoded version when destination is an XMM register) 
DEST[31:0] := SRC[31:0] 
DEST[MAXVL-1:32] := 0 


MOVQ (when destination operand is XMM register) 
DEST[63:0] := SRC[63:0); 
DEST[127:64] := OOOOOODDD0000000H; 
DEST[MAXVL-1:128] (Unmodified) 


MOVQ (when destination operand is r/m64) 
DEST[63:0] := SRC[63:0); 


MOVQ (when source operand is XMM register or r/m64) 
DEST := SRC[63:0); 


VMOVQ (VEX-encoded version when destination is an XMM register) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVD (EVEX-encoded version when destination is an XMM register) 
DEST[31:0] := SRC[31:0] 
DEST[MAXVL-1:32] := 0 


VMOVQ (EVEX-encoded version when destination is an XMM register) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVD: m64 _mm_cvtsi32_si64 (int i) 

MOVD: int__mm_cvtsi64_si32 (__m64m ) 
MOVD: m128i _mm_cvtsi32_si128 (int a) 
MOVD: int __mm_cvtsi128_si32 (__m128i a) 
MOVaQ: int64 _mm_cvtsi128_si64(__m128i); 
MOVQ: m128i __mm_cvtsi64_si128(__int64); 
VMOVD m128i _mm_cvtsi32_si128( int); 
VMOVD int__mm_cvtsil28_si32(__m128i); 
VMOVQ m128i__mm_cvtsi64_si128 (__int64); 
VMOVQ int64 __mm_cvtsi128_si64(__m128i ); 
VMOVQ m128i __mm_loadl_epi64(__m128i * s); 
VMOVQ void __mm_storel_epi64(__m128i * d,__m128i s); 
Flags Affected 

None 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
Additionally: 
#UD If VEX.L = 1. 

If VEX.vvvv != 1111B or EVEX.vvvv != 11118. 
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MOVDDUP—Replicate Double FP Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
F2 OF 12 /r A VIV SSE3 Move double-precision floating-point value from 
MOVDDUP xmm1, xmm2/m64 xmm_2/m64 and duplicate into xmm1. 
VEX.128.F2.0F.WIG 12 /r A VV AVX Move double-precision floating-point value from 
VMOVDDUP xmm1, xmm2/m64 xmm_2/m64 and duplicate into xmm1. 
VEX.256.F2.0F.WIG 12 /r A VV AVX Move even index double-precision floating-point 
VMOVDDUP ymm1, ymm2/m256 values from ymm2/mem and duplicate each element 

into ymm1. 

EVEX.128.F2.0F.W1 12 /r B VIV AVX512VL | Move double-precision floating-point value from 
VMOVDDUP xmm1 {k1}{z}, AVX512F xmm2/m64 and duplicate each element into xmm1 
xmm2/m64 subject to writemask k1. 
EVEX.256.F2.0F.W1 12 /r B VV AVX512VL | Move even index double-precision floating-point 
VMOVDDUP ymm1 {k1}{Z}, AVX512F values from ymm2/m256 and duplicate each element 
ymm2/m256 into ymm1 subject to writemask k1. 
EVEX.512.F2.0F.W1 12 /r B VIV AVX512F Move even index double-precision floating-point 
VMOVDDUP zmm1 {k1}{z}, values from zmm2/m512 and duplicate each element 
zmm2/m512 into zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B MOVDDUP ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


For 256-bit or higher versions: Duplicates even-indexed double-precision floating-point values from the source 
operand (the second operand) and into adjacent pair and store to the destination operand (the first operand). 

For 128-bit versions: Duplicates the low double-precision floating-point value from the source operand (the second 
operand) and store to the destination operand (the first operand). 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register are unchanged. The 
source operand is XMM register or a 64-bit memory location. 

VEX.128 and EVEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. The source 
operand is XMM register or a 64-bit memory location. The destination is updated conditionally under the writemask 
for EVEX version. 

VEX.256 and EVEX.256 encoded version: Bits (MAXVL-1:256) of the destination register are zeroed. The source 
operand is YMM register or a 256-bit memory location. The destination is updated conditionally under the 
writemask for EVEX version. 

EVEX.512 encoded version: The destination is updated according to the writemask. The source operand is ZMM 
register or a 512-bit memory location. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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SRC X3 X2 
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DEST] X2 X2 
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Figure 4-2. VMOVDDUP Operation 


Operation 


VMOVDDUP (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
TMP_SRC[63:0] := SRC[63:0] 
TMP_SRC[1 27:64] := SRC[63:0] 
IF VL >= 256 
TMP_SRC[191:128] := SRC[191:128] 
TMP_SRC[255:192] := SRC[191:128] 
Fl; 
IF VL >= 512 
TMP_SRC[319:256] := SRC[319:256] 
TMP_SRC[383:320] := SRC[319:256] 
TMP_SRC[477:384] := SRC[477:384] 
TMP_SRC[511:484] := SRC[477:384] 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_SRC[i+63:i] 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDDUP (VEX.256 encoded version) 
DEST[63:0] := SRC[63:0] 

DEST[127:64] := SRC[63:0) 
DEST[191:128] := SRC[191:128] 
DEST[255:192] := SRC[191:128] 
DEST[MAXVL-1:256] := 0 


VMOVDDUP (VEX.128 encoded version) 
DEST[63:0] := SRC[63:0] 

DEST[127:64] := SRC[63:0) 
DEST[MAXVL-1:128] := 0 
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MOVDDUP (128-bit Legacy SSE version) 
DEST[63:0] := SRC[63:0] 

DEST[127:64] := SRC[63:0] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVDDUP 


m512d 


mm512_movedup_pd(__m512d a); 


VMOVDDUP 


m512d 


mm512_mask_movedup_pd(__m512ds,___mmask8 k,__m512d a); 


VMOVDDUP 


m512d 


mm512_maskz_movedup_pd(__mmask8 k,___m512d a); 


VMOVDDUP 


m256d 


VMOVDDUP 


m256d 


mm256_mask_movedup_pd(__m256d s,___ mmask8 k, __ m256d a); 
mm256_maskz_movedup_pd(__mmask8 k, __m256d a); 


VMOVDDUP 


m128d 


mm_mask_movedup_pd(__m128d s,___mmask8 k,___m128d a); 


VMOVDDUP 


m128d 


mm_maskz_movedup_pd(__mmask8 k, __m128d a); 


MOVDDUP __m256d_mm256_movedup_pd (__m256d a); 


MOVDDUP __m128d_mm_movedup_pd (__m128d a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-52, “Type E5NF Class Exception Conditions”. 


Additionally: 
#UD 
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MOVDIRI—Move Doubleword as Direct Store 


Opcode/ Op/ 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF 38 F9 /r A VIV MOVDIRI Move doubleword from r32 to m32 using direct store. 
MOVDIRI m32, r32 
NP REX.W + OF 38 F9 /r A V/N.E. MOVDIRI Move quadword from r64 to m64 using direct store. 
MOVDIRI m64, r64 


Instruction Operand Encoding! 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the doubleword integer in the source operand (second operand) to the destination operand (first operand) 
using a direct-store operation. The source operand is a general purpose register. The destination operand is a 32- 
bit memory location. In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix 
permits access to additional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See 
summary chart at the beginning of this section for encoding data and limits. 


The direct-store is implemented by using write combining (WC) memory type protocol for writing data. Using this 
protocol, the processor does not write the data into the cache hierarchy, nor does it fetch the corresponding cache 
line from memory into the cache hierarchy. If the destination address is cached, the line is written-back (if modi- 
fied) and invalidated from the cache, before the direct-store. Unlike stores with non-temporal hint that allow 
uncached (UC) and write-protected (WP) memory-type for the destination to override the non-temporal hint, 
direct-stores always follow WC memory type protocol irrespective of the destination address memory type 
(including UC and WP types). 


Unlike WC stores and stores with non-temporal hint, direct-stores are eligible for immediate eviction from the 
write-combining buffer, and thus not combined with younger stores (including direct-stores) to the same address. 
Older WC and non-temporal stores held in the write-combing buffer may be combined with younger direct stores 
to the same address. Direct stores are weakly ordered relative to other stores. Software that desires stronger 
ordering should use a fencing instruction (MFENCE or SFENCE) before or after a direct store to enforce the ordering 
desired. 


Direct-stores issued by MOVDIRI to a destination aligned to a 4-byte boundary (8-byte boundary if used with 
REX.W prefix) guarantee 4-byte (8-byte with REX.W prefix) write-completion atomicity. This means that the data 
arrives at the destination in a single undivided 4-byte (or 8-byte) write transaction. If the destination is not aligned 
for the write size, the direct-stores issued by MOVDIRI are split and arrive at the destination in two parts. Each part 
of such split direct-store will not merge with younger stores but can arrive at the destination in either order. Avail- 
ability of the MOVDIRI instruction is indicated by the presence of the CPUID feature flag MOVDIRI (bit 27 of the 
ECX register in leaf 07H, see “CPUID—CPU Identification” in the Intel® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 2A). 


Operation 
DEST := SRC; 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVDIRI void _directstoreu_u32(void *dst, uint32_t val) 
MOVDIRI void _directstoreu_u64(void *dst, uint64_t val) 


1. The Mod field of the ModR/M byte cannot have value 11B. 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 
#PF (fault-code) For a page fault. 
#UD If CPUID.O7H.OH:ECX.MOVDIRI[bit 27] = 0. 
If LOCK prefix or operand-size (66H) prefix is used. 
#AC If alignment checking is enabled and an unaligned memory reference made while in current 


privilege level 3. 


Real-Address Mode Exceptions 
#GP If any part of the operand lies outside the effective address space from 0 to FFFFH. 
#UD If CPUID.07H.OH:ECX.MOVDIRI[bit 27] = 0. 

If LOCK prefix or operand-size (66H) prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 
#PF (fault-code) For a page fault. 


#AC If alignment checking is enabled and an unaligned memory reference made while in current 
privilege level 3. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If memory address referencing the SS segment is in non-canonical form. 
#GP(0) If the memory address is in non-canonical form. 
#PF (fault-code) For a page fault. 
#UD If CPUID.O7H.OH:ECX.MOVDIRI[bit 27] = 0. 
If LOCK prefix or operand-size (66H) prefix is used. 
#AC If alignment checking is enabled and an unaligned memory reference made while in current 


privilege level 3. 
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MOVDIR64B—Move 64 Bytes as Direct Store 


Opcode/ Op/ 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
66 OF 38 F8 /r A VIV MOVDIR64B | Move 64-bytes as direct-store with guaranteed 64- 
MOVDIR64B r16/r32/r64, m512 byte write atomicity from the source memory operand 
address to destination memory address specified as 
offset to ES segment in the register operand. 


Instruction Operand Encoding! 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Moves 64-bytes as direct-store with 64-byte write atomicity from source memory address to destination memory 
address. The source operand is a normal memory operand. The destination operand is a memory location specified 
in a general-purpose register. The register content is interpreted as an offset into ES segment without any segment 
override. In 64-bit mode, the register operand width is 64-bits (32-bits with 67H prefix). Outside of 64-bit mode, 
the register width is 32-bits when CS.D=1 (16-bits with 67H prefix), and 16-bits when CS.D=0 (32-bits with 67H 
prefix). MOVDIR64B requires the destination address to be 64-byte aligned. No alignment restriction is enforced 
for source operand. 


MOVDIR64B first reads 64-bytes from the source memory address. It then performs a 64-byte direct-store opera- 
tion to the destination address. The load operation follows normal read ordering based on source address memory- 
type. The direct-store is implemented by using the write combining (WC) memory type protocol for writing data. 
Using this protocol, the processor does not write the data into the cache hierarchy, nor does it fetch the corre- 
sponding cache line from memory into the cache hierarchy. If the destination address is cached, the line is written- 
back (if modified) and invalidated from the cache, before the direct-store. 


Unlike stores with non-temporal hint which allow UC/WP memory-type for destination to override the non-temporal 
hint, direct-stores always follow WC memory type protocol irrespective of destination address memory type 
(including UC/WP types). Unlike WC stores and stores with non-temporal hint, direct-stores are eligible for imme- 
diate eviction from the write-combining buffer, and thus not combined with younger stores (including direct-stores) 
to the same address. Older WC and non-temporal stores held in the write-combing buffer may be combined with 
younger direct stores to the same address. Direct stores are weakly ordered relative to other stores. Software that 
desires stronger ordering should use a fencing instruction (MFENCE or SFENCE) before or after a direct store to 
enforce the ordering desired. 


There is no atomicity guarantee provided for the 64-byte load operation from source address, and processor imple- 
mentations may use multiple load operations to read the 64-bytes. The 64-byte direct-store issued by MOVDIR64B 
guarantees 64-byte write-completion atomicity. This means that the data arrives at the destination in a single 
undivided 64-byte write transaction. 


Availability of the MOVDIR64B instruction is indicated by the presence of the CPUID feature flag MOVDIR64B (bit 
28 of the ECX register in leaf 07H, see “CPUID—CPU Identification” in the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 2A). 


Operation 
DEST := SRC; 


Intel C/C++ Compiler Intrinsic Equivalent 
MOVDIR64B void _movdir64b(void *dst, const void* src) 


1. The Mod field of the ModR/M byte cannot have value 11B. 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
If address in destination (register) operand is not aligned to a 64-byte boundary. 

#SS(0) For an illegal address in the SS segment. 

#PF (fault-code) For a page fault. 

#UD If CPUID.07H.OH:ECX.MOVDIR64B[bit 28] = 0. 


If LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If any part of the operand lies outside the effective address space from 0 to FFFFH. 
If address in destination (register) operand is not aligned to a 64-byte boundary. 
#UD If CPUID.07H.OH:ECX.MOVDIR64B[bit 28] = 0. 


If LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 
#PF (fault-code) For a page fault. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If memory address referencing the SS segment is in non-canonical form. 
#GP(0) If the memory address is in non-canonical form. 

If address in destination (register) operand is not aligned to a 64-byte boundary. 
#PF (fault-code) For a page fault. 
#UD If CPUID.07H.OH:ECX.MOVDIR64B[bit 28] = 0. 

If LOCK prefix is used. 
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MOVDQA,VMOVDQA32/64—Move Aligned Packed Integer Values 


VMOVDQA64 zmm2/m512 {k1}{Z}, 
zmm1 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bitMode | Feature 

Support Flag 
66 OF 6F /r A VIV SSE2 Move aligned packed integer values from 
MOVDQA xmm1, xmm2/m128 xmm2/mem to xmm1. 
66 OF 7F /r B VIV SSE2 Move aligned packed integer values from xmm1 
MOVDQA xmm2/m1 28, xmm1 to xmm2/mem. 
VEX.128.66.0F.WIG 6F /r A VIV AVX Move aligned packed integer values from 
VMOVDOA xmm1, xmm2/m128 xmm2/mem to xmm1. 
VEX.128.66.0F.WIG 7F /r B VIV AVX Move aligned packed integer values from xmm1 
VMOVDOA xmm2/m1 28, xmm1 to xmm2/mem. 
VEX.256.66.0F.WIG 6F /r A VIV AVX Move aligned packed integer values from 
VMOVDQA ymm1, ymm2/m256 ymm2/mem to ymm1. 
VEX.256.66.0F.WIG 7F /r B VIV AVX Move aligned packed integer values from ymm1 
VMOVDOQA ymm2/m256, ymm1 to ymm2/mem. 
EVEX.128.66.0F.WO 6F /r C VIV AVX512VL | Move aligned packed doubleword integer values 
VMOVDQA32 xmm1 {k1}{2}, AVX512F from xmm2/m128 to xmm1 using writemask 
xmm2/m128 k1, 
EVEX.256.66.0F.WO 6F /r C VIN AVX512VL_ | Move aligned packed doubleword integer values 
VMOVDQA32 ymm1 {k1}{z}, AVX512F from ymm2/m256 to ymm1 using writemask 
ymm2/m256 k1, 
EVEX.512.66.0F.WO 6F /r C VIV AVX512F Move aligned packed doubleword integer values 
VMOVDQA32 zmm1 {k1}{Z}, from zmm2/m512 to zmm1 using writemask k1. 
zmm2/m512 
EVEX.128.66.0F.WO 7F /r D VIV AVX512VL | Move aligned packed doubleword integer values 
VMOVDQA32 xmm2/m128 {k1}{Z}, AVX512F from xmm1 to xmm2/m128 using writemask 
xmm1 k1. 
EVEX.256.66.0F.WO 7F /r D VIV AVX512VL | Move aligned packed doubleword integer values 
VMOVDQA32 ymm2/m256 {k1}{Z}, AVX512F from ymm1 to ymm2/m256 using writemask 
ymm1 k1. 
EVEX.512.66.0F.WO 7F /r D VIV AVX512F Move aligned packed doubleword integer values 
VMOVDQA32 zmm2/m512 {k1}{Z}, from zmm1 to zmm2/m512 using writemask k1. 
zmm1 
EVEX.128.66.0F.W1 6F /r C VIV AVX512VL | Move aligned packed quadword integer values 
VMOVDQA64 xmm1 {k1}{2}, AVX512F from xmm2/m128 to xmm1 using writemask 
xmm2/m128 k1, 
EVEX.256.66.0F.W1 6F /r C VIV AVX512VL | Move aligned packed quadword integer values 
VMOVDQA64 ymm1 {k1}{2}, AVX512F from ymm2/m256 to ymm1 using writemask 
ymm2/m256 k1. 
EVEX.512.66.0F.W1 6F /r C VIV AVX512F Move aligned packed quadword integer values 
VMOVDQA64 zmm1 {k1}{Z}, from zmm2/m512 to zmm1 using writemask k1. 
zmm2/m512 
EVEX.128.66.0F.W1 7F /r D VIV AVX512VL | Move aligned packed quadword integer values 
VMOVDQA64 xmm2/m1 28 {k1}{Z}, AVX512F from xmm1 to xmm2/m128 using writemask 
xmm1 k1, 
EVEX.256.66.0F.W1 7F /r D VIV AVX512VL | Move aligned packed quadword integer values 
VMOVDQA64 ymm2/m256 {k1}{Z}, AVX512F from ymm1 to ymm2/m256 using writemask 
ymm1 k1. 
EVEX.512.66.0F.W1 7F /r D VIV AVX512F Move aligned packed quadword integer values 


from zmm1 to zmm2/m512 using writemask k1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
EVEX encoded versions: 


Moves 128, 256 or 512 bits of packed doubleword/quadword integer values from the source operand (the second 
operand) to the destination operand (the first operand). This instruction can be used to load a vector register from 
an int32/int64 memory location, to store the contents of a vector register into an int32/int64 memory location, or 
to move data between two ZMM registers. When the source or destination operand is a memory operand, the 
operand must be aligned on a 16 (EVEX.128)/32(EVEX.256)/64(EVEX.512)-byte boundary or a general-protection 
exception (#GP) will be generated. To move integer data to and from unaligned memory locations, use the 
VMOVDQU instruction. 


The destination operand is updated at 32-bit (VMOVDQA32) or 64-bit (VMOVDQA64) granularity according to the 
writemask. 
VEX.256 encoded version: 


Moves 256 bits of packed integer values from the source operand (second operand) to the destination operand 
(first operand). This instruction can be used to load a YMM register from a 256-bit memory location, to store the 
contents of a YMM register into a 256-bit memory location, or to move data between two YMM registers. 


When the source or destination operand is a memory operand, the operand must be aligned on a 32-byte boundary 
or a general-protection exception (#GP) will be generated. To move integer data to and from unaligned memory 
locations, use the VMOVDQU instruction. Bits (MAXVL-1:256) of the destination register are zeroed. 

128-bit versions: 


Moves 128 bits of packed integer values from the source operand (second operand) to the destination operand 
(first operand). This instruction can be used to load an XMM register from a 128-bit memory location, to store the 
contents of an XMM register into a 128-bit memory location, or to move data between two XMM registers. 


When the source or destination operand is a memory operand, the operand must be aligned on a 16-byte boundary 
or a general-protection exception (#GP) will be generated. To move integer data to and from unaligned memory 
locations, use the VMOVDQU instruction. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding ZMM destination register remain 
unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. 
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Operation 


VMOVDQA32 (EVEX encoded versions, register-copy form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQA32 (EVEX encoded versions, store-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR; 


VMOVDQA32 (EVEX encoded versions, load-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VMOVDQA64 (EVEX encoded versions, register-copy form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQAG4 (EVEX encoded versions, store-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 
ELSE *DEST[i+63:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR; 


VMOVDQAG4 (EVEX encoded versions, load-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQA (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVDQA (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0)] 


VMOVDQA (VEX.128 encoded version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


VMOVDQA (128-bit load- and register-copy- form Legacy SSE version) 


DEST[127:0] = SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 
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(V)MOVDQA (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVDQA32 __m512i_mm512_load_epi32( void * sa); 

VMOVDQA32 __m512i_mm512_mask_load_epi32(__m512i s, ___mmask16 k, void * sa); 
VMOVDQA32 __m512i_mm512_maskz_load_epi32(__mmask16 k, void * sa); 
VMOVDQA32 void _mm512_store_epi32(void * d,__m512i a); 

VMOVDQA32 void _mm512_mask_store_epi32(void * d,___ mmask16 k, __m512i a); 
VMOVDQA32 __m256i__mm256_mask_load_epi32(__m256i s, __mmask8 k, void * sa); 
VMOVDQA32 __m256i__mm256_maskz_load_epi32(__mmask8 k, void * sa); 
VMOVDQA32 void _mm256_store_epi32(void * d,___m256i a); 

VMOVDQA32 void __mm256_mask_store_epi32(void * d, __mmask8 k, __m256i a); 
VMOVDQA32 __m128i __mm_mask_load_epi32(__m128i s,___mmask8 k, void * sa); 
VMOVDQA32 __m128i __mm_maskz_load_epi32(__mmask8 k, void * sa); 
VMOVDQA32 void __mm_store_epi32(void * d,__m128i a); 

VMOVDQA32 void __mm_mask_store_epi32(void * d,___mmask8 k, __m128i a); 
VMOVDQA64 __m512i_mm512_load_epi64( void * sa); 

VMOVDQA64 __m512i_mm512_mask_load_epi64(__m512i s, __mmask8 k, void * sa); 
VMOVDQA64 __m512i_mm512_maskz_load_epi64(__mmask8 k, void * sa); 
VMOVDQA64 void _mm512_store_epi64(void * d,__m512i a); 

VMOVDQA64 void __mm512_mask_store_epi64(void * d, __ mmask8 k, __m512i a); 
VMOVDQA64 __m256i __mm256_mask_load_epi64(__m256i s, __mmask8 k, void * sa); 
VMOVDQA64 __m256i __mm256_maskz_load_epi64(__mmask8 k, void * sa); 
VMOVDQA64 void _mm256_store_epi64(void * d,___m256i a); 

VMOVDQA64 void _mm256_mask_store_epi64(void * d, __ mmask8 k, __m256i a); 
VMOVDQA64 __m128i __mm_mask_load_epi64(__m128i s,__mmask8 k, void * sa); 
VMOVDQA64 __m128i __mm_maskz_load_epi64(__mmask8 k, void * sa); 
VMOVDQA64 void _mm_store_epi64(void * d,__m128i a); 

VMOVDQA64 void _mm_mask_store_epi64(void * d, __mmask8 k, __m128i a); 
MOVDQA void __m256i __mm256_load_si256 (__m256i * p); 

MOVDQA _mm256_store_si256(_m256i *p, __m256i a); 

MOVDQA __m128i __mm_load_si128 (__m128i * p); 

MOVDQA void __mm_store_si128(__m128i *p,___m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Exceptions Type1.SSE2 in Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-44, “Type E1 Class Exception Conditions”. 

Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 
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MOVDQU, VVMOVDQU8/16/32/64—Move Unaligned Packed Integer Values 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 

F3 OF 6F /r A VIV SSE2 Move unaligned packed integer values from 

MOVDQU xmm1, xmm2/m128 xmm2/m128 to xmm1. 

F3 OF 7F /r B VIV SSE2 Move unaligned packed integer values from 

MOVDQU xmm2/m128, xmm1 xmm1 to xmm2/m128. 

VEX.128.F3.0F.WIG 6F /r A VIV AVX Move unaligned packed integer values from 

VMOVDQU xmm1, xmm2/m128 xmm2/m128 to xmm1. 

VEX.128.F3.0F.WIG 7F /r B VIV AVX Move unaligned packed integer values from 

VMOVDQU xmm2/m1 28, xmm1 xmm1 to xmm2/m128. 

VEX.256.F3.0F.WIG 6F /r A VIV AVX Move unaligned packed integer values from 

VMOVDQU ymm1, ymm2/m256 ymm2/m256 to ymm1. 

VEX.256.F3.0F.WIG 7F /r B VIV AVX Move unaligned packed integer values from 

VMOVDQU ymm2/m256, ymm1 ymm1 to ymnm2/m256. 

EVEX.128.F2.0F.WO 6F /r C VIV AVX512VL_ | Move unaligned packed byte integer values 

VMOVDQU8 xmm1 {k1}{z}, xmm2/m128 AVX512BW | from xmm2/m128 to xmm1 using writemask 
k1. 

EVEX.256.F2.0F.WO 6F /r C VIV AVX512VL_ | Move unaligned packed byte integer values 

VMOVDQU8 ymm1 {k1}{z}, ymm2/m256 AVX512BW | from ymm2/m256 to ymm1 using writemask 
k1. 

EVEX.512.F2.0F.WO 6F /r C VIV AVX512BW | Move unaligned packed byte integer values 

VMOVDQU8 zmm1 {k1}{z}, zmm2/m512 from zmm2/m512 to zmm1 using writemask 
k1. 

EVEX.128.F2.0F.WO 7F /r D VIV AVX512VL_ | Move unaligned packed byte integer values 

VMOVDQU8 xmm2/m1 28 {k1}{z}, xmm1 AVX512BW | from xmm1 to xmm2/m128 using writemask 
k1. 

EVEX.256.F2.0F.WO 7F /r D VV AVX512VL | Move unaligned packed byte integer values 

VMOVDQU8 ymm2/m256 {k1}{z}, ymm1 AVX512BW | from ymm1 to ymm2/m256 using writemask 
k1. 

EVEX.512.F2.0F.WO 7F /r D VV AVX512BW | Move unaligned packed byte integer values 

VMOVDQU8 zmm2/m512 {k1}{z}, zmm1 from zmm1 to zmm2/m512 using writemask 
k1, 

EVEX.128.F2.0F.W1 6F /r C VIV AVX512VL_ | Move unaligned packed word integer values 

VMOVDQU16 xmm1 {k1}{z}, xmm2/m128 AVX512BW | from xmm2/m128 to xmm1 using writemask 
k1. 

EVEX.256.F2.0F.W1 6F /r C VIV AVX512VL_ | Move unaligned packed word integer values 

VMOVDQU16 ymm1 {k1}{z}, ymnm2/m256 AVX512BW | from ymm2/m256 to ymm1 using writemask 
k1. 

EVEX.512.F2.0F.W1 6F /r C VV AVX512BW | Move unaligned packed word integer values 

VMOVDQU16 zmm1 {k1}{z}, zmm2/m512 from zmm2/m512 to zmm1 using writemask 
k1, 

EVEX.128.F2.0F.W1 7F /r D VV AVX512VL_ | Move unaligned packed word integer values 

VMOVDQU16 xmm2/m1 28 {k1}{z}, xmm1 AVX512BW | from xmm1 to xmm2/m128 using writemask 
k1, 

EVEX.256.F2.0F.W1 7F /r D VIV AVX512VL_ | Move unaligned packed word integer values 

VMOVDQU16 ymm2/m256 {k1}{z}, ymm1 AVX512BW | from ymm1 to ymm2/m256 using writemask 
k1. 

EVEX.512.F2.0F.W1 7F /r D VIV AVX512BW | Move unaligned packed word integer values 

VMOVDQU16 zmm2/m512 {k1}{z}, zmm1 from zmm1 to zmm2/m512 using writemask 
k1. 

EVEX.128.F3.0F.WO 6F /r C VIV AVX512VL_ | Move unaligned packed doubleword integer 

VMOVDQU32 xmm1 {k1}{Z}, AVX512F values from xmm2/m128 to xmm1 using 

xmm2/mm128 writemask k1. 
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VMOVDQU64 zmm2/m512 {k1}{z}, zmm1 


Instruction Operand Encoding 


Opcode/ Op/En 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 

EVEX.256.F3.0F.WO 6F /r C VIV AVX512VL | Move unaligned packed doubleword integer 

VMOVDQU32 ymm1 {k1}{z}, ymnm2/m256 AVX512F values from ymm2/m256 to ymm1 using 
writemask k1. 

EVEX.512.F3.0F.WO 6F /r C VV AVX512F Move unaligned packed doubleword integer 

VMOVDQU32 zmm1 {k1}{z}, zmm2/m512 values from zmm2/m512 to zmm1 using 
writemask k1. 

EVEX.128.F3.0F.WO 7F /r D VV AVX512VL | Move unaligned packed doubleword integer 

VMOVDQU32 xmm2/m1 28 {k1}{z}, xmm1 AVX512F values from xmm1 to xmm2/m128 using 
writemask k1. 

EVEX.256.F3.0F.WO 7F /r D VV AVX512VL | Move unaligned packed doubleword integer 

VMOVDQU32 ymm2/m256 {k1}{z}, ymm1 AVX512F values from ymm1 to ymm2/m256 using 
writemask k1. 

EVEX.512.F3.0F.WO 7F /r D VIV AVX512F Move unaligned packed doubleword integer 

VMOVDQU32 zmm2/m512 {k1}{z}, zmm1 values from zmm1 to zmm2/m512 using 
writemask k1. 

EVEX.128.F3.0F.W1 6F /r C VV AVX512VL | Move unaligned packed quadword integer 

VMOVDQU64 xmm1 {k1}{z}, xmm2/m128 AVX512F values from xmm2/m1 28 to xmm1 using 
writemask k1. 

EVEX.256.F3.0F.W1 6F /r C VIV AVX512VL | Move unaligned packed quadword integer 

VMOVDQU64 ymm1 {k1}{z}, ymm2/m256 AVX512F values from ymm2/m256 to ymm1 using 
writemask k1. 

EVEX.512.F3.0F.W1 6F /r C VV AVX512F Move unaligned packed quadword integer 

VMOVDQU64 zmm1 {k1}{z}, zmm2/m512 values from zmm2/m512 to zmm1 using 
writemask k1. 

EVEX.128.F3.0F.W1 7F /r D VV AVX512VL | Move unaligned packed quadword integer 

VMOVDQU64 xmm2/m1 28 {k1}{z}, xmm1 AVX512F values from xmm1 to xmm2/m128 using 
writemask k1. 

EVEX.256.F3.0F.W1 7F /r D VIV AVX512VL | Move unaligned packed quadword integer 

VMOVDQU64 ymm2/m256 {k1}{z}, ymm1 AVX512F values from ymm1 to ymm2/m256 using 
writemask k1. 

EVEX.512.F3.0F.W1 7F /r D VIV AVX512F Move unaligned packed quadword integer 


values from zmm1 to zmm2/m512 using 
writemask k1. 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


EVEX encoded versions: 


Moves 128, 256 or 512 bits of packed byte/word/doubleword/quadword integer values from the source operand 
(the second operand) to the destination operand (first operand). This instruction can be used to load a vector 


register from a memory location, to store the contents of a vector register into a memory location, or to move data 


between two vector registers. 
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The destination operand is updated at 8-bit (VMOVDQU8), 16-bit (VMOVDQU16), 32-bit (VMOVDQU32), or 64-bit 
(VMOVDQU64) granularity according to the writemask. 


VEX.256 encoded version: 


Moves 256 bits of packed integer values from the source operand (second operand) to the destination operand 
(first operand). This instruction can be used to load a YMM register from a 256-bit memory location, to store the 
contents of a YMM register into a 256-bit memory location, or to move data between two YMM registers. 


Bits (MAXVL-1:256) of the destination register are zeroed. 


128-bit versions: 


Moves 128 bits of packed integer values from the source operand (second operand) to the destination operand 
(first operand). This instruction can be used to load an XMM register from a 128-bit memory location, to store the 
contents of an XMM register into a 128-bit memory location, or to move data between two XMM registers. 
128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 


When the source or destination operand is a memory operand, the operand may be unaligned to any alignment 
without causing a general-protection exception (#GP) to be generated 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. 


Operation 


VMOVDQU8 (EVEX encoded versions, register-copy form) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SRC[i+7:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+7:i] remains unchanged* 
ELSE DEST[i+7:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU8 (EVEX encoded versions, store-form) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = 
SRC[i+7:i] 
ELSE *DEST[i+7:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR; 
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VMOVDQU8 (EVEX encoded versions, load-form) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SRC[i+7:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE DEST[i+7:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU16 (EVEX encoded versions, register-copy form) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] := SRC[i+15:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE DEST[i+15:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU16 (EVEX encoded versions, store-form) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = 
SRC[i+15:i] 
ELSE *DEST[i+1 5:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR; 
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VMOVDQU16 (EVEX encoded versions, load-form) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SRC[i+15:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE DEST[i+15:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU32 (EVEX encoded versions, register-copy form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU32 (EVEX encoded versions, store-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
SRC[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR; 
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VMOVDQU32 (EVEX encoded versions, load-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU64 (EVEX encoded versions, register-copy form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQUG64 (EVEX encoded versions, store-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 
ELSE *DEST[i+63:i] remains unchanged* ; merging-masking 


Fl; 
ENDFOR; 
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VMOVDQU64 (EVEX encoded versions, load-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVDQU (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVDQU (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0) 


VMOVDQU (VEX.128 encoded version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


VMOVDQU (128-bit load- and register-copy- form Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


(V)MOVDQU (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVDQU16 __m512i_mm512_mask_loadu_epi16(__m512is, __mmask32 k, void * sa); 
VMOVDQU16 __m512i_mm512_maskz_loadu_epi16(___mmask32 k, void * sa); 
VMOVDQU16 void __mm512_mask_storeu_epi1 6(void * d,___ mmask32 k, __m512i a); 
VMOVDQU16 __m256i__mm256_mask_loadu_epi16(__m256i s,__mmask16 k, void * sa); 
VMOVDQU16 __m256i__mm256_maskz_loadu_epi16(_mmask16 k, void * sa); 
VMOVDQU16 void __mm256_mask_storeu_epi1 6(void * d,___ mmask16 k, __m256i a); 
VMOVDQU16 __m128i__mm_mask_loadu_epi16(__m128i s, __mmask8 k, void * sa); 
VMOVDQU16 __m128i __mm_maskz_loadu_epi16(__mmask8 k, void * sa); 
VMOVDQU16 void _mm_mask_storeu_epi16(void * d, __ mmask8 k, __m128i a); 
VMOVDQU32 __m512i_mm512_loadu_epi32( void * sa); 

VMOVDQU32 __m512i_mm512_mask_loadu_epi32(__m512is,___mmask16 k, void * sa); 
VMOVDQU32 __m512i_mm512_maskz_loadu_epi32(__mmask16 k, void * sa); 
VMOVDQU32 void _mm512_storeu_epi32(void * d,__m512i a); 

VMOVDQU32 void __mm512_mask_storeu_epi32(void * d,__mmask16 k, __m512i a); 
VMOVDQU32 __m256i __mm256_mask_loadu_epi32(__m256i s,___mmask8 k, void * sa); 
VMOVDQU32 __m256i __mm256_maskz_loadu_epi32(__mmask8 k, void * sa); 
VMOVDQU32 void _mm256_storeu_epi32(void * d,___m256i a); 

VMOVDQU32 void __mm256_mask_storeu_epi32(void * d, __mmask8 k, __m256i a); 
VMOVDQU32 __m128i__mm_mask_loadu_epi32(__m128i s, __ mmask8 k, void * sa); 
VMOVDQU32 __m128i __mm_maskz_loadu_epi32(__mmask8 k, void * sa); 
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VMOVDQU32 void __mm_storeu_epi32(void * d, __m128i a); 

VMOVDQU32 void _mm_mask_storeu_epi32(void * d,__ mmask8 k, __m128i a); 
VMOVDQU64 __m512i_mm512_loadu_epi64( void * sa); 

VMOVDQU64 __m512i_mm512_mask_loadu_epi64(__m512is,___mmask8 k, void * sa); 
VMOVDQU64 __m512i_mm512_maskz_loadu_epi64(__mmask8 k, void * sa); 
VMOVDQU64 void _mm512_storeu_epi64(void * d,__m512i a); 

VMOVDQU64 void __mm512_mask_storeu_epi64(void * d,___mmask8 k, __m512i a); 
VMOVDQU64 __m256i__mm256_mask_loadu_epi64(__m256i s,___mmask8 k, void * sa); 
VMOVDQU64 __m256i__mm256_maskz_loadu_epi64(__mmask8 k, void * sa); 
VMOVDQU64 void __mm256_storeu_epi64(void * d,___m256i a); 

VMOVDQU64 void _mm256_mask_storeu_epi64(void * d, __mmask8 k, __m256i a); 
VMOVDQU64 __m128i __mm_mask_loadu_epi64(__m128i s, __mmask8 k, void * sa); 
VMOVDQU64 __m128i __mm_maskz_loadu_epi64(__mmask8 k, void * sa); 
VMOVDQU64 void _mm_storeu_epi64(void * d,__m128i a); 

VMOVDQU64 void _mm_mask_storeu_epi64(void * d,__ mmask8 k, __m128i a); 
VMOVDQU8 __m512i__mm512_mask_loadu_epi8(__m512i s,___mmask64 k, void * sa); 
VMOVDQU8 __m512i__mm512_maskz_loadu_epi8(___mmask64 k, void * sa); 
VMOVDQU8 void _mm512_mask_storeu_epi8(void * d,___ mmask64 k, __m512i a); 
VMOVDQU8 __m256i _mm256_mask_loadu_epi8(__m256i s, __mmask32 k, void * sa); 
VMOVDQU8 __m256i _mm256_maskz_loadu_epi8(__mmask32 k, void * sa); 
VMOVDQU8 void _mm256_mask_storeu_epi8(void * d,___ mmask32 k, __m256i a); 
VMOVDQU8 __m128i _mm_mask_loadu_epi8(__m128i s, ___mmask16 k, void * sa); 
VMOVDQU8 __m128i _mm_maskz_loadu_epi8(__mmask16 k, void * sa); 

VMOVDQU8 void _mm_mask_storeu_epi8(void * d,___ mmask16 k, __m128i a); 
MOVDQU __m256i __mm256_loadu_si256 (__m256i * p); 

MOVDQU _mm256_storeu_si256(_m256i *p, __m256i a); 

MOVDQU __m128i __mm_loadu_si128 (__m128i * p); 

MOVDQU _mm_storeu_si1 28(__m128i *p,___m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 


MOVDQU,VMOVDQU8/1 6/32/64—Move Unaligned Packed Integer Values Vol.2B 4-79 


INSTRUCTION SET REFERENCE, M-U 


MOVDQ2Q—Move Quadword from XMM to MMX Technology Register 


Opcode Instruction Op/ 64-Bit Compat/ Description 
En Mode Leg Mode 
F2 OF D6 /r MOVDQ2Q mm, xmm RM Valid Valid Move low quadword from xmm to mmx 
register. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 

Description 


Moves the low quadword from the source operand (second operand) to the destination operand (first operand). The 
source operand is an XMM register and the destination operand is an MMX technology register. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the MOVDQ2Q instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 
DEST := SRC[63:0]; 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVDQ2Q: __m64 _mm_movepi64_pi64 (__m128i a) 


SIMD Floating-Point Exceptions 
None. 


Protected Mode Exceptions 


#NM If CRO.TS[bit 3] = 1. 
#UD If CRO.EM[bit 2] = 1. 
If CR4.OSFXSR[bit 9] = 0. 
If CPUID.O1H:EDX.SSE2[bit 26] = 0. 
If the LOCK prefix is used. 
#MF If there is a pending x87 FPU exception. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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MOVHLPS—Move Packed Single-Precision Floating-Point Values High to Low 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
NP OF 12 /r RM VIV SSE Move two packed single-precision floating-point values 
MOVHLPS xmm1, xmm2 from high quadword of xmm2 to low quadword of xmm1. 
VEX.128.0F.WIG 12 /r RVM | V/V AVX Merge two packed single-precision floating-point values 
VMOVHLPS xmm1, xmm2, xmm3 from high quadword of xmm3 and low quadword of xmmz. 
EVEX.128.0F.WO 12 /r RVM | V/V AVX512F Merge two packed single-precision floating-point values 
VMOVHLPS xmm1, xmm2, xmm3 from high quadword of xmm3 and low quadword of xmme. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction cannot be used for memory to register moves. 

128-bit two-argument form: 

Moves two packed single-precision floating-point values from the high quadword of the second XMM argument 
(second operand) to the low quadword of the first XMM register (first argument). The quadword at bits 127:64 of 
the destination operand is left unchanged. Bits (MAXVL-1:128) of the corresponding destination register remain 
unchanged. 

128-bit and EVEX three-argument form 

Moves two packed single-precision floating-point values from the high quadword of the third XMM argument (third 
operand) to the low quadword of the destination (first operand). Copies the high quadword from the second XMM 
argument (second operand) to the high quadword of the destination (first operand). Bits (MAXVL-1:128) of the 
corresponding destination register are zeroed. 

If VMOVHLPS is encoded with VEX.L or EVEX.LL= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 


Operation 


MOVHLPS (128-bit two-argument form) 
DEST[63:0] := SRC[127:64] 
DEST[MAXVL-1:64] (Unmodified) 


VMOVHLPS (128-bit three-argument form - VEX & EVEX) 
DEST[63:0] := SRC2[127:64] 

DEST[127:64] := SRC1[127:64] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVHLPS __m128_mm_movehl_ps(__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
None 


1. ModRM.MOD = 011B required 
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Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-24, “Type 7 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 


EVEX-encoded instruction, see Exceptions Type E7NM.128 in Table 2-55, “Type E7NM Class Exception Conditions”. 
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MOVHPD—Move High Packed Double-Precision Floating-Point Value 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
66 OF 16 /r A VIV SSE2 Move double-precision floating-point value from m64 
MOVHPD xmm1, m64 to high quadword of xmm1. 
VEX.128.66.0F.WIG 16 /r B VIV AVX Merge double-precision floating-point value from m64 
VMOVHPD xmm2, xmm1, m64 and the low quadword of xmm1. 
EVEX.128.66.0F.W1 16 /r D VIV AVX512F | Merge double-precision floating-point value from m64 
VMOVHPD xmm2, xmm1, m64 and the low quadword of xmm1. 
66 OF 17 /r C VIV SSE2 Move double-precision floating-point value from high 
MOVHPD m64, xmm1 quadword of xmm1 to m64. 
VEX.128.66.0F.WIG 17 /r C VIV AVX Move double-precision floating-point value from high 
VMOVHPD m64, xmm1 quadword of xmm1 to m64. 
EVEX.128.66.0F.W1 17 /r E VIV AVX512F | Move double-precision floating-point value from high 
VMOVHPD m64, xmm1 quadword of xmm1 to m64. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C NA ModRM:r/m (w) ModRM:reg (r) NA NA 
D Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
E Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


This instruction cannot be used for register to register or memory to memory moves. 


128-bit Legacy SSE load: 


Moves a double-precision floating-point value from the source 64-bit memory operand and stores it in the high 64- 
bits of the destination XMM register. The lower 64bits of the XMM register are preserved. Bits (MAXVL-1:128) of the 
corresponding destination register are preserved. 

VEX.128 & EVEX encoded load: 

Loads a double-precision floating-point value from the source 64-bit memory operand (the third operand) and 
stores it in the upper 64-bits of the destination XMM register (first operand). The low 64-bits from the first source 
operand (second operand) are copied to the low 64-bits of the destination. Bits (MAXVL-1:128) of the corre- 
sponding destination register are zeroed. 

128-bit store: 


Stores a double-precision floating-point value from the high 64-bits of the XMM register source (second operand) 
to the 64-bit memory location (first operand). 

Note: VMOVHPD (store) (VEX.128.66.0F 17 /r) is legal and has the same behavior as the existing 66 OF 17 store. 
For VMOVHPD (store) VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will #UD. 


If VMOVHPD is encoded with VEX.L or EVEX.L’L= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 
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Operation 


MOVHPD (128-bit Legacy SSE load) 
DEST[63:0] (Unmodified) 
DEST[127:64] := SRC[63:0] 
DEST[MAXVL-1:128] (Unmodified) 


VMOVHPD (VEX.128 & EVEX encoded load) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[MAXVL-1:128] := 0 


VMOVHPD (store) 
DEST[63:0] := SRC[127:64] 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVHPD __m128d_mm_loadh_pd (__m128d a, double *p) 
MOVHPD void _mm_storeh_pd (double *p,__m128d a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 

EVEX-encoded instruction, see Table 2-57, “Type EONF Class Exception Conditions”. 
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MOVHPS—Move High Packed Single-Precision Floating-Point Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
NP OF 16 /r A VIV SSE Move two packed single-precision floating-point values 
MOVHPS xmm1, m64 from m64 to high quadword of xmm1. 
VEX.128.0F.WIG 16 /r B VIV AVX Merge two packed single-precision floating-point values 
VMOVHPS xmm2, xmm1, m64 from m64 and the low quadword of xmm1. 
EVEX.128.0F.WO 16 /r D VIV AVX512F Merge two packed single-precision floating-point values 
VMOVHPS xmm2, xmm1, m64 from m64 and the low quadword of xmm1. 
NP OF 17 /r C VIV SSE Move two packed single-precision floating-point values 
MOVHPS m64, xmm1 from high quadword of xmm1 to m64. 
VEX.128.0F.WIG 17 /r C VIV AVX Move two packed single-precision floating-point values 
VMOVHPS m64, xmm1 from high quadword of xmm1 to m64. 
EVEX.128.0F.WO 17 /r E VIV AVX512F Move two packed single-precision floating-point values 
VMOVHPS m64, xmm1 from high quadword of xmm1 to m64. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C NA ModRM:r/m (w) ModRM:reg (r) NA NA 
D Tuple2 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
E Tuple2 ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


This instruction cannot be used for register to register or memory to memory moves. 
128-bit Legacy SSE load: 


Moves two packed single-precision floating-point values from the source 64-bit memory operand and stores them 
in the high 64-bits of the destination XMM register. The lower 64bits of the XMM register are preserved. Bits 
(MAXVL-1:128) of the corresponding destination register are preserved. 


VEX.128 & EVEX encoded load: 


Loads two single-precision floating-point values from the source 64-bit memory operand (the third operand) and 
stores it in the upper 64-bits of the destination XMM register (first operand). The low 64-bits from the first source 
operand (the second operand) are copied to the lower 64-bits of the destination. Bits (MAXVL-1:128) of the corre- 
sponding destination register are zeroed. 


128-bit store: 


Stores two packed single-precision floating-point values from the high 64-bits of the XMM register source (second 
operand) to the 64-bit memory location (first operand). 


Note: VMOVHPS (store) (VEX.128.0F 17 /r) is legal and has the same behavior as the existing OF 17 store. For 
VMOVHPS (store) VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will #UD. 


If VMOVHPS is encoded with VEX.L or EVEX.L’L= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 
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Operation 


MOVHPS (128-bit Legacy SSE load) 
DEST[63:0] (Unmodified) 
DEST[127:64] := SRC[63:0] 
DEST[MAXVL-1:128] (Unmodified) 


VMOVHPS (VEX.128 and EVEX encoded load) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[MAXVL-1:128] := 0 


VMOVHPS (store) 
DEST[63:0] := SRC[127:64] 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVHPS __m128 _mm_loadh_pi (__m128 a,__m64 *p) 
MOVHPS void _mm_storeh_pi (__m64 *p,_m128 a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 

EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
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MOVLHPS—Move Packed Single-Precision Floating-Point Values Low to High 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
NP OF 16 /r RM VIV SSE Move two packed single-precision floating-point values from 
MOVLHPS xmm1, xmm2 low quadword of xmm_2 to high quadword of xmm1. 
VEX.128.0F.WIG 16 /r RVM | V/V AVX Merge two packed single-precision floating-point values 
VMOVLHPS xmm1, xmm2, xmm3 from low quadword of xmm3 and low quadword of xmm2. 
EVEX.128.0F.WO 16 /r RVM | V/V AVX512F Merge two packed single-precision floating-point values 
VMOVLHPS xmm1, xmm2, xmm3 from low quadword of xmm3 and low quadword of xmmz. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction cannot be used for memory to register moves. 

128-bit two-argument form: 

Moves two packed single-precision floating-point values from the low quadword of the second XMM argument 
(second operand) to the high quadword of the first XMM register (first argument). The low quadword of the desti- 
nation operand is left unchanged. Bits (MAXVL-1:128) of the corresponding destination register are unmodified. 
128-bit three-argument forms: 

Moves two packed single-precision floating-point values from the low quadword of the third XMM argument (third 
operand) to the high quadword of the destination (first operand). Copies the low quadword from the second XMM 
argument (second operand) to the low quadword of the destination (first operand). Bits (MAXVL-1:128) of the 
corresponding destination register are zeroed. 


If VMOVLHPS is encoded with VEX.L or EVEX.L'L= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 


Operation 


MOVLHPS (128-bit two-argument form) 
DEST[63:0] (Unmodified) 

DEST[127:64] := SRC[63:0] 
DEST[MAXVL-1:128] (Unmodified) 


VMOVLHPS (128-bit three-argument form - VEX & EVEX) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVLHPS __m128_mm_movelh_ps(__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
None 


1. ModRM.MOD = 011B required 
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Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-24, “Type 7 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 


EVEX-encoded instruction, see Exceptions Type E7NM.128 in Table 2-55, “Type E7NM Class Exception Conditions”. 
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MOVLPD—Move Low Packed Double-Precision Floating-Point Value 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 
66 OF 12 /r A VIV SSE2 Move double-precision floating-point value from m64 to 
MOVLPD xmm1, m64 low quadword of xmm1. 
VEX.128.66.0F.WIG 12 /r B VIV AVX Merge double-precision floating-point value from m64 
VMOVLPD xmmz, xmm1, m64 and the high quadword of xmm1. 
EVEX.128.66.0F.W1 12 /r D VIV AVX512F Merge double-precision floating-point value from m64 
VMOVLPD xmmz, xmm1, m64 and the high quadword of xmm1. 
66 OF 13/r C VIV SSE2 Move double-precision floating-point value from low 
MOVLPD m64, xmm1 quadword of xmm1 to m64. 
VEX.128.66.0F.WIG 13/r C VIV AVX Move double-precision floating-point value from low 
VMOVLPD m64, xmm1 quadword of xmm1 to m64. 
EVEX.128.66.0F.W1 13/r E VIV AVX512F Move double-precision floating-point value from low 
VMOVLPD m64, xmm1 quadword of xmm1 to m64. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:r/m (r) VEX.vvvv (r) ModRM:r/m (r) NA 

C NA ModRM:r/m (w) ModRM:reg (r) NA NA 

D Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

E Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 

Description 


This instruction cannot be used for register to register or memory to memory moves. 
128-bit Legacy SSE load: 


Moves a double-precision floating-point value from the source 64-bit memory operand and stores it in the low 64- 
bits of the destination XMM register. The upper 64bits of the XMM register are preserved. Bits (MAXVL-1:128) of the 
corresponding destination register are preserved. 

VEX.128 & EVEX encoded load: 


Loads a double-precision floating-point value from the source 64-bit memory operand (third operand), merges it 
with the upper 64-bits of the first source XMM register (second operand), and stores it in the low 128-bits of the 
destination XMM register (first operand). Bits (MAXVL-1:128) of the corresponding destination register are zeroed. 
128-bit store: 


Stores a double-precision floating-point value from the low 64-bits of the XMM register source (Second operand) to 
the 64-bit memory location (first operand). 

Note: VMOVLPD (store) (VEX.128.66.0F 13 /r) is legal and has the same behavior as the existing 66 OF 13 store. 
For VMOVLPD (store) VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will #UD. 


If VMOVLPD is encoded with VEX.L or EVEX.L’L= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 


Operation 


MOVLPD (128-bit Legacy SSE load) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 
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VMOVLPD (VEX.128 & EVEX encoded load) 
DEST[63:0] := SRC2[63:0] 

DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VMOVLPD (store) 
DEST[63:0] := SRC[63:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVLPD __m128d _mm_loadl_pd (__m128d a, double *p) 
MOVLPD void __mm_storel_pd (double *p,___m128d a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 
EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
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MOVLPS—Move Low Packed Single-Precision Floating-Point Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
NP OF 12 /r A VIV SSE Move two packed single-precision floating-point values 
MOVLPS xmm1, m64 from m64 to low quadword of xmm1. 
VEX.128.0F.WIG 12 /r B VIV AVX Merge two packed single-precision floating-point values 
VMOVLPS xmm_2, xmm1, m64 from m64 and the high quadword of xmm1. 
EVEX.128.0F.WO 12 /r D VIV AVX512F Merge two packed single-precision floating-point values 
VMOVLPS xmm_2, xmm1, m64 from m64 and the high quadword of xmm1. 
OF 13/r C VIV SSE Move two packed single-precision floating-point values 
MOVLPS m64, xmm1 from low quadword of xmm1 to m64. 
VEX.128.0F.WIG 13/r C VIV AVX Move two packed single-precision floating-point values 
VMOVLPS m64, xmm1 from low quadword of xmm1 to m64. 
EVEX.128.0F.WO 13/r E VIV AVX512F Move two packed single-precision floating-point values 


VMOVLPS m64, xmm1 from low quadword of xmm1 to m64. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C NA ModRM:r/m (w) ModRM:reg (r) NA NA 
D Tuple2 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
E Tuple2 ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


This instruction cannot be used for register to register or memory to memory moves. 

128-bit Legacy SSE load: 

Moves two packed single-precision floating-point values from the source 64-bit memory operand and stores them 
in the low 64-bits of the destination XMM register. The upper 64bits of the XMM register are preserved. Bits 
(MAXVL-1:128) of the corresponding destination register are preserved. 

VEX.128 & EVEX encoded load: 

Loads two packed single-precision floating-point values from the source 64-bit memory operand (the third 
operand), merges them with the upper 64-bits of the first source operand (the second operand), and stores them 
in the low 128-bits of the destination register (the first operand). Bits (MAXVL-1:128) of the corresponding desti- 
nation register are zeroed. 

128-bit store: 

Loads two packed single-precision floating-point values from the low 64-bits of the XMM register source (second 
operand) to the 64-bit memory location (first operand). 


Note: VMOVLPS (store) (VEX.128.0F 13 /r) is legal and has the same behavior as the existing OF 13 store. For 
VMOVLPS (store) VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will #UD. 


If VMOVLPS is encoded with VEX.L or EVEX.L’L= 1, an attempt to execute the instruction encoded with VEX.L or 
EVEX.L’L= 1 will cause an #UD exception. 
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Operation 


MOVLPS (128-bit Legacy SSE load) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


VMOVLPS (VEX.128 & EVEX encoded load) 
DEST[63:0] := SRC2[63:0] 

DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VMOVLPS (store) 
DEST[63:0] := SRC[63:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVLPS __m128_mm_loadl_pi(__m128 a, __m64 *p) 
MOVLPS void __mm_storel_pi (__m64 *p,__m128 a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 

EVEX-encoded instruction, see Table 2-57, “Type EONF Class Exception Conditions”. 
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MOVMSKPD—Extract Packed Double-Precision Floating-Point Sign Mask 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
66 OF 50 /r RM |V/V SSE2 Extract 2-bit sign mask from xmm and store in reg. The 
MOVMSKPD reg, xmm upper bits of r32 or r64 are filled with zeros. 
VEX.128.66.0F.WIG 50 /r RM |V/V AVX Extract 2-bit sign mask from xmmZ2 and store in reg. 
VMOVMSKPD reg, xmm2 The upper bits of r32 or r64 are zeroed. 
VEX.256.66.0F.WIG 50 /r RM |V/V AVX Extract 4-bit sign mask from ymm2 and store in reg. 
VMOVMSKPD reg, ynm2 The upper bits of r32 or r64 are zeroed. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Extracts the sign bits from the packed double-precision floating-point values in the source operand (second 
operand), formats them into a 2-bit mask, and stores the mask in the destination operand (first operand). The 
source operand is an XMM register, and the destination operand is a general-purpose register. The mask is stored 
in the 2 low-order bits of the destination operand. Zero-extend the upper bits of the destination. 


In 64-bit mode, the instruction can access additional registers (XMM8-XMM15, R8-R15) when used with a REX.R 
prefix. The default operand size is 64-bit in 64-bit mode. 


128-bit versions: The source operand is a YMM register. The destination operand is a general purpose register. 


VEX.256 encoded version: The source operand is a YMM register. The destination operand is a general purpose 
register. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


(V)MOVMSKPD (128-bit versions) 
DEST[O] := SRC[63] 
DEST[1] := SRC[127] 
IF DEST = r32 
THEN DEST[31:2] := 0; 
ELSE DEST[63:2] := 0; 
Fl 


VMOVMSKPD (VEX.256 encoded version) 
DEST[O] := SRC[63] 
DEST[1] := SRC[127] 
DEST[2Z] := SRC[191] 
DEST[3] := SRC[255] 
IF DEST = r32 
THEN DEST[31:4] := 0; 
ELSE DEST[63:4] := 0; 
Fl 
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Intel C/C++ Compiler Intrinsic Equivalent 


MOVMSKPD: int __mm_movemask_pd (__m128d a) 
VMOVMSKPD: _mm256_movemask_pd(__m256d a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-24, “Type 7 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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MOVMSKPS—Extract Packed Single-Precision Floating-Point Sign Mask 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
NP OF 50 /r RM |V/V SSE Extract 4-bit sign mask from xmm and store in reg. 
MOVMSKPS reg, xmm The upper bits of r32 or r64 are filled with zeros. 
VEX.128.0F.WIG 50 /r RM | V/V AVX Extract 4-bit sign mask from xmm2 and store in reg. 
VMOVMSKPS reg, xmm2 The upper bits of r32 or r64 are zeroed. 
VEX.256.0F.WIG 50 /r RM | V/V AVX Extract 8-bit sign mask from ymm2 and store in reg. 
VMOVMSKPS reg, ymm2 The upper bits of r32 or 164 are zeroed. 


Instruction Operand Encoding! 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Extracts the sign bits from the packed single-precision floating-point values in the source operand (second 
operand), formats them into a 4- or 8-bit mask, and stores the mask in the destination operand (first operand). 
The source operand is an XMM or YMM register, and the destination operand is a general-purpose register. The 
mask is stored in the 4 or 8 low-order bits of the destination operand. The upper bits of the destination operand 
beyond the mask are filled with zeros. 


In 64-bit mode, the instruction can access additional registers (XMM8-XMM15, R8-R15) when used with a REX.R 
prefix. The default operand size is 64-bit in 64-bit mode. 


128-bit versions: The source operand is a YMM register. The destination operand is a general purpose register. 
VEX.256 encoded version: The source operand is a YMM register. The destination operand is a general purpose 
register. 

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


DEST[O] := SRC[31]; 
DEST[1] := SRC[63}; 
DEST[2] := SRC[95]; 
DEST[3] := SRC[127]; 


IF DEST = r32 
THEN DEST[31:4] := ZeroExtend; 
ELSE DEST[63:4] := ZeroExtend; 
Fl; 


1. ModRM.MOD = 011B required 
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(V)MOVMSKPS (128-bit version) 
DEST[O] := SRC[31] 
DEST[1] := SRC[63] 
DEST[2] := SRC[95] 
DEST[3] := SRC[127] 
IF DEST = r32 
THEN DEST[31:4] := 0; 
ELSE DEST[63:4] := 0; 
Fl 


VMOVMSKPS (VEX.256 encoded version) 
DEST[O] := SRC[31] 
DEST[1] := SRC[63] 
DEST[2Z] := SRC[95] 
DEST[3] := SRC[127] 
DEST[4] := SRC[159] 
DEST[5] := SRC[191] 
DEST[6] := SRC[223] 
DEST[7] := SRC[255] 
IF DEST = r32 

THEN DEST[31:8] := 0; 

ELSE DEST[63:8] := 0; 
Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


int __mm_movemask_ps(__m128 a) 
int __mm256_movemask_ps(__m256 a) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-24, “Type 7 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv # 1111B. 
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MOVNTDQA—Load Double Quadword Non-Temporal Aligned Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature Flag 

Support 
66 OF 38 2A /r A VIV SSE4_1 Move double quadword from m128 to xmm1 using non- 
MOVNTDQA xmm1, m128 temporal hint if WC memory type. 
VEX.128.66.0F38.WIG 2A /r A VIV AVX Move double quadword from m128 to xmm using non- 
VMOVNTDOA xmm1, m128 temporal hint if WC memory type. 
VEX.256.66.0F38.WIG 2A /r A VIV AVX2 Move 256-bit data from m256 to ymm using non-temporal 
VMOVNTDQA ymm1, m256 hint if WC memory type. 
EVEX.128.66.0F38.W0 2A /r B VIV AVX512VL Move 128-bit data from m128 to xmm using non-temporal 
VMOVNTDOA xmm1, m128 AVX512F hint if WC memory type. 
EVEX.256.66.0F38.W0 2A /r B VIV AVX512VL Move 256-bit data from m256 to ymm using non-temporal 
VMOVNTDQA ymm1, m256 AVX512F hint if WC memory type. 
EVEX.512.66.0F38.W0 2A /r B VIV AVX512F Move 512-bit data from m512 to zmm using non-temporal 
VMOVNTDOQA zmm1, m512 hint if WC memory type. 


Instruction Operand Encoding! 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


MOVNTDQA loads a double quadword from the source operand (second operand) to the destination operand (first 
operand) using a non-temporal hint if the memory source is WC (write combining) memory type. For WC memory 
type, the nontemporal hint may be implemented by loading a temporary internal buffer with the equivalent of an 
aligned cache line without filling this data to the cache. Any memory-type aliased lines in the cache will be snooped 
and flushed. Subsequent MOVNTDQA reads to unread portions of the WC cache line will receive data from the 
temporary internal buffer if data is available. The temporary internal buffer may be flushed by the processor at any 
time for any reason, for example: 


e A load operation other than a MOVNTDQA which references memory already resident in a temporary internal 
buffer. 


e Anon-WC reference to memory already resident in a temporary internal buffer. 
e Interleaving of reads and writes to a single temporary internal buffer. 

e Repeated (V)MOVNTDQA loads of a particular 16-byte item in a streaming line. 
e Certain micro-architectural conditions including resource shortages, detection of 
a mis-speculation condition, and various fault conditions 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when reading the 
data from memory. Using this protocol, the processor does not read the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
read can override the non-temporal hint, if the memory address specified for the non-temporal read is not a WC 
memory region. Information on non-temporal reads and writes can be found in “Caching of Temporal vs. Non- 
Temporal Data” in Chapter 10 in the Intel® 64 and IA-32 Architecture Software Developer’s Manual, Volume 3A. 


Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
a MFENCE instruction should be used in conjunction with MOVNTDQA instructions if multiple processors might use 
different memory types for the referenced memory locations or to synchronize reads of a processor with writes by 
other agents in the system. A processor’s implementation of the streaming load hint does not override the effective 
memory type, but the implementation of the hint is processor dependent. For example, a processor implementa- 
tion may choose to ignore the hint and process the instruction as a normal MOVDQA for any memory type. Alter- 


1. ModRM.MOD != 011B 
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natively, another implementation may optimize cache reads generated by MOVNTDQA on WB memory type to 
reduce cache evictions. 


The 128-bit (V)MOVNTDQA addresses must be 16-byte aligned or the instruction will cause a #GP. 
The 256-bit VMOVNTDQA addresses must be 32-byte aligned or the instruction will cause a #GP. 
The 512-bit VMOVNTDQA addresses must be 64-byte aligned or the instruction will cause a #GP. 


Operation 


MOVNTDQA (128bit- Legacy SSE form) 
DEST := SRC 
DEST[MAXVL-1:128] (Unmodified) 


VMOVNTDQA (VEX.128 and EVEX.128 encoded form) 
DEST := SRC 
DEST[MAXVL-1:128] := 0 


VMOVNTDQA (VEX.256 and EVEX.256 encoded forms) 
DEST[255:0] := SRC[255:0) 
DEST[MAXVL-1:256] := 0 


VMOVNTDQA (EVEX.512 encoded form) 
DEST[51 1:0] := SRC[51 1:0) 
DEST[MAXVL-1:512] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VMOVNTDQA __m512i__mm512_stream_load_si512(__m512i const* p); 
MOVNTDQA __m128i __mm_stream_load_si1 28 (const __m128i *p); 
VMOVNTDQA __m256i __mm256_stream_load_si256 (__m256i const* p); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-45, “Type E1NF Class Exception Conditions”. 
Additionally: 


#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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MOVNTDQ-—Store Packed Integers Using Non-Temporal Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature Flag 

Support 
66 OF E7 /r A VV SSE2 Move packed integer values in xmm1 to m128 using non- 
MOVNTDQ m128, xmm1 temporal hint. 
VEX.128.66.0F.WIG E7 /r A VIV AVX Move packed integer values in xmm1 to m128 using non- 
VMOVNTDQ m128, xmm1 temporal hint. 
VEX.256.66.0F.WIG E7 /r A VV AVX Move packed integer values in ymm1 to m256 using non- 
VMOVNTDQ m256, ymm1 temporal hint. 
EVEX.128.66.0F.WO E7 /r B VIV AVX512VL Move packed integer values in xmm1 to m128 using non- 
VMOVNTDQ m1 28, xmm1 AVX512F temporal hint. 
EVEX.256.66.0F.WO E7 /r B VIV AVX512VL Move packed integer values in zmm1 to m256 using non- 
VMOVNTDQ m256, ymm1 AVX512F temporal hint. 
EVEX.512.66.0F.WO E7 /r B VV AVX512F Move packed integer values in zmm1 to m512 using non- 
VMOVNTDQ m512, zmm1 temporal hint. 


Instruction Operand Encoding! 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) NA NA 
B Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the packed integers in the source operand (second operand) to the destination operand (first operand) using 
a non-temporal hint to prevent caching of the data during the write to memory. The source operand is an XMM 
register, YMM register or ZMM register, which is assumed to contain integer data (packed bytes, words, double- 
words, or quadwords). The destination operand is a 128-bit, 256-bit or 512-bit memory location. The memory 
operand must be aligned on a 16-byte (128-bit version), 32-byte (VEX.256 encoded version) or 64-byte (512-bit 
version) boundary otherwise a general-protection exception (#GP) will be generated. 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when writing the 
data to memory. Using this protocol, the processor does not write the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
written to can override the non-temporal hint, if the memory address specified for the non-temporal store is in an 
uncacheable (UC) or write protected (WP) memory region. For more information on non-temporal stores, see 
“Caching of Temporal vs. Non-Temporal Data” in Chapter 10 in the IA-32 Intel Architecture Software Developer's 
Manual, Volume 1. 


Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
the SFENCE or MFENCE instruction should be used in conjunction with VMOVNTDQ instructions if multiple proces- 
sors might use different memory types to read/write the destination memory locations. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, VEX.L must be 0; otherwise instructions will 
#UD. 


Operation 


VMOVNTDQ(EVEX encoded versions) 
VL = 128, 256,512 

DEST[VL-1:0] := SRC[VL-1:0] 
DEST[MAXVL-1:VL] := 0 


1. ModRM.MOD != 011B 
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MOVNTDQ (Legacy and VEX versions) 
DEST := SRC 


Intel C/C++ Compiler Intrinsic Equivalent 

VMOVNTDQ void _mm512_stream_si512(void * p,_m512i a); 
VMOVNTDQ void __mm256_stream_si256 (__m256i * p,__m256i a); 
MOVNTDQ void _mm_stream_si128 (__m128i * p, ___m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Exceptions Type1.SSE2 in Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-45, “Type E1NF Class Exception Conditions”. 

Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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MOVNTI—Store Doubleword Using Non-Temporal Hint 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF C3 /r MR | V/V SSE2 Move doubleword from r32 to m32 using non-temporal 
MOVNTI m32, r32 hint. 
NP REX.W + OF C3 /r MR | V/N.E. SSE2 Move quadword from r64 to m64 using non-temporal 
MOVNTI m64, r64 hint. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the doubleword integer in the source operand (second operand) to the destination operand (first operand) 
using a non-temporal hint to minimize cache pollution during the write to memory. The source operand is a 
general-purpose register. The destination operand is a 32-bit memory location. 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when writing the 
data to memory. Using this protocol, the processor does not write the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
written to can override the non-temporal hint, if the memory address specified for the non-temporal store is in an 
uncacheable (UC) or write protected (WP) memory region. For more information on non-temporal stores, see 
“Caching of Temporal vs. Non-Temporal Data” in Chapter 10 in the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1. 


Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
the SFENCE or MFENCE instruction should be used in conjunction with MOVNTI instructions if multiple processors 
might use different memory types to read/write the destination memory locations. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 
DEST := SRC; 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVNTI: void __mm_stream_si32 (int *p, int a) 
MOVNTI: void _mm_stream_si64(__int64 *p, __int64 a) 


SIMD Floating-Point Exceptions 
None. 


Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
#SS(0) For an illegal address in the SS segment. 

#PF(fault-code) For a page fault. 

#UD If CPUID.01H:EDX.SSE2[bit 26] = 0. 


If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP 
#UD 


If any part of the operand lies outside the effective address space from 0 to FFFFH. 
If CPUID.O1H:EDX.SSE2[bit 26] = 0. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in real address mode. 


#PF(fault-code) 


For a page fault. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 

#GP(0) 
#PF(fault-code) 
#UD 


#AC(0) 
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If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 

For a page fault. 

If CPUID.01H:EDX.SSE2[bit 26] = 0. 

If the LOCK prefix is used. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
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MOVNTPD-—Store Packed Double-Precision Floating-Point Values Using Non-Temporal Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
66 OF 2B /r A VV SSE2 Move packed double-precision values in xmm1 to m128 using 
MOVNTPD m128, xmm1 non-temporal hint. 
VEX.128.66.0F.WIG 2B /r A VV AVX Move packed double-precision values in xmm1 to m128 using 
VMOVNTPD m1 28, xmm1 non-temporal hint. 
VEX.256.66.0F.WIG 2B /r A VV AVX Move packed double-precision values in ymm1 to m256 using 
VMOVNTPD m256, ymm1 non-temporal hint. 
EVEX.128.66.0F.W1 2B /r B VIV AVX512VL Move packed double-precision values in xmm1 to m128 using 
VMOVNTPD m1 28, xmm1 AVX512F non-temporal hint. 
EVEX.256.66.0F.W1 2B /r B VIV AVX512VL Move packed double-precision values in ymm1 to m256 using 
VMOVNTPD m256, ymm1 AVX512F non-temporal hint. 
EVEX.512.66.0F.W1 2B /r B VV AVX512F Move packed double-precision values inzmm1 to m512 using 
VMOVNTPD m512, zmm1 non-temporal hint. 


Instruction Operand Encoding! 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) NA NA 
B Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the packed double-precision floating-point values in the source operand (second operand) to the destination 
operand (first operand) using a non-temporal hint to prevent caching of the data during the write to memory. The 
source operand is an XMM register, YMM register or ZMM register, which is assumed to contain packed double- 
precision, floating-pointing data. The destination operand is a 128-bit, 256-bit or 512-bit memory location. The 
memory operand must be aligned on a 16-byte (128-bit version), 32-byte (VEX.256 encoded version) or 64-byte 
(EVEX.512 encoded version) boundary otherwise a general-protection exception (#GP) will be generated. 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when writing the 
data to memory. Using this protocol, the processor does not write the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
written to can override the non-temporal hint, if the memory address specified for the non-temporal store is in an 
uncacheable (UC) or write protected (WP) memory region. For more information on non-temporal stores, see 
“Caching of Temporal vs. Non-Temporal Data” in Chapter 10 in the IA-32 Intel Architecture Software Developer's 
Manual, Volume 1. 


Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
the SFENCE or MFENCE instruction should be used in conjunction with MOVNTPD instructions if multiple processors 
might use different memory types to read/write the destination memory locations. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, VEX.L must be 0; otherwise instructions will 
#UD. 


Operation 


VMOVNTPD (EVEX encoded versions) 
VL = 128, 256,512 

DEST[VL-1:0] := SRC[VL-1:0] 
DEST[MAXVL-1:VL] := 0 


1. ModRM.MOD != 011B 
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MOVNTPD (Legacy and VEX versions) 
DEST := SRC 


Intel C/C++ Compiler Intrinsic Equivalent 

VMOVNTPD void _mm512_stream_pd(double * p,__m512d a); 
VMOVNTPD void _mm256_stream_pd (double * p,__m256d a); 
MOVNTPD void _mm_stream_pd (double * p,__m128d a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Exceptions Type1.SSE2 in Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-45, “Type E1NF Class Exception Conditions”. 

Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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MOVNTPS—Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
NP OF 2B /r A VIV SSE Move packed single-precision values xmm1 to mem using 
MOVNTPS m1 28, xmm1 non-temporal hint. 
VEX.128.0F.WIG 2B /r A VIV AVX Move packed single-precision values xmm1 to mem using 
VMOVNTPS m128, xmm1 non-temporal hint. 
VEX.256.0F.WIG 2B /r A VIV AVX Move packed single-precision values ymm1 to mem using 
VMOVNTPS m256, ymm1 non-temporal hint. 
EVEX.128.0F.WO 2B /r B VIV AVX512VL Move packed single-precision values in xmm1 to m128 
VMOVNTPS m128, xmm1 AVX512F using non-temporal hint. 
EVEX.256.0F.WO 2B /r B VIV AVX512VL Move packed single-precision values in ymm1 to m256 
VMOVNTPS m256, ymm1 AVX512F using non-temporal hint. 
EVEX.512.0F.WO 2B /r B VIV AVX512F Move packed single-precision values in zmm1 to m512 
VMOVNTPS m512, zmm1 using non-temporal hint. 


Instruction Operand Encoding! 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) NA NA 
B Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the packed single-precision floating-point values in the source operand (second operand) to the destination 
operand (first operand) using a non-temporal hint to prevent caching of the data during the write to memory. The 
source operand is an XMM register, YMM register or ZMM register, which is assumed to contain packed single-preci- 
sion, floating-pointing. The destination operand is a 128-bit, 256-bit or 512-bit memory location. The memory 
operand must be aligned on a 16-byte (128-bit version), 32-byte (VEX.256 encoded version) or 64-byte 
(EVEX.512 encoded version) boundary otherwise a general-protection exception (#GP) will be generated. 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when writing the 
data to memory. Using this protocol, the processor does not write the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
written to can override the non-temporal hint, if the memory address specified for the non-temporal store is in an 
uncacheable (UC) or write protected (WP) memory region. For more information on non-temporal stores, see 
“Caching of Temporal vs. Non-Temporal Data” in Chapter 10 in the IA-32 Intel Architecture Software Developer’s 
Manual, Volume 1. 

Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
the SFENCE or MFENCE instruction should be used in conjunction with MOVNTPS instructions if multiple processors 
might use different memory types to read/write the destination memory locations. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VMOVNTPS (EVEX encoded versions) 
VL = 128, 256,512 

DEST[VL-1:0] := SRC[VL-1:0] 
DEST[MAXVL-1:VL] := 0 


1. ModRM.MOD != 011B 
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MOVNTPS 
DEST := SRC 


Intel C/C++ Compiler Intrinsic Equivalent 

VMOVNTPS void_mm512_stream_ps(float * p,__m512d a); 
MOVNTPS void _mm_stream_ps (float * p,__m128d a); 
VMOVNTPS void _mm256_stream_ps (float * p,__m256 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Exceptions Type1.SSE in Table 2-18, “Type 1 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-45, “Type E1NF Class Exception Conditions”. 

Additionally: 

#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 


4-106 Vol. 2B MOVNTPS—Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint 


INSTRUCTION SET REFERENCE, M-U 


MOVNTQ—Store of Quadword Using Non-Temporal Hint 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
NP OF €7 /r MOVNTQ m64, mm MR_ | Valid Valid Move quadword from mm to m64 using non- 
temporal hint. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Moves the quadword in the source operand (second operand) to the destination operand (first operand) using a 
non-temporal hint to minimize cache pollution during the write to memory. The source operand is an MMX tech- 
nology register, which is assumed to contain packed integer data (packed bytes, words, or doublewords). The 
destination operand is a 64-bit memory location. 


The non-temporal hint is implemented by using a write combining (WC) memory type protocol when writing the 
data to memory. Using this protocol, the processor does not write the data into the cache hierarchy, nor does it 
fetch the corresponding cache line from memory into the cache hierarchy. The memory type of the region being 
written to can override the non-temporal hint, if the memory address specified for the non-temporal store is in an 
uncacheable (UC) or write protected (WP) memory region. For more information on non-temporal stores, see 
“Caching of Temporal vs. Non-Temporal Data” in Chapter 10 in the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1. 


Because the WC protocol uses a weakly-ordered memory consistency model, a fencing operation implemented with 
the SFENCE or MFENCE instruction should be used in conjunction with MOVNTQ instructions if multiple processors 
might use different memory types to read/write the destination memory locations. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
DEST := SRC; 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVNTQ: void _mm_stream_pi(__m64 * p,___m64 a) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 21-8, “Exception Conditions for Legacy SIMD/MMxX Instructions without FP Exception” in the Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 3A. 
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MOVQ—Move Quadword 


Opcode/ Op/ En | 64/32-bit | CPUID Description 
Instruction Mode Feature 
Flag 
NP OF 6F /r A VIV MMX Move quadword from mm/m64 to mm. 
MOVQ mm, mm/m64 
NP OF 7F /r B VIV MMX Move quadword from mm to mm/m64. 
MOVQ mm/m64, mm 
F3 OF 7E /r A VV SSE2 Move quadword from xmm2/mem64 to xmm1. 
MOVQ xmm1, xmm2/m64 
VEX.128.F3.0F.WIG 7E /r A VIV AVX Move quadword from xmm2 to xmm1. 
VMOVQ xmm1, xmm2/m64 
EVEX.128.F3.0F.W1 7E /r C VIV AVX512F | Move quadword from xmm2/m64 to xmm1. 
VMOVQ xmm1, xmm2/m64 
66 OF D6 /r B VIV SSE2 Move quadword from xmm1 to xmm2/mem64. 
MOVQ xmm2/m64, xmm1 
VEX.128.66.0F.WIG D6 /r B VIV AVX Move quadword from xmm2 register to xmm1/m64. 
VMOVQ xmm1/m64, xmm2 
EVEX.128.66.0F.W1 D6 /r D VIV AVX512F | Move quadword from xmmz2 register to xmm1/m64. 
VMOVQ xmm1/m64, xmm2 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
D Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Copies a quadword from the source operand (second operand) to the destination operand (first operand). The 
source and destination operands can be MMX technology registers, XMM registers, or 64-bit memory locations. This 
instruction can be used to move a quadword between two MMX technology registers or between an MMX tech- 
nology register and a 64-bit memory location, or to move data between two XMM registers or between an XMM 
register and a 64-bit memory location. The instruction cannot be used to transfer data between memory locations. 


When the source operand is an XMM register, the low quadword is moved; when the destination operand is an XMM 
register, the quadword is stored to the low quadword of the register, and the high quadword is cleared to all Os. 


In 64-bit mode and if not encoded using VEX/EVEX, use of the REX prefix in the form of REX.R permits this instruc- 
tion to access additional registers (XMM8-XMM15). 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


If VMOVQ is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an 
#UD exception. 


4-108 Vol. 2B MOVQ—Move Quadword 


INSTRUCTION SET REFERENCE, M-U 


Operation 


MOVQ instruction when operating on MMX technology registers and memory locations 
DEST := SRC; 


MOVQ instruction when source and destination operands are XMM registers 
DEST[63:0] := SRC[63:0); 
DEST[127:64] := DOOOOOD000000000H; 


MOVQ instruction when source operand is XMM register and destination 
operand is memory location: 
DEST := SRC[63:0]; 


MOVQ instruction when source operand is memory location and destination 
operand is XMM register: 

DEST[63:0] := SRC; 

DEST[127:64] := QOOOOODD00000000H; 


VMOVQ (VEX.128.F3.0F 7€) with XMM register source and destination 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVQ (VEX.128.66.0F D6) with XMM register source and destination 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVQ (7E - EVEX encoded version) with XMM register source and destination 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVQ (D6 - EVEX encoded version) with XMM register source and destination 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVQ (7€) with memory source 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


VMOVQ (7E - EVEX encoded version) with memory source 
DEST[63:0] := SRC[63:0] 
DEST[:MAXVL-1:64] := 0 


VMOVQ (D6) with memory dest 
DEST[63:0] := SRC2[63:0] 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
VMOVQ __m128i __mm_loadu_si64( void * s); 
VMOVQ void __mm_storeu_si64( void * d,___m128i s); 


MOVQ m128i __mm_move_epi64(__m128i a) 


MOVQ—Move Quadword Vol.2B 4-109 


INSTRUCTION SET REFERENCE, M-U 


SIMD Floating-Point Exceptions 


None 
Other Exceptions 


See Table 21-8, “Exception Conditions for Legacy SIMD/MMxX Instructions without FP Exception” in the Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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Opcode / Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
F3 OF D6 /r RM | V/V SSE2 Move quadword from mmx to low quadword 
MOVQ2DQ xmm, mm of xmm. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Moves the quadword from the source operand (second operand) to the low quadword of the destination operand 
(first operand). The source operand is an MMX technology register and the destination operand is an XMM register. 


This instruction causes a transition from x87 FPU to MMX technology operation (that is, the x87 FPU top-of-stack 
pointer is set to 0 and the x87 FPU tag word is set to all Os [valid]). If this instruction is executed while an x87 FPU 
floating-point exception is pending, the exception is handled before the MOVQ2DQ instruction is executed. 


In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). 


Operation 


DEST[63:0] := SRC[63:0]; 


DEST[127:64] := OOOOOOOD0D0000000H; 


Intel C/C++ Compiler Intrinsic Equivalent 


MOVQ2DQ: 


SIMD Floating-Point Exceptions 


None. 


128i __mm_movpi64_epi64 ( 


m64 a) 


Protected Mode Exceptions 


#NM 
#UD 


#MF 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


If CRO.TS[bit 3] = 1. 
If CRO.EM[bit 2] = 1. 


If CR4.OSFXSR[bit 9] = 0. 

If CPUID.OLH:EDX.SSE2[bit 26] = 0. 

If the LOCK prefix is used. 

If there is a pending x87 FPU exception. 


MOVQ2DQ—Move Quadword from MMX Technology to XMM Register 


Vol.2B 4-111 


INSTRUCTION SET REFERENCE, M-U 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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MOVS/MOVSB/MOVSW/MOVSD/MOVSQ—Move Data from String to String 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
A4 MOVS m8, m8 ZO ‘| Valid Valid For legacy mode, Move byte from address 


DS:(E)SI to ES:(€)DI. For 64-bit mode move 
byte from address (RIE)SI to (RJE)DI. 


A5 MOVS m16, m16 ZO | Valid Valid For legacy mode, move word from address 
DS:(E)SI to ES:(€)DI. For 64-bit mode move 
word at address (RIE)SI to (RJE)DI. 


A5 MOVS m32, m32 ZO | Valid Valid For legacy mode, move dword from address 
DS:(E)SI to ES:(€)DI. For 64-bit mode move 
dword from address (RJE)SI to (RIE)DI. 


REX.W + AS MOVS m64, m64 ZO ‘| Valid N.E. Move qword from address (RIE)SI! to (RJE)DI. 


A4 MOVSB ZO | Valid Valid For legacy mode, Move byte from address 
DS:(E)SI to ES:(€)DI. For 64-bit mode move 
byte from address (RIE)SI to (RJE)DI. 


A5 MOVSW ZO | Valid Valid For legacy mode, move word from address 
DS:(E)SI to ES:(€)DI. For 64-bit mode move 
word at address (RIE)SI to (RJE)DI. 


A5 MOVSD ZO | Valid Valid For legacy mode, move dword from address 
DS:(E)SI to ES:(€)DI. For 64-bit mode move 
dword from address (RJE)SI to (RIE)DI. 


REX.W + A5 MOVSQ ZO ‘| Valid N.E. Move qword from address (RIE)SI to (RJE)DI. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Moves the byte, word, or doubleword specified with the second operand (source operand) to the location specified 
with the first operand (destination operand). Both the source and destination operands are located in memory. The 
address of the source operand is read from the DS:ESI or the DS:SI registers (depending on the address-size attri- 
bute of the instruction, 32 or 16, respectively). The address of the destination operand is read from the ES:EDI or 
the ES:DI registers (again depending on the address-size attribute of the instruction). The DS segment may be 
overridden with a segment override prefix, but the ES segment cannot be overridden. 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the MOVS mnemonic) allows the source and destination 
operands to be specified explicitly. Here, the source and destination operands should be symbols that indicate the 
size and location of the source value and the destination, respectively. This explicit-operands form is provided to 
allow documentation; however, note that the documentation provided by this form can be misleading. That is, the 
source and destination operand symbols must specify the correct type (size) of the operands (bytes, words, or 
doublewords), but they do not have to specify the correct location. The locations of the source and destination 
operands are always specified by the DS:(E)SI and ES:(E)DI registers, which must be loaded correctly before the 
move string instruction is executed. 


The no-operands form provides “short forms” of the byte, word, and doubleword versions of the MOVS instruc- 
tions. Here also DS:(E)SI and ES:(E)DI are assumed to be the source and destination operands, respectively. The 
size of the source and destination operands is selected with the mnemonic: MOVSB (byte move), MOVSW (word 
move), or MOVSD (doubleword move). 


After the move operation, the (E)SI and (E)DI registers are incremented or decremented automatically according 
to the setting of the DF flag in the EFLAGS register. (If the DF flag is 0, the (E)SI and (E)DI register are incre- 
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mented; if the DF flag is 1, the (E)SI and (E)DI registers are decremented.) The registers are incremented or 
decremented by 1 for byte operations, by 2 for word operations, or by 4 for doubleword operations. 


NOTE 


To improve performance, more recent processors support modifications to the processor's 
operation during the string store operations initiated with MOVS and MOVSB. See Section 7.3.9.3 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for additional 
information on fast-string operation. 


The MOVS, MOVSB, MOVSW, and MOVSD instructions can be preceded by the REP prefix (see “REP/REPE/REPZ 
/REPNE/REPNZ—Repeat String Operation Prefix” for a description of the REP prefix) for block moves of ECX bytes, 
words, or doublewords. 


In 64-bit mode, the instruction’s default address size is 64 bits, 32-bit address size is supported using the prefix 
67H. The 64-bit addresses are specified by RSI and RDI; 32-bit address are specified by ESI and EDI. Use of the 
REX.W prefix promotes doubleword operation to 64 bits. See the summary chart at the beginning of this section for 
encoding data and limits. 


Operation 
DEST := SRC; 


Non-64-bit Mode: 


IF (Byte move) 
THEN IF DF =0 
THEN 
(E)SI := (E)SI + 1; 
(E)DI := (E)DI + 1; 


ELSE 
(E)SI := (E)SI - 1; 
(E)DI := (E)DI - 1; 
FI; 
ELSE IF (Word move) 
THEN IF DF = 0 


(E)SI := (E)SI + 2; 
(€)DI:= (E)DI + 2; 


FI; 
ELSE 
(E)SI := (E)SI - 2; 
(E)DI := (E)DI - 2; 
FI; 
ELSE IF (Doubleword move) 
THEN IF DF =0 
(E)SI := (E)SI + 4; 
(E)DI := (E)DI + 4; 
FI; 
ELSE 
(E)SI := (E)SI - 4; 
(E)DI := (E)DI - 4; 
FI; 
FI; 
64-bit Mode: 
IF (Byte move) 
THEN IF DF =0 
THEN 
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(RIE)SI := (RIE)SI + 1; 
(RIE)DI := (RIE)DI + 1; 

ELSE 
(RIE)SI := (RIE)SI - 1; 
(RIE)DI := (RIE)DI - 1; 


Fl; 
ELSE IF (Word move) 
THEN IF DF=0 
(RJE)SI := (RIE)SI + 2; 
(RJE)DI := (RIE)DI + 2; 
Fl; 
ELSE 
(RJE)SI := (RIE)SI - 2; 
(RJE)DI := (RIE)DI - 2; 
Fl; 
ELSE IF (Doubleword move) 
THEN IF DF =0 
(RJE)SI := (RIE)SI + 4; 
(RJE)DI := (RIE)DI + 4; 
Fl; 
ELSE 
(RJE)SI := (RIE)SI - 4; 
(RJE)DI := (RIE)DI - 4; 
Fl; 
ELSE IF (Quadword move) 
THEN IF DF =0 
(RIE)SI := (RIE)SI + 8; 
(RIE)DI := (RJE)DI + 8; 
Fl; 
ELSE 
(RJE)SI := (RIE)SI - 8; 
(RJE)DI := (RIE)DI - 8; 
Fl; 
FI; 
Flags Affected 
None 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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MOVSD—Move or Merge Scalar Double-Precision Floating-Point Value 


VMOVSD m64 {k1}, xmm1 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
F2 OF 10 /r A VV SSE2 Move scalar double-precision floating-point value 
MOVSD xmm1, xmm2 from xmm_2 to xmm1 register. 
F2 OF 10 /r A VV SSE2 Load scalar double-precision floating-point value 
MOVSD xmm1, m64 from m64 to xmm1 register. 
F2 OF 11 /r C VV SSE2 Move scalar double-precision floating-point value 
MOVSD xmm1/m64, xmm2 from xmm2 register to xmm1/m64. 
VEX.LIG.F2.0F.WIG 10 /r B VV AVX Merge scalar double-precision floating-point value 
VMOVSD xmm1, xmm2, xmm3 from xmm2 and xmm3 to xmm1 register. 
VEX.LIG.F2.0F,WIG 10 /r D VIV AVX Load scalar double-precision floating-point value 
VMOVSD xmm1, m64 from m64 to xmm1 register. 
VEX.LIG.F2.0F.WIG 11 /r E VIV AVX Merge scalar double-precision floating-point value 
VMOVSD xmm1, xmm2, xmm3 from xmm_2 and xmm3 registers to xmm1. 
VEX.LIG.F2.0F.WIG 11 /r C VV AVX Store scalar double-precision floating-point value 
VMOVSD m64, xmm1 from xmm1 register to m64. 
EVEX.LLIG.F2.0F.W1 10 /r B VIV AVX512F | Merge scalar double-precision floating-point value 
VMOVSD xmm1 {k1}{z}, xmm2, xmm3 from xmm_2 and xmm3 registers to xmm1 under 
writemask k1. 
EVEX.LLIG.F2.0F.W1 10 /r F VIV AVX512F | Load scalar double-precision floating-point value 
VMOVSD xmm1 {k1}{z}, m64 from m64 to xmm1 register under writemask k1. 
EVEX.LLIG.F2.0F.W1 11 /r E VV AVX512F | Merge scalar double-precision floating-point value 
VMOVSD xmm1 {k1}{z}, xmm2, xmm3 from xmm2 and xmm3 registers to xmm1 under 
writemask k1. 
EVEX.LLIG.F2.0F.W1 11 /r G VV AVX512F | Store scalar double-precision floating-point value 


from xmm1 register to m64 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C NA ModRM:r/m (w) ModRM:reg (r) NA NA 
D NA ModRM:reg (w) ModRM:r/m (r) NA NA 
E NA ModRM:r/m (w) vuvv (r) ModRM:reg (r) NA 
F Tuple1 Scalar ModRM:reg (r, w) ModRM:r/m (r) NA NA 
G Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
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Description 


Moves a scalar double-precision floating-point value from the source operand (second operand) to the destination 
operand (first operand). The source and destination operands can be XMM registers or 64-bit memory locations. 
This instruction can be used to move a double-precision floating-point value to and from the low quadword of an 
XMM register and a 64-bit memory location, or to move a double-precision floating-point value between the low 
quadwords of two XMM registers. The instruction cannot be used to transfer data between memory locations. 
Legacy version: When the source and destination operands are XMM registers, bits MAXVL:64 of the destination 
operand remains unchanged. When the source operand is a memory location and destination operand is an XMM 
registers, the quadword at bits 127:64 of the destination operand is cleared to all Os, bits MAXVL:128 of the desti- 
nation operand remains unchanged. 

VEX and EVEX encoded register-register syntax: Moves a scalar double-precision floating-point value from the 
second source operand (the third operand) to the low quadword element of the destination operand (the first 
operand). Bits 127:64 of the destination operand are copied from the first source operand (the second operand). 
Bits (MAXVL-1:128) of the corresponding destination register are zeroed. 

VEX and EVEX encoded memory store syntax: When the source operand is a memory location and destination 
operand is an XMM registers, bits MAXVL:64 of the destination operand is cleared to all Os. 


EVEX encoded versions: The low quadword of the destination is updated according to the writemask. 


Note: For VMOVSD (memory store and load forms), VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, 
otherwise instruction will #UD. 


Operation 


VMOVSD (EVEX.LLIG.F2.0F 10 /r: VMOVSD xmm1, m64 with support for 32 registers) 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := SRC[63:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[MAXVL-1:64] := 0 


VMOVSD (EVEX.LLIG.F2.0F 11 /r: VMOVSD m64, xmm1 with support for 32 registers) 
IF k1[0] or *no writemask* 

THEN  DEST[63:0] := SRC[63:0] 

ELSE *DEST[63:0] remains unchanged* ; merging-masking 
Fl; 


VMOVSD (EVEX.LLIG.F2.0F 11 /r: VMOVSD xmm1, xmm2, xmm3) 
IF k1[0] or *no writemask* 
THEN  DEST[63:0] := SRC2[63:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 
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MOVSD (128-bit Legacy SSE version: MOVSD XMM1, XMM2) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


VMOVSD (VEX.128.F2.0F 11 /r: VMOVSD xmm1, xmm2, xmm3) 
DEST[63:0] := SRC2[63:0] 

DEST[127:64] := SRC1[127:64] 

DEST[MAXVL-1:128] := 0 


VMOVSD (VEX.128.F2.0F 10 /r: VMOVSD xmm1, xmm2, xmm3) 
DEST[63:0] := SRC2[63:0] 

DEST[127:64] := SRC1[127:64] 

DEST[MAXVL-1:128] = 0 


VMOVSD (VEX.128.F2.0F 10 /r: VMOVSD xmm1, m64) 
DEST[63:0] := SRC[63:0] 
DEST[MAXVL-1:64] := 0 


MOVSD/VMOVSD (128-bit versions: MOVSD m64, xmm1 or VMOVSD m64, xmm1) 
DEST[63:0] := SRC[63:0] 


MOVSD (128-bit Legacy SSE version: MOVSD XMM1, m64) 
DEST[63:0] := SRC[63:0] 

DEST[127:64] := 0 

DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVSD __m128d _mm_mask_load_sd(__m128d s,___mmask8 k, double * p); 

VMOVSD __m128d __mm_maskz_load_sd(__mmask8 k, double * p); 

VMOVSD __m128d_mm_mask_move_sd(__m128d sh, ___mmask8 k,__m128d sl,__m128d a); 
VMOVSD __m128d __mm_maskz_move_sd(__mmask8 k,__m128ds,__m128d a); 

VMOVSD void _mm_mask_store_sd(double * p,__ mmask8 k,___m128d s); 

MOVSD __m128d_mm_load_sd (double *p) 

MOVSD void _mm_store_sd (double *p,__m128d a) 

MOVSD __m128d_mm_move_sd (__m128d a,__m128d b) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv != 1111B. 

EVEX-encoded instruction, see Table 2-58, “Type E10 Class Exception Conditions”. 
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MOVSHDUP—Replicate Single FP Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F3 OF 16 /r A VV SSE3 Move odd index single-precision floating-point values from 
MOVSHDUP xmm1, xmm2/m128 xmm2/mem and duplicate each element into xmm1. 
VEX.128.F3.0F.WIG 16 /r A VV AVX Move odd index single-precision floating-point values from 
VMOVSHDUP xmm1, xmm2/m128 xmm2/mem and duplicate each element into xmm1. 
VEX.256.F3.0F.WIG 16 /r A VV AVX Move odd index single-precision floating-point values from 
VMOVSHDUP ymm1, ymm2/m256 ymm2/mem and duplicate each element into ymm1. 
EVEX.128.F3.0F.WO 16 /r B VV AVX512VL | Move odd index single-precision floating-point values from 
VMOVSHDUP xmm1 {k1}{Z}, AVX512F xmm2/m128 and duplicate each element into xmm1 under 
xmm2/m128 writemask. 
EVEX.256.F3.0F.WO 16 /r B VV AVX512VL | Move odd index single-precision floating-point values from 
VMOVSHDUP ymm1 {k1}{Z}, AVX512F ymm2/m256 and duplicate each element into ymm1 under 
ymm2/m256 writemask. 
EVEX.512.F3.0F.WO0 16 /r B VV AVX512F Move odd index single-precision floating-point values from 
VMOVSHDUP zmm1 {k1}{z}, zmm2/m512 and duplicate each element into zmm1 under 
zmm2/m512 writemask. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Duplicates odd-indexed single-precision floating-point values from the source operand (the second operand) to 
adjacent element pair in the destination operand (the first operand). See Figure 4-3. The source operand is an 
XMM, YMM or ZMM register or 128, 256 or 512-bit memory location and the destination operand is an XMM, YMM 


or ZMM register. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 
VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. 

VEX.256 encoded version: Bits (MAXVL-1:256) of the destination register are zeroed. 

EVEX encoded version: The destination operand is updated at 32-bit granularity according to the writemask. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


SRC 


DEST] 


X7 X6 X5 x4 X3 X2 X1 XO 
X7 X7 X5 X5 X3 X3 X1 x1 
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Operation 


VMOVSHDUP (EVEX encoded versions) 

(KL, VL) = (4, 128), (8, 256), (16, 512) 

TMP_SRC[31:0] := SRC[63:32] 

TMP_SRC[63:32] := SRC[63:32] 

TMP_SRC[95:64] := SRC[127:96] 

TMP_SRC[1 27:96] := SRC[1 27:96] 

IF VL >= 256 
TMP_SRC[159:1 28] := SRC[191:160] 
TMP_SRC[191:160] := SRC[191:160] 
TMP_SRC[223:192] := SRC[255:224] 
TMP_SRC[255:224] := SRC[255:224] 

Fl; 

IF VL >= 512 
TMP_SRC[287:256] := SRC[319:288] 
TMP_SRC[319:288] := SRC[319:288] 
TMP_SRC[351:320] := SRC[383:352] 
TMP_SRC[383:352] := SRC[383:352] 
TMP_SRC[415:384] := SRC[447:416] 
TMP_SRC[447:416] := SRC[447:416] 
TMP_SRC[479:448] := SRC[511:480] 
TMP_SRC[511:480] := SRC[511:480] 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_SRC[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVSHDUP (VEX.256 encoded version) 
DEST[31:0] := SRC[63:32] 

DEST[63:32] := SRC[63:32] 

DEST[95:64] := SRC[127:96] 

DEST[127:96] := SRC[127:96] 
DEST[159:128] := SRC[191:160] 
DEST[191:160] := SRC[191:160] 
DEST[223:192] := SRC[255:224] 
DEST[255:224] := SRC[255:224] 
DEST[MAXVL-1:256] := 0 


VMOVSHDUP (VEX.128 encoded version) 
DEST[31:0] := SRC[63:32] 

DEST[63:32] := SRC[63:32] 

DEST[95:64] := SRC[127:96] 

DEST[127:96] := SRC[127:96] 
DEST[MAXVL-1:128] := 0 
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MOVSHDUP (128-bit Legacy SSE version) 
DEST[31:0] := SRC[63:32] 

DEST[63:32] := SRC[63:32] 

DEST[95:64] := SRC[127:96] 

DEST[127:96] := SRC[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVSHDUP __m512 _mm512_movehdup_ps(__m512 a); 

VMOVSHDUP __m512 _mm512_mask_movehdup_ps(__m512 s,__mmask16 k,__m512 a); 
VMOVSHDUP __m512 _mm512_maskz_movehdup_ps(__mmask16 k,__m512 a); 
VMOVSHDUP __m256 _mm256_mask_movehdup_ps(__m256 s,__ mmask8 k, __m256 a); 
VMOVSHDUP __m256 _mm256_maskz_movehdup_ps(_mmask8 k,___m256 a); 
VMOVSHDUP __m128 _mm_mask_movehdup_ps(__m128 s,__ mmask8 k,___m128 a); 
VMOVSHDUP __m128 _mm_maskz_movehdup_ps(__mmask8 k, __m128 a); 

VMOVSHDUP __m256 _mm256_movehdup_ps (__m256 a); 

VMOVSHDUP __m128 _mm_movehdup_ps (__m128 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

F3 OF 12 /r A VIV SSE3 Move even index single-precision floating-point values from 
MOVSLDUP xmm1, xmm2/m128 xmm2/mem and duplicate each element into xmm1. 
VEX.128.F3.0F.WIG 12 /r A VIV AVX Move even index single-precision floating-point values from 
VMOVSLDUP xmm1, xmm2/m128 xmm2/mem and duplicate each element into xmm1. 
VEX.256.F3.0F.WIG 12 /r A VIV AVX Move even index single-precision floating-point values from 
VMOVSLDUP ymm1, ymm2/m256 ymm2/mem and duplicate each element into ymm1. 
EVEX.128.F3.0F.WO0 12 /r B VIV AVX512VL | Move even index single-precision floating-point values from 
VMOVSLDUP xmm1 {k1}{z}, AVX512F xmm2/m128 and duplicate each element into xmm1 under 
xmm2/m128 writemask. 
EVEX.256.F3.0F.WO0 12 /r B VIV AVX512VL | Move even index single-precision floating-point values from 
VMOVSLDUP ymm1 {k1}{z}, AVX512F ymm2/m256 and duplicate each element into ymm1 under 
ymm2/m256 writemask. 
EVEX.512.F3.0F.WO0 12 /r B VIV AVX512F Move even index single-precision floating-point values from 
VMOVSLDUP zmm1 {k1}{Z}, zmm2/m512 and duplicate each element into zmm1 under 
zmm2/m512 writemask. 

Instruction Operand Encoding 

Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Duplicates even-indexed single-precision floating-point values from the source operand (the second operand). See 
Figure 4-4. The source operand is an XMM, YMM or ZMM register or 128, 256 or 512-bit memory location and the 
destination operand is an XMM, YMM or ZMM register. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 
VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. 

VEX.256 encoded version: Bits (MAXVL-1:256) of the destination register are zeroed. 

EVEX encoded version: The destination operand is updated at 32-bit granularity according to the writemask. 
Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


SRC 


X7 


X6 


X5 


X4 


X3 X2 X1 XO 


DEST] 


X6 


X6 


x4 


x4 


X2 X2 XO x0 
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Operation 


VMOVSLDUP (EVEX encoded versions) 

(KL, VL) = (4, 128), (8, 256), (16, 512) 

TMP_SRC[31:0] := SRC[31:0] 

TMP_SRC[63:32] := SRC[31:0] 

TMP_SRC[95:64] := SRC[95:64] 

TMP_SRC[1 27:96] := SRC[95:64] 

IF VL >= 256 
TMP_SRC[159:1 28] := SRC[159:128] 
TMP_SRC[191:160] := SRC[159:128] 
TMP_SRC[223:192] := SRC[223:192] 
TMP_SRC[255:224] := SRC[223:192] 

Fl; 

IF VL >= 512 
TMP_SRC[287:256] := SRC[287:256] 
TMP_SRC[319:288] := SRC[287:256] 
TMP_SRC[351:320] := SRC[351:320] 
TMP_SRC[383:352] := SRC[351:320] 
TMP_SRC[415:384] := SRC[415:384] 
TMP_SRC[447:416] := SRC[415:384] 
TMP_SRC[479:448] := SRC[479:448] 
TMP_SRC[51 1:480] := SRC[479:448] 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_SRC[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVSLDUP (VEX.256 encoded version) 
DEST[31:0] := SRC[31:0] 

DEST[63:32] := SRC[31:0] 

DEST[95:64] := SRC[95:64] 

DEST[127:96] := SRC[95:64] 
DEST[159:128] := SRC[159:128] 
DEST[191:160] := SRC[159:1 28] 
DEST[223:192] = SRC[223:192] 
DEST[255:224] = SRC[223:192] 
DEST[MAXVL-1:256] := 0 


VMOVSLDUP (VEX.128 encoded version) 
DEST[31:0] := SRC[31:0] 

DEST[63:32] := SRC[31:0] 

DEST[95:64] := SRC[95:64] 

DEST[127:96] := SRC[95:64] 
DEST[MAXVL-1:128] := 0 
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MOVSLDUP (128-bit Legacy SSE version) 
DEST[31:0] := SRC[31:0] 

DEST[63:32] := SRC[31:0] 

DEST[95:64] := SRC[95:64] 

DEST[127:96] := SRC[95:64] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVSLDUP __m512_mm512_moveldup_ps(_m512 a); 

VMOVSLDUP __m512 _mm512_mask_moveldup_ps(__m512 s,__ mmask16 k,_m512 a); 
VMOVSLDUP __m512 _mm512_maskz_moveldup_ps(__ mmask16 k,__m512 a); 
VMOVSLDUP __m256 __mm256_mask_moveldup_ps(__m256 s,__ mmask8 k,___m256 a); 
VMOVSLDUP __m256 __mm256_maskz_moveldup_ps(_mmask8 k,___m256 a); 
VMOVSLDUP __m128 __mm_mask_moveldup_ps(__m128 s,__ mmask8 k,___m128 a); 
VMOVSLDUP __m128 _mm_maskz_moveldup_ps(__mmask8 k, __m128 a); 

VMOVSLDUP __m256 __mm256_moveldup_ps (__m256 a); 

VMOVSLDUP __m128 _mm_moveldup_ps (__m128 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 
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MOVSS—Move or Merge Scalar Single-Precision Floating-Point Value 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
F3 OF 10 /r A VIV SSE Merge scalar single-precision floating-point value 
MOVSS xmm1, xmm2 from xmm_2 to xmm1 register. 
F3 OF 10 /r A VIV SSE Load scalar single-precision floating-point value from 
MOVSS xmm1, m32 m32 to xmm1 register. 
VEX.LIG.F3.0F.WIG 10 /r B VIV AVX Merge scalar single-precision floating-point value 
VMOVSS xmm1, xmm2, xmm3 from xmm_2 and xmm3 to xmm1 register 
VEX.LIG.F3.0F.WIG 10 /r D VIV AVX Load scalar single-precision floating-point value from 
VMOVSS xmm1, m32 m32 to xmm1 register. 
F30F 11 /r C VIV SSE Move scalar single-precision floating-point value 
MOVSS xmm2/m32, xmm1 from xmm1 register to xmm2/m32. 
VEX.LIG.F3.0F.WIG 11 /r E VIV AVX Move scalar single-precision floating-point value 
VMOVSS xmm1, xmm2, xmm3 from xmm2 and xmm3 to xmm1 register. 
VEX.LIG.F3.0F.WIG 11 /r C VIV AVX Move scalar single-precision floating-point value 
VMOVSS m32, xmm1 from xmm1 register to m32. 
EVEX.LLIG.F3.0F.WO 10 /r B VIV AVX512F | Move scalar single-precision floating-point value 
VMOVSS xmm1 {k1}{z}, xmm2, xmm3 from xmm_2 and xmm3 to xmm1 register under 
writemask k1. 
EVEX.LLIG.F3.0F.WO 10 /r F VIV AVX512F | Move scalar single-precision floating-point values 
VMOVSS xmm1 {k1}{z}, m32 from m32 to xmm1 under writemask k1. 
EVEX.LLIG.F3.0F.WO 11 /r E VIV AVX512F | Move scalar single-precision floating-point value 
VMOVSS xmm1 {k1}{z}, xmm2, xmm3 from xmm_2 and xmm3 to xmm1 register under 
writemask k1. 
EVEX.LLIG.F3.0F.WO 11 /r G VIV AVX512F | Move scalar single-precision floating-point values 
VMOVSS m32 {k1}, xmm1 from xmm1 to m32 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C NA ModRM:r/m (w) ModRM:reg (r) NA NA 
D NA ModRM:reg (w) ModRM:r/m (r) NA NA 
E NA ModRM:r/m (w) EVEX.vvvv (r) ModRM:reg (r) NA 
F Tuple1 Scalar ModRM:reg (r, w) ModRM:r/m (r) NA NA 
G Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
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Description 


Moves a scalar single-precision floating-point value from the source operand (second operand) to the destination 
operand (first operand). The source and destination operands can be XMM registers or 32-bit memory locations. 
This instruction can be used to move a single-precision floating-point value to and from the low doubleword of an 
XMM register and a 32-bit memory location, or to move a single-precision floating-point value between the low 
doublewords of two XMM registers. The instruction cannot be used to transfer data between memory locations. 
Legacy version: When the source and destination operands are XMM registers, bits (MAXVL-1:32) of the corre- 
sponding destination register are unmodified. When the source operand is a memory location and destination 
operand is an XMM registers, Bits (127:32) of the destination operand is cleared to all Os, bits MAXVL:128 of the 
destination operand remains unchanged. 

VEX and EVEX encoded register-register syntax: Moves a scalar single-precision floating-point value from the 
second source operand (the third operand) to the low doubleword element of the destination operand (the first 
operand). Bits 127:32 of the destination operand are copied from the first source operand (the second operand). 
Bits (MAXVL-1:128) of the corresponding destination register are zeroed. 

VEX and EVEX encoded memory load syntax: When the source operand is a memory location and destination 
operand is an XMM registers, bits MAXVL:32 of the destination operand is cleared to all Os. 


EVEX encoded versions: The low doubleword of the destination is updated according to the writemask. 


Note: For memory store form instruction “VMOVSS m32, xmm1”, VEX.vvvv is reserved and must be 1111b other- 
wise instruction will #UD. For memory store form instruction “VMOVSS mv {k1}, xmm1”, EVEX.vvvv is reserved 
and must be 1111b otherwise instruction will #UD. 


Software should ensure VMOVSS is encoded with VEX.L=0. Encoding VMOVSS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 


VMOVSS (EVEX.LLIG.F3.0F.WO 11 /r when the source operand is memory and the destination is an XMM register) 
IF k1[0] or *no writemask* 
THEN —DEST[31:0] := SRC[31:0] 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[MAXVL-1:32] := 0 


VMOVSS (EVEX.LLIG.F3.0F.WO 10 /r when the source operand is an XMM register and the destination is memory) 
IF k1[0] or *no writemask* 

THEN —DEST[31:0] := SRC[31:0] 

ELSE *DEST[31:0] remains unchanged* ; merging-masking 
Fl; 
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VMOVSS (EVEX.LLIG.F3.0F.WO 10/11 /r where the source and destination are XMM registers) 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := SRC2[31:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


MOVSS (Legacy SSE version when the source and destination operands are both XMM registers) 
DEST[31:0] := SRC[31:0] 
DEST[MAXVL-1:32] (Unmodified) 


VMOVSS (VEX.128.F3.0F 11 /r where the destination is an XMM register) 
DEST[31:0] := SRC2[31:0] 

DEST[127:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


VMOVSS (VEX.128.F3.0F 10 /r where the source and destination are XMM registers) 
DEST[31:0] := SRC2[31:0] 

DEST[127:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


VMOVSS (VEX.128.F3.0F 10 /r when the source operand is memory and the destination is an XMM register) 
DEST[31:0] := SRC[31:0] 
DEST[MAXVL-1:32] := 0 


MOVSS/VMOVSS (when the source operand is an XMM register and the destination is memory) 
DEST[31:0] := SRC[31:0] 


MOVSS (Legacy SSE version when the source operand is memory and the destination is an XMM register) 
DEST[31:0] := SRC[31:0] 

DEST[127:32] := 0 

DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVSS __m128_mm_mask_load_ss(__m128 s,___mmask8 k, float * p); 
VMOVSS __m128_mm_maskz_load_ss(__mmask8 k, float * p); 

VMOVSS __m128 __mm_mask_move_ss(__m128 sh, ___mmask8 k,__m128 sl, 
VMOVSS __m128 __mm_maskz_move_ss(__mmask8 k,__m128s,__m128 a); 
VMOVSS void _mm_mask_store_ss(float * p,__mmask8 k,__m128 a); 
MOVSS __m128 _mm_load_ss(float * p) 

MOVSS void_mm_store_ss(float * p,__m128 a) 

MOVSS __m128_mm_move_ss(__m128 a,__m128 b) 


m128 a); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv != 1111B. 
EVEX-encoded instruction, see Table 2-58, “Type E10 Class Exception Conditions”. 


MOVSS—Move or Merge Scalar Single-Precision Floating-Point Value Vol.2B 4-129 


INSTRUCTION SET REFERENCE, M-U 


MOVSX/MOVSXD—Move with Sign-Extension 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF BE /r MOVSX 16, r/m8 RM | Valid Valid Move byte to word with sign-extension. 

OF BE /r MOVSX r32, r/m8 RM | Valid Valid Move byte to doubleword with sign- 
extension. 

REX.W + OF BE /r MOVSX r64, r/m8 RM | Valid N.E. Move byte to quadword with sign-extension. 

OF BF /r MOVSX r32, r/m16 RM | Valid Valid Move word to doubleword, with sign- 
extension. 

REX.W + OF BF /r MOVSX r64, r/m16 RM | Valid N.E. Move word to quadword with sign-extension. 

63 /r* MOVSXD r16, r/m16 RM_ | Valid N.E. Move word to word with sign-extension. 

63 /r* MOVSXD r32, r/m32 RM_ | Valid N.E. Move doubleword to doubleword with sign- 
extension. 

REX.W + 63 /r MOVSXD r64, r/m32 RM_ | Valid N.E. Move doubleword to quadword with sign- 
extension. 

NOTES: 


* The use of MOVSXD without REX.W in 64-bit mode is discouraged. Regular MOV should be used instead of using MOVSXD without 
REX.W. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Copies the contents of the source operand (register or memory location) to the destination operand (register) and 
sign extends the value to 16 or 32 bits (see Figure 7-6 in the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 1). The size of the converted value depends on the operand-size attribute. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 
DEST := SignExtend(SRC); 


Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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MOVUPD—Move Unaligned Packed Double-Precision Floating-Point Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 

66 OF 10 /r A VIV SSE2 Move unaligned packed double-precision floating- 

MOVUPD xmm1, xmm2/m128 point from xmm2/mem to xmm1. 

66 OF 11 /r B VIV SSE2 Move unaligned packed double-precision floating- 

MOVUPD xmm2/m128, xmm1 point from xmm1 to xmm2/mem. 

VEX.128.66.0F.WIG 10 /r A VIV AVX Move unaligned packed double-precision floating- 

VMOVUPD xmm1, xmm2/m128 point from xmm2/mem to xmm1. 

VEX.128.66.0F.WIG 11 /r B VV AVX Move unaligned packed double-precision floating- 

VMOVUPD xmm2/m128, xmm1 point from xmm1 to xmm2/mem. 

VEX.256.66.0F.WIG 10 /r A VIV AVX Move unaligned packed double-precision floating- 

VMOVUPD ymm1, ymm2/m256 point from ymm2/mem to ymm1. 

VEX.256.66.0F.WIG 11 /r B VIN AVX Move unaligned packed double-precision floating- 

VMOVUPD ymm2/m256, ymm1 point from ymm1 to ymm2/mem. 

EVEX.128.66.0F.W1 10 /r C VV AVX512VL | Move unaligned packed double-precision floating- 

VMOVUPD xmm1 {k1}{z}, xmm2/m128 AVX512F point from xmm2/m1 28 to xmm1 using 
writemask k1. 

EVEX.128.66.0F.W1 11 /r D VIV AVX512VL_ | Move unaligned packed double-precision floating- 

VMOVUPD xmm2/m1 28 {k1}{z}, xmm1 AVX512F point from xmm1 to xmm2/m128 using 
writemask k1. 

EVEX.256.66.0F.W1 10 /r C VV AVX512VL | Move unaligned packed double-precision floating- 

VMOVUPD ymm1 {k1}{z}, ynm2/m256 AVX512F point from ymm2/m256 to ymm1 using 
writemask k1. 

EVEX.256.66.0F.W1 11 /r D VIV AVX512VL_ | Move unaligned packed double-precision floating- 

VMOVUPD ymm2/m256 {k1}{z}, ymm1 AVX512F point from ymm1 to ymm2/m256 using 
writemask k1. 

EVEX.512.66.0F.W1 10 /r C VIV AVX512F Move unaligned packed double-precision floating- 

VMOVUPD zmm1 {k1}{z}, zmm2/m512 point values from zmm2/m512 to zmm1 using 
writemask k1. 

EVEX.512.66.0F.W1 11 /r D VIV AVX512F Move unaligned packed double-precision floating- 

VMOVUPD zmm2/m512 {k1}{z}, zmm1 point values from zmm1 to zmm2/m512 using 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Note: VEX.vvvv and EVEX.vvvwv is reserved and must be 1111b otherwise instructions will #UD. 


EVEX.512 encoded version: 


Moves 512 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a ZMM register from a float64 memory 
location, to store the contents of a ZMM register into a memory. The destination operand is updated according to 


the writemask. 
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VEX.256 encoded version: 


Moves 256 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a YMM register from a 256-bit memory 
location, to store the contents of a YMM register into a 256-bit memory location, or to move data between two YMM 
registers. Bits (MAXVL-1:256) of the destination register are zeroed. 


128-bit versions: 


Moves 128 bits of packed double-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load an XMM register from a 128-bit memory 
location, to store the contents of an XMM register into a 128-bit memory location, or to move data between two 
XMM registers. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 


When the source or destination operand is a memory operand, the operand may be unaligned on a 16-byte 
boundary without causing a general-protection exception (#GP) to be generated 


VEX.128 and EVEX.128 encoded versions: Bits (MAXVL-1:128) of the destination register are zeroed. 


Operation 


VMOVUPD (EVEX encoded versions, register-copy form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVUPD (EVEX encoded versions, store-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[i+63:i] 
ELSE *DEST[i+63:i] remains unchanged* ; merging-masking 


Fl; 
ENDFOR; 
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VMOVUPD (EVEX encoded versions, load-form) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := SRC[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVUPD (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVUPD (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0)] 


VMOVUPD (VEX.128 encoded version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


MOVUPD (128-bit load- and register-copy- form Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


(V)MOVUPD (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVUPD __m512d_mm512_loadu_pd( void * s); 

VMOVUPD __m512d_mm512_mask_loadu_pd(__m512da,__mmask8 k, void * s); 
VMOVUPD __m512d_mm512_maskz_loadu_pd( ___mmask8 k, void * s); 
VMOVUPD void _mm512_storeu_pd( void * d,__m512d a); 

VMOVUPD void _mm512_mask_storeu_pd( void * d,__ mmask8 k,___m512d a); 
VMOVUPD __m256d_mm256_mask_loadu_pd(__m256d s, __mmask8 k, void * m); 
VMOVUPD __m256d __mm256_maskz_loadu_pd( ___mmask8 k, void * m); 
VMOVUPD void _mm256_mask_storeu_pd( void * d,__ mmask8 k,___m256d a); 
VMOVUPD __m128d_mm_mask_loadu_pd(__m128d s,__ mmask8 k, void * m); 
VMOVUPD __m128d _mm_maskz_loadu_pd( ___mmask8 k, void * m); 

VMOVUPD void _mm_mask_storeu_pd( void * d,__ mmask8 k, __m128d a); 
MOVUPD __m256d __mm256_loadu_pd (double * p); 

MOVUPD void _mm256_storeu_pd( double *p,__ m256d a); 

MOVUPD __m128d_mm_loadu_pd (double * p); 

MOVUPD void _mm_storeu_pd( double *p,__m128d a); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

Note treatment of #AC varies; additionally: 

#UD If VEX.vvvv != 1111B. 

EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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MOVUPS—Move Unaligned Packed Single-Precision Floating-Point Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
NP OF 10 /r A VIV SSE Move unaligned packed single-precision 
MOVUPS xmm1, xmm2/m128 floating-point from xmm2/mem to xmm1. 
NP OF 11 /r B VIV SSE Move unaligned packed single-precision 
MOVUPS xmm2/m1 28, xmm1 floating-point from xmm1 to xmm2/mem. 
VEX.128.0F.WIG 10 /r A VIV AVX Move unaligned packed single-precision 
VMOVUPS xmm1, xmm2/m128 floating-point from xmm2/mem to xmm1. 
VEX.128.0F.WIG 11 /r B VIV AVX Move unaligned packed single-precision 
VMOVUPS xmm2/m1 28, xmm1 floating-point from xmm1 to xmm2/mem. 
VEX.256.0F.WIG 10 /r A VIV AVX Move unaligned packed single-precision 
VMOVUPS ymm1, ymm2/m256 floating-point from ymm2/mem to ymm1. 
VEX.256.0F.WIG 11 /r B VIN AVX Move unaligned packed single-precision 
VMOVUPS ymm2/m256, ymm1 floating-point from ymm1 to ymm2/mem. 
EVEX.128.0F.WO 10 /r G VIV AVX512VL_ | Move unaligned packed single-precision 
VMOVUPS xmm1 {k1}{z}, xmm2/m128 AVX512F floating-point values from xmm2/m1 28 to 
xmm_1 using writemask k1. 
EVEX.256.0F.W0 10 /r C VIN AVX512VL_ | Move unaligned packed single-precision 
VMOVUPS ymm1 {k1}{z}, ymm2/m256 AVX512F floating-point values from ymm2/m256 to 
ymm1 using writemask k1. 
EVEX.512.0F.WO 10 /r C VIV AVX512F Move unaligned packed single-precision 
VMOVUPS zmm1 {k1}{z}, zmm2/m512 floating-point values from zmm2/m512 to 
zmm1 using writemask k1. 
EVEX.128.0F.WO 11 /r D VIV AVX512VL_ | Move unaligned packed single-precision 
VMOVUPS xmm2/m128 {k1}{z}, xmm1 AVX512F floating-point values from xmm1 to 
xmm2/m128 using writemask k1. 
EVEX.256.0F.WO 11 /r D VIV AVX512VL_ | Move unaligned packed single-precision 
VMOVUPS ymm2/m256 {k1}{z}, ymm1 AVX512F floating-point values from ymm1 to 
ymm2/m256 using writemask k1. 
EVEX.512.0F.WO 11 /r D VIV AVX512F Move unaligned packed single-precision 
VMOVUPS zmm2/m512 {k1}{z}, zmm1 floating-point values from zmm1 to 
zmm2/m512 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
C Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Full Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Note: VEX.vvvv and EVEX.vvwv is reserved and must be 1111b otherwise instructions will #UD. 


EVEX.512 encoded version: 


Moves 512 bits of packed single-precision floating-point values from the source operand (second operand) to the 


destination operand (first operand). This instruction can be used to load a ZMM register from a 512-bit float32 
memory location, to store the contents of a ZMM register into memory. The destination operand is updated 


according to the writemask. 


4-136 Vol. 2B 


MOVUPS—Move Unaligned Packed Single-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, M-U 


VEX.256 and EVEX.256 encoded versions: 


Moves 256 bits of packed single-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load a YMM register from a 256-bit memory 
location, to store the contents of a YMM register into a 256-bit memory location, or to move data between two YMM 
registers. Bits (MAXVL-1:256) of the destination register are zeroed. 


128-bit versions: 

Moves 128 bits of packed single-precision floating-point values from the source operand (second operand) to the 
destination operand (first operand). This instruction can be used to load an XMM register from a 128-bit memory 
location, to store the contents of an XMM register into a 128-bit memory location, or to move data between two 
XMM registers. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 
When the source or destination operand is a memory operand, the operand may be unaligned without causing a 
general-protection exception (#GP) to be generated. 

VEX.128 and EVEX.128 encoded versions: Bits (MAXVL-1:128) of the destination register are zeroed. 


Operation 


VMOVUPS (EVEX encoded versions, register-copy form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] = SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVUPS (EVEX encoded versions, store-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR; 
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VMOVUPS (EVEX encoded versions, load-form) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := SRC[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMOVUPS (VEX.256 encoded version, load - and register copy) 
DEST[255:0] := SRC[255:0] 
DEST[MAXVL-1:256] := 0 


VMOVUPS (VEX.256 encoded version, store-form) 
DEST[255:0] := SRC[255:0)] 


VMOVUPS (VEX.128 encoded version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] := 0 


MOVUPS (128-bit load- and register-copy- form Legacy SSE version) 
DEST[127:0] := SRC[127:0] 
DEST[MAXVL-1:128] (Unmodified) 


(V)MOVUPS (128-bit store-form version) 
DEST[127:0] := SRC[127:0] 


Intel C/C++ Compiler Intrinsic Equivalent 


VMOVUPS __m512_mm512_loadu_ps( void * s); 

VMOVUPS __m512 _mm512_mask_loadu_ps(__m512 a,__mmask16 k, void * s); 
VMOVUPS __m512 _mm512_maskz_loadu_ps(__mmask16 k, void * s); 
VMOVUPS void _mm512_storeu_ps( void * d,__m512 a); 

VMOVUPS void _mm512_mask_storeu_ps( void * d,__ mmask8 k,__m512 a); 
VMOVUPS __m256 _mm256_mask_loadu_ps(__m256 a, ___mmask8 k, void * s); 
VMOVUPS __m256 _mm256_maskz_loadu_ps(__mmask8 k, void * s); 
VMOVUPS void _mm256_mask_storeu_ps( void * d,__ mmask8 k,__m256 a); 
VMOVUPS __m128 _mm_mask_loadu_ps(__m128 a, ___mmask8 k, void * s); 
VMOVUPS __m128 _mm_maskz_loadu_ps(__mmask8 k, void * s); 

VMOVUPS void _mm_mask_storeu_ps( void * d,__ mmask8 k,__m128 a); 
MOVUPS __m256 __mm256_loadu_ps ( float * p); 

MOVUPS void _mm256 _storeu_ps( float *p,__m256 a); 

MOVUPS __m128_mm_loadu_ps ( float * p); 

MOVUPS void _mm_storeu_ps( float *p,__m128 a); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

Note treatment of #AC varies. 

EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
Additionally: 

#UD If EVEX.vvvv != 1111B or VEX.vvvv != 1111B. 
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MOVZX—Move with Zero-Extend 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF B6 /r MOVZX r16, r/m8 RM_ | Valid Valid Move byte to word with zero-extension. 
OF B6 /r MOVZX r32, r/m8 RM _ | Valid Valid Move byte to doubleword, zero-extension. 
REX.W + OF B6 /r MOVZX r64, r/m8* RM _ | Valid N.E. Move byte to quadword, zero-extension. 
OF B7 /r MOVZX r32, r/m16 RM | Valid Valid Move word to doubleword, zero-extension. 
REX.W + OF B7 /r MOVZX r64, r/m16 RM _ | Valid N.E. Move word to quadword, zero-extension. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if the REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Copies the contents of the source operand (register or memory location) to the destination operand (register) and 
zero extends the value. The size of the converted value depends on the operand-size attribute. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bit operands. See the summary chart 


at the beginning of this section for encoding data and limits. 


Operation 


DEST := ZeroExtend(SRC); 


Flags Affected 


None. 


Protected Mode Exceptions 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


#GP(0) 
#SS(0) 
#PF(fault-code) 
#AC(0) 


#UD 


Real-Address Mode Exceptions 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If the LOCK prefix is used. 


#GP 
#SS 
#UD 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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MPSADBW — Compute Multiple Packed Sums of Absolute Difference 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 
Flag 
66 OF 3A 42 /r ib RMI | V/V SSE4_1 Sums absolute 8-bit integer difference of 


adjacent groups of 4 byte integers in xmm1 
and xmm2/m128 and writes the results in 
xmm1. Starting offsets within xmm17 and 
xmm2/m128 are determined by immé. 


MPSADBW xmm1, xmm2/m128, imm8 


VEX.128.66.0F3A.WIG 42 /r ib RVMI | V/V AVX 
VMPSADBW xmm1, xmm2, xmm3/m128, imm& 


Sums absolute 8-bit integer difference of 
adjacent groups of 4 byte integers in xmm2 
and xmm3/m128 and writes the results in 
xmm1. Starting offsets within xmm2 and 
xmm3/m128 are determined by immé. 


VEX.256.66.0F3A.WIG 42 /r ib RVMI | V/V AVX2 
VMPSADBW ymm17, ymm2, ymm3/m256, imm8 


Sums absolute 8-bit integer difference of 
adjacent groups of 4 byte integers in xmm2 
and ymm3/m128 and writes the results in 
ymm1. Starting offsets within ymm2 and 
xmm3/m128 are determined by imm8. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8s NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 

Description 


(V)MPSADBW calculates packed word results of sum-absolute-difference (SAD) of unsigned bytes from two blocks 
of 32-bit dword elements, using two select fields in the immediate byte to select the offsets of the two blocks within 
the first source operand and the second operand. Packed SAD word results are calculated within each 128-bit lane. 
Each SAD word result is calculated between a stationary block_2 (whose offset within the second source operand 

is selected by a two bit select control, multiplied by 32 bits) and a sliding block_1 at consecutive byte-granular posi- 
tion within the first source operand. The offset of the first 32-bit block of block_1 is selectable using a one bit select 
control, multiplied by 32 bits. 


128-bit Legacy SSE version: Imm8[1:0]*32 specifies the bit offset of block_2 within the second source operand. 
Imm[2]*32 specifies the initial bit offset of the block_1 within the first source operand. The first source operand 
and destination operand are the same. The first source and destination operands are XMM registers. The second 
source operand is either an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding 
YMM destination register remain unchanged. Bits 7:3 of the immediate byte are ignored. 


VEX.128 encoded version: Imm8[1:0]*32 specifies the bit offset of block_2 within the second source operand. 
Imm[2]*32 specifies the initial bit offset of the block_1 within the first source operand. The first source and desti- 
nation operands are XMM registers. The second source operand is either an XMM register or a 128-bit memory 
location. Bits (127:128) of the corresponding YMM register are zeroed. Bits 7:3 of the immediate byte are ignored. 


VEX.256 encoded version: The sum-absolute-difference (SAD) operation is repeated 8 times for MPSADW between 
the same block_2 (fixed offset within the second source operand) and a variable block_1 (offset is shifted by 8 bits 
for each SAD operation) in the first source operand. Each 16-bit result of eight SAD operations between block_2 
and block_1 is written to the respective word in the lower 128 bits of the destination operand. 


Additionally, VMPSADBW performs another eight SAD operations on block_4 of the second source operand and 

block_3 of the first source operand. (Imm8[4:3]*32 + 128) specifies the bit offset of block_4 within the second 
source operand. (Imm[5]*32+128) specifies the initial bit offset of the block_3 within the first source operand. 
Each 16-bit result of eight SAD operations between block_4 and block_3 is written to the respective word in the 
upper 128 bits of the destination operand. 
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The first source operand is a YMM register. The second source register can be a YMM register or a 256-bit memory 
location. The destination operand is a YMM register. Bits 7:6 of the immediate byte are ignored. 


Note: If VMPSADBW is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will 
cause an #UD exception. 


Imm[4:3]*32+128 
255 224 192 128 
Src2 
Imm[5]*32+128 
Src1 
255 ere pa 7 128 
Destination 
Imm[1 :0]*32 
127 96 64 | 0 
Src2 n 
Imm[2]*32 
Src1 \ 
Destination 


Figure 4-5. 256-bit VMPSADBW Operation 
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Operation 


VMPSADBW (VEX.256 encoded version) 

BLK2_OFFSET := imm8[1:0]*32 

BLK1_OFFSET := imm8[2]*32 

SRC1_BYTEO := SRC1[BLK1_OFFSET+7:BLK1_OFFSET] 
SRC1_BYTE1 := SRC1[BLK1_OFFSET+15:BLK1_OFFSET+8] 
SRC1_BYTE2 := SRC1[BLK1_OFFSET+23:BLK1_OFFSET+16] 
SRC1_BYTE3 := SRC1[BLK1_OFFSET+31:BLK1_OFFSET+24] 
SRC1_BYTE4 := SRC1[BLK1_OFFSET+39:BLK1_OFFSET+32] 
SRC1_BYTES := SRC1[BLK1_OFFSET+47:BLK1_OFFSET+40] 
SRC1_BYTE6 := SRC1[BLK1_OFFSET+55:BLK1_OFFSET+48] 
SRC1_BYTE7 := SRC1[BLK1_OFFSET+63:BLK1_OFFSET+56] 
SRC1_BYTE8 := SRC1[BLK1_OFFSET+71:BLK1_OFFSET+64] 
SRC1_BYTE9 := SRC1[BLK1_OFFSET+79:BLK1_OFFSET+72] 
SRC1_BYTE10 := SRC1[BLK1_OFFSET+87:BLK1_OFFSET+80] 
SRC2_BYTEO := SRC2[BLK2_OFFSET+7:BLK2_OFFSET] 
SRC2_BYTE1 := SRC2[BLK2_OFFSET+15:BLK2_OFFSET+8] 
SRC2_BYTE2 := SRC2[BLK2_OFFSET+23:BLK2_OFFSET+16] 
SRC2_BYTE3 := SRC2[BLK2_OFFSET+31:BLK2_OFFSET+24] 


TEMPO := ABS(SRC1_BYTEO - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE1 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE2 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE3 - SRC2_BYTE3) 
DEST[15:0] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE1 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE2 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE3 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE4 - SRC2_BYTE3) 
DEST[31:16] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE2 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE3 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE4 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES5 - SRC2_BYTE3) 
DEST[47:32] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE3 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE4 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES5 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE6 - SRC2_BYTE3) 
DEST[63:48] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE4 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTES5 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE6 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE7 - SRC2_BYTE3) 
DEST[79:64] := TEMPO + TEMP1 + TEMP2 + TEMP3 
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TEMPO := ABS(SRC1_BYTES5 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE6 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE7 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES8 - SRC2_BYTE3) 
DEST[95:80] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE6 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE7 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES8 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES - SRC2_BYTE3) 
DEST[111:96] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE7 - SRC2_BYTEO) 

TEMP1 := ABS(SRC1_BYTES8 - SRC2_BYTE1) 

TEMP2 := ABS(SRC1_BYTES - SRC2_BYTE2) 

TEMP3 := ABS(SRC1_BYTE10 - SRC2_BYTE3) 
DEST[127:112] := TEMPO + TEMP1 + TEMP2 + TEMP3 


BLK2_OFFSET := imm8[4:3]*32 + 128 

BLK1_OFFSET := imm8[5]*32 + 128 

SRC1_BYTEO := SRC1[BLK1_OFFSET+7:BLK1_OFFSET] 
SRC1_BYTE1 := SRC1[BLK1_OFFSET+15:BLK1_OFFSET+8] 
SRC1_BYTE2 := SRC1[BLK1_OFFSET+23:BLK1_OFFSET+16] 
SRC1_BYTE3 := SRC1[BLK1_OFFSET+31:BLK1_OFFSET+24] 
SRC1_BYTE4 := SRC1[BLK1_OFFSET+39:BLK1_OFFSET+32] 
SRC1_BYTES5 := SRC1[BLK1_OFFSET+47:BLK1_OFFSET+40] 
SRC1_BYTE6 := SRC1[BLK1_OFFSET+55:BLK1_OFFSET+48] 
SRC1_BYTE7 := SRC1[BLK1_OFFSET+63:BLK1_OFFSET+56] 
SRC1_BYTE8 := SRC1[BLK1_OFFSET+71:BLK1_OFFSET+64] 
SRC1_BYTE9 := SRC1[BLK1_OFFSET+79:BLK1_OFFSET+72] 
SRC1_BYTE10 := SRC1[BLK1_OFFSET+87:BLK1_OFFSET+80] 


SRC2_BYTEO := SRC2[BLK2_OFFSET+7:BLK2_OFFSET] 
SRC2_BYTE1 := SRC2[BLK2_OFFSET+15:BLK2_OFFSET+8] 
SRC2_BYTE2 := SRC2[BLK2_OFFSET+23:BLK2_OFFSET+16] 
SRC2_BYTE3 := SRC2[BLK2_OFFSET+31:BLK2_OFFSET+24] 


TEMPO := ABS(SRC1_BYTEO - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE1 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE2 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE3 - SRC2_BYTE3) 
DEST[143:128] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE1 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE2 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE3 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE4 - SRC2_BYTE3) 
DEST[159:144] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE2 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE3 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE4 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES5 - SRC2_BYTE3) 
DEST[175:160] := TEMPO + TEMP1 + TEMP2 + TEMP3 
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TEMPO := ABS(SRC1_BYTE3 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE4 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE6 - SRC2_BYTE3) 
DEST[191:176] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE4 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTES - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE6 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE7 - SRC2_BYTE3) 
DEST[207:192] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTES5 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE6 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE7 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES8 - SRC2_BYTE3) 
DEST[223:208] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE6 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE7 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES8 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES - SRC2_BYTE3) 
DEST[239:224] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE7 - SRC2_BYTEO) 

TEMP1 := ABS(SRC1_BYTES8 - SRC2_BYTE1) 

TEMP2 := ABS(SRC1_BYTES - SRC2_BYTE2) 

TEMP3 := ABS(SRC1_BYTE10 - SRC2_BYTE3) 
DEST[255:240] := TEMPO + TEMP1 + TEMP2 + TEMP3 


VMPSADBW (VEX.128 encoded version) 

BLK2_OFFSET := imm8[1:0]*32 

BLK1_OFFSET := imm8[2]*32 

SRC1_BYTEO := SRC1[BLK1_OFFSET+7:BLK1_OFFSET] 
SRC1_BYTE1 := SRC1[BLK1_OFFSET+15:BLK1_OFFSET+8] 
SRC1_BYTE2 := SRC1[BLK1_OFFSET+23:BLK1_OFFSET+16] 
SRC1_BYTE3 := SRC1[BLK1_OFFSET+31:BLK1_OFFSET+24] 
SRC1_BYTE4 := SRC1[BLK1_OFFSET+39:BLK1_OFFSET+32] 
SRC1_BYTES := SRC1[BLK1_OFFSET+47:BLK1_OFFSET+40] 
SRC1_BYTE6 := SRC1[BLK1_OFFSET+55:BLK1_OFFSET+48] 
SRC1_BYTE7 := SRC1[BLK1_OFFSET+63:BLK1_OFFSET+56] 
SRC1_BYTE8 := SRC1[BLK1_OFFSET+71:BLK1_OFFSET+64] 
SRC1_BYTES := SRC1[BLK1_OFFSET+79:BLK1_OFFSET+72] 
SRC1_BYTE10 := SRC1[BLK1_OFFSET+87:BLK1_OFFSET+80] 


SRC2_BYTEO := SRC2[BLK2_OFFSET+7:BLK2_OFFSET] 
SRC2_BYTE1 := SRC2[BLK2_OFFSET+15:BLK2_OFFSET+8] 
SRC2_BYTE2 := SRC2[BLK2_OFFSET+23:BLK2_OFFSET+16] 
SRC2_BYTE3 := SRC2[BLK2_OFFSET+31:BLK2_OFFSET+24] 
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TEMPO := ABS(SRC1_BYTEO - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE1 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE2 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE3 - SRC2_BYTE3) 
DEST[15:0] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE1 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE2 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE3 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE4 - SRC2_BYTE3) 
DEST[31:16] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE2 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE3 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE4 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES5 - SRC2_BYTE3) 
DEST[47:32] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE3 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE4 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES5 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE6 - SRC2_BYTE3) 
DEST[63:48] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE4 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTES5 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE6 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTE7 - SRC2_BYTE3) 
DEST[79:64] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTES5 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE6 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTE7 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES8 - SRC2_BYTE3) 
DEST[95:80] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE6 - SRC2_BYTEO) 
TEMP1 := ABS(SRC1_BYTE7 - SRC2_BYTE1) 
TEMP2 := ABS(SRC1_BYTES8 - SRC2_BYTE2) 
TEMP3 := ABS(SRC1_BYTES - SRC2_BYTE3) 
DEST[111:96] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS(SRC1_BYTE7 - SRC2_BYTEO) 

TEMP1 := ABS(SRC1_BYTES8 - SRC2_BYTE1) 

TEMP2 := ABS(SRC1_BYTES - SRC2_BYTE2) 

TEMP3 := ABS(SRC1_BYTE10 - SRC2_BYTE3) 
DEST[127:112] := TEMPO + TEMP1 + TEMP2 + TEMP3 
DEST[MAXVL-1:128] := 0 
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MPSADBW (128-bit Legacy SSE version) 

SRC_OFFSET := imm8[1:0]*32 

DEST_OFFSET := imm8[2]*32 

DEST_BYTEO := DEST[DEST_OFFSET+7:DEST_OFFSET] 
DEST_BYTE1 := DEST[DEST_OFFSET+15:DEST_OFFSET+8] 
DEST_BYTE2 := DEST[DEST_OFFSET+23:DEST_OFFSET+16] 
DEST_BYTE3 := DEST[DEST_OFFSET+31:DEST_OFFSET+24] 
DEST_BYTE4 := DEST[DEST_OFFSET+39:DEST_OFFSET+32] 
DEST_BYTES := DEST[DEST_OFFSET+47:DEST_OFFSET+40] 
DEST_BYTE6 := DEST[DEST_OFFSET+55:DEST_OFFSET+48] 
DEST_BYTE7 := DEST[DEST_OFFSET+63:DEST_OFFSET+56] 
DEST_BYTES8 := DEST[DEST_OFFSET+71:DEST_OFFSET+64] 
DEST_BYTES := DEST[DEST_OFFSET+79:DEST_OFFSET+72] 
DEST_BYTE10 := DEST[DEST_OFFSET+87:DEST_OFFSET+80] 


SRC_BYTEO := SRC[SRC_OFFSET+7:SRC_OFFSET] 
SRC_BYTE1 := SRC[SRC_OFFSET+15:SRC_OFFSET+8] 
SRC_BYTE2 := SRC[SRC_OFFSET+23:SRC_OFFSET+16] 
SRC_BYTE3 := SRC[SRC_OFFSET+31:SRC_OFFSET+24] 


TEMPO := ABS( DEST_BYTEO - SRC_BYTEO 
TEMP1 := ABS( DEST_BYTE1 - SRC_BYTE1 
TEMP2 := ABS( DEST_BYTE2 - SRC_BYTE2 
TEMP3 := ABS( DEST_BYTE3 - SRC_BYTE3 
DEST[15:0] := TEMPO + TEMP1 + TEMP2 + TEMP3 


Se Ye YH DS 


TEMPO := ABS( DEST_BYTE1 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTE2 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTE3 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTE4 - SRC_BYTE3) 
DEST[31:16] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS( DEST_BYTE2 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTE3 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTE4 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTES5 - SRC_BYTE3) 
DEST[47:32] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS( DEST_BYTE3 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTE4 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTES5 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTE6 - SRC_BYTE3) 
DEST[63:48] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS( DEST_BYTE4 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTES5 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTE6 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTE7 - SRC_BYTE3) 
DEST[79:64] := TEMPO + TEMP1 + TEMP2 + TEMP3 
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TEMPO := ABS( DEST_BYTES5 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTE6 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTE7 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTES8 - SRC_BYTE3) 
DEST[95:80] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS( DEST_BYTE6 - SRC_BYTEO) 
TEMP1 := ABS( DEST_BYTE7 - SRC_BYTE1) 
TEMP2 := ABS( DEST_BYTES8 - SRC_BYTE2) 
TEMP3 := ABS( DEST_BYTE9 - SRC_BYTE3) 
DEST[111:96] := TEMPO + TEMP1 + TEMP2 + TEMP3 


TEMPO := ABS( DEST_BYTE7 - SRC_BYTEO) 

TEMP1 := ABS( DEST_BYTES8 - SRC_BYTE1) 

TEMP2 := ABS( DEST_BYTE9 - SRC_BYTE2) 

TEMP3 := ABS( DEST_BYTE10 - SRC_BYTE3) 
DEST[127:112] := TEMPO + TEMP1 + TEMP2 + TEMP3 
DEST[MAXVL-1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
(V)JMPSADBW: __m128i_mm_mpsadbw_epu8 (__m128is1,__m128i s2, const int mask); 


VMPSADBW: m256i_mm256_mpsadbw_epu8 (__m256i s1,__ m256i s2, const int mask); 


Flags Affected 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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MUL—Unsigned Multiply 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
F6 /4 MUL r/m8 M Valid Valid Unsigned multiply (AX := AL * r/m8). 
REX + F6 /4 MUL r/m&” M Valid N.E. Unsigned multiply (AX := AL * r/m8). 
F7 /4 MUL r/m16 M Valid Valid Unsigned multiply (DX:AX := AX * r/m76). 
F7 /4 MUL r/m32 M Valid Valid Unsigned multiply (EDX:EAX := EAX * r/m32). 
REX.W + F7 /4 MUL r/m64 M Valid N.E. Unsigned multiply (RDX:RAX := RAX * r/m64). 
NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Performs an unsigned multiplication of the first operand (destination operand) and the second operand (source 

operand) and stores the result in the destination operand. The destination operand is an implied operand located in 
register AL, AX or EAX (depending on the size of the operand); the source operand is located in a general-purpose 
register or a memory location. The action of this instruction and the location of the result depends on the opcode 
and the operand size as shown in Table 4-9. 


The result is stored in register AX, register pair DX:AX, or register pair EDX:EAX (depending on the operand size), 
with the high-order bits of the product contained in register AH, DX, or EDX, respectively. If the high-order bits of 
the product are 0, the CF and OF flags are cleared; otherwise, the flags are set. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi- 
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. 


See the summary chart at the beginning of this section for encoding data and limits. 


Table 4-9. MUL Results 


Operand Size Source 1 Source 2 Destination 
Byte AL r/m8 AX 
Word AX r/m16 DX:AX 
Doubleword EAX r/m32 EDX:EAX 
Quadword RAX r/m64 RDX:RAX 
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Operation 


IF (Byte operation) 
THEN 
AX := AL * SRC; 
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ELSE (* Word or doubleword operation *) 
IF OperandSize = 16 


THEN 


DX:AX := AX * SRC; 
ELSE IF OperandSize = 32 
THEN EDX:EAX := EAX * SRC; Fl; 
ELSE (* OperandSize = 64 *) 
RDX:RAX := RAX * SRC; 


Fl; 
Fl; 


Flags Affected 


The OF and CF flags are set to 0 if the upper half of the result is 0; otherwise, they are set to 1. The SF, ZF, AF, and 
PF flags are undefined. 


Protected Mode Exceptions 


#GP(0) 
#SS(0) 
#PF(fault-code) 
#AC(0) 


#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#SS 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 

#SS(0) 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If alignment checking is enabled and an unaligned memory reference is made. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 


Same exceptions as 


in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 
#PF(fault-code) 
#AC(0) 
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If a memory address referencing the SS segment is in a non-canonical form. 
If the memory address is in a non-canonical form. 
If a page fault occurs. 


If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
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MULPD—Multiply Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
66 OF 59 /r A VV SSE2 Multiply packed double-precision floating-point values 
MULPD xmm1, xmm2/m128 in xmm2/m128 with xmm1 and store result in xmm1. 
VEX.128.66.0F.WIG 59 /r B VV AVX Multiply packed double-precision floating-point values 
VMULPD xmm1,xmme2, xmm3/m128 in xmm3/m128 with xmm2 and store result in xmm1. 
VEX.256.66.0F.WIG 59 /r B VV AVX Multiply packed double-precision floating-point values 
VMULPD ymm1, ymm2, ymm3/m256 in ymm3/m256 with ymm_2 and store result in ymm1. 
EVEX.128.66.0F.W1 59 /r C VV AVX512VL | Multiply packed double-precision floating-point values 
VMULPD xmm1 {k1}{z}, xmm2, AVX512F from xmm3/m128/m64bcst to xmmz and store result 
xmm3/m128/m64bcst in xmm1. 
EVEX.256.66.0F.W1 59 /r C VIV AVX512VL | Multiply packed double-precision floating-point values 
VMULPD ymm1 {k1}{z}, ymm2, AVX512F from ymm3/m256/m64bcst to ymm2 and store result 
ymm3/m256/m64bcst in ymm1. 
EVEX.512.66.0F.W1 59 /r C VIV AVX512F Multiply packed double-precision floating-point values 
VMULPD zmm1 {k1}{z}, zmm2, in zmm3/m512/m64bcst with zmm_2 and store result 
zmm3/m512/m64bcst{er} inzmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiply packed double-precision floating-point values from the first source operand with corresponding values in 
the second source operand, and stores the packed double-precision floating-point results in the destination 
operand. 


EVEX encoded versions: The first source operand (the second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. Bits (MAXVL-1:256) of the corre- 
sponding destination ZMM register are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the destination YMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VMULPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] := SRC1[i+63:i] * SRC2[63:0] 
ELSE 
DEST[i+63:i] = SRC1[i+63:i] * SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMULPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] * SRC2[63:0] 
DEST[127:64] := SRC1[127:64] * SRC2[127:64] 
DEST[191:128] := SRC1[191:128] * SRC2[191:128] 
DEST[255:192] := SRC1[255:192] * SRC2[255:192] 
DEST[MAXVL-1:256] := 0; 


VMULPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] * SRC2[63:0] 
DEST[127:64] := SRC1[127:64] * SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


MULPD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] * SRC[63:0] 
DEST[127:64] := DEST[127:64] * SRC[127:64] 
DEST[MAXVL-1:1 28] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VMULPD __m512d_mm512_mul_pd(__m512d a,__m512db); 

VMULPD __m512d_mm512_mask_mul_pd(__m512ds,__mmask8 k,__m512d a, 
VMULPD __m512d_mm512_maskz_mul_pd(__mmask8 k,__m512d a,__m512d b); 

VMULPD __m512d_mm512_mul_round_pd(__m512da,__m512d5, int); 

VMULPD __m512d_mm512_mask_mul_round_pd(__m512ds,__mmask8 k,__m512da,__m512db, int); 
VMULPD __m512d_mm512_maskz_mul_round_pd(__mmask8 k,__m512da,__m512d 5, int); 

VMULPD __m256d __mm256_mul_pd (__m256d a, __m256d b); 

MULPD __m128d_mm_mul_pd (__m128d a, _m128d b); 


m512d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MULPS—Multiply Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 59 /r A VIV SSE Multiply packed single-precision floating-point values in 
MULPS xmm1, xmm2/m128 xmm2/m128 with xmm1 and store result in xmm1. 
VEX.128.0F.WIG 59 /r B VIV AVX Multiply packed single-precision floating-point values in 
VMULPS xmm1,xmm_2, xmm3/m128 xmm3/m128 with xmm2 and store result in xmm1. 
VEX.256.0F.WIG 59 /r B VIV AVX Multiply packed single-precision floating-point values in 
VMULPS ymm1, ymm2, ymm3/m256 ymm3/m256 with ymm2 and store result in ymm1. 
EVEX.128.0F.WO 59 /r C VIV AVX512VL | Multiply packed single-precision floating-point values 
VMULPS xmm1 {k1}{z}, xmm2, AVX512F from xmm3/m128/m32bcst to xmm2 and store result in 
xmm3/m128/m32bcst xmm1. 
EVEX.256.0F.WO 59 /r C VIV AVX512VL | Multiply packed single-precision floating-point values 
VMULPS ymm1 {k1}{z}, ymm2, AVX512F from ymm3/m256/m32bcst to ymm2 and store result in 
ymm3/m256/m32bcst ymm1. 
EVEX.512.0F.WO 59 /r C VIV AVX512F Multiply packed single-precision floating-point values in 
VMULPS zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst with zmm2 and store result in 
zmm3/m51 2/m32bcst {er} zmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Multiply the packed single-precision floating-point values from the first source operand with the corresponding 
values in the second source operand, and stores the packed double-precision floating-point results in the destina- 


tion operand. 


EVEX encoded versions: The first source operand (the second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 


updated with writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 


register or a 256-bit memory location. The destination operand is a YMM register. Bits (MAXVL-1:256) of the corre- 
sponding destination ZMM register are zeroed. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the destination YMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. 
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Operation 


VMULPS (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] := SRC1[i+31:i] * SRC2[31:0] 
ELSE 
DEST[i+31:i] = SRC1[i+31:i] * SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VMULPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] * SRC2[31:0] 
DEST[63:32] := SRC1[63:32] * SRC2[63:32] 
DEST[95:64] := SRC1[95:64] * SRC2[95:64] 
DEST[127:96] := SRC1[127:96] * SRC2[127:96] 
DEST[159:128] := SRC1[159:128] * SRC2[159:1 28] 
DEST[191:160] := SRC1[191:160] * SRC2[191:160] 
DEST[223:192] := SRC1[223:192] * SRC2[223:192] 
DEST[255:224] := SRC1[255:224] * SRC2[255:224]. 
DEST[MAXVL-1:256] := 0; 


VMULPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] * SRC2[31:0] 
DEST[63:32] := SRC1[63:32] * SRC2[63:32] 
DEST[95:64] := SRC1[95:64] * SRC2[95:64] 
DEST[127:96] := SRC1[127:96] * SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


MULPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] * SRC2[31:0] 
DEST[63:32] := SRC1[63:32] * SRC2[63:32] 
DEST[95:64] := SRC1[95:64] * SRC2[95:64] 
DEST[127:96] := SRC1[127:96] * SRC2[127:96] 
DEST[MAXVL-1:128] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VMULPS __m512_mm512_mul_ps(__m512 a,__m512 b); 

VMULPS __m512_mm512_mask_mul_ps(__m512s,__ mmask16 k,__m512 a, 
VMULPS __m512 _mm512_maskz_mul_ps(__mmask16 k,__m512 a,__m512 b); 
VMULPS __m512 _mm512_mul_round_ps(__m512 a,__m512 b, int); 


m512 b); 


VMULPS __m512 _mm512_mask_mul_round_ps(__m512 s,__mmask16 k,__m512 a,__m512 5, int); 


VMULPS __m512 _mm512_maskz_mul_round_ps(__mmask16 k,__m512 a,__m512 5, int); 
VMULPS __m256 _mm256_mask_mul_ps(__m256 s,__ mmask8 k,__m256 a,__m256 b); 
VMULPS __m256 _mm256_maskz_mul_ps(__mmask8 k,__m256 a,__ m256 b); 

VMULPS __m128 _mm_mask_mul_ps(__m128s,__ mmask8 k,__m128 a,__m128 b); 
VMULPS __m128 _mm_maskz_mul_ps(__mmask8 k,__m128 a,__m128 b); 

VMULPS __m256 _mm256_mul_ps (__m256 a, __m256 b); 

MULPS __m128_mm_mul_ps (_m128 a,__m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”. 
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MULSD—Multiply Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
F2 OF 59 /r A VIV SSE2 Multiply the low double-precision floating-point value in 
MULSD xmm1,xmm2/m64 xmm2/m64 by low double-precision floating-point 
value in xmm1. 
VEX.LIG.F2.0F.WIG 59 /r B VIV AVX Multiply the low double-precision floating-point value in 
VMULSD xmm1,xmm2, xmm3/m64 xmm3/m64 by low double-precision floating-point 
value in xmm2. 
EVEX.LLIG.F2.0F.W1 59 /r C VIV AVX512F Multiply the low double-precision floating-point value in 
VMULSD xmm1 {k1}{z}, xmm2, xmm3/m64 by low double-precision floating-point 
xmm3/m64 {er} value in xmmz. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the low double-precision floating-point value in the second source operand by the low double-precision 
floating-point value in the first source operand, and stores the double-precision floating-point result in the destina- 
tion operand. The second source operand can be an XMM register or a 64-bit memory location. The first source 
operand and the destination operands are XMM registers. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:64) of the corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded version: The quadword at bits 127:64 of the destination operand is copied from the 
same bits of the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMULSD is encoded with VEX.L=0. Encoding VMULSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


VMULSD (EVEX encoded version) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := SRC1[63:0] * SRC2[63:0] 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl 
Fl; 
ENDFOR 


DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] = 0 


VMULSD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] * SRC2[63:0] 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


MULSD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] * SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
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VMULSD __m128d_mm_mask_mul_sd(__m128d s,__ mmask8 k,__m128d a,__m128d b); 


VMULSD __m128d _mm_maskz_mul_sd(__mmask8 k, 
VMULSD __m128d_mm_mul_round_sd(__m128da,__m128d 5, int); 


VMULSD __m128d _mm_mask_mul_round_sd(__m128d s,__ mmask8 k, 
VMULSD __m128d _mm_maskz_mul_round_sd(__mmask8 k,___m128d a, 


MULSD __m128d_mm_mul_sd (__m128d a,__m128d b) 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


m128d a,__m128d b); 


m128d a,__m128d b, int); 
m1 28d b, int); 


Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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MULSS—Multiply Scalar Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF 59 /r A VIV SSE Multiply the low single-precision floating-point value in 
MULSS xmm1,xmm2/m32 xmm2/m32 by the low single-precision floating-point 
value in xmm1. 
VEX.LIG.F3.0F.WIG 59 /r B VIV AVX Multiply the low single-precision floating-point value in 
VMULSS xmm1,xmm2, xmm3/m32 xmm3/m32 by the low single-precision floating-point 
value in xmm2. 
EVEX.LLIG.F3.0F.WO 59 /r C VV AVX512F Multiply the low single-precision floating-point value in 
VMULSS xmm1 {k1}{z}, xmme2, xmm3/m32 by the low single-precision floating-point 
xmm3/m32 {er} value in xmm2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the low single-precision floating-point value from the second source operand by the low single-precision 
floating-point value in the first source operand, and stores the single-precision floating-point result in the destina- 
tion operand. The second source operand can be an XMM register or a 32-bit memory location. The first source 
operand and the destination operands are XMM registers. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 and EVEX encoded version: The first source operand is an xmm register encoded by VEX.vvvv. The three 
high-order doublewords of the destination operand are copied from the first source operand. Bits (MAXVL-1:128) 
of the destination register are zeroed. 


EVEX encoded version: The low doubleword element of the destination operand is updated according to the 
writemask. 


Software should ensure VMULSS is encoded with VEX.L=0. Encoding VMULSS with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


VMULSS (EVEX encoded version) 
IF (EVEX.b = 1) AND SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := SRC1[31:0] * SRC2[31:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl 
Fl; 
ENDFOR 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] = 0 


VMULSS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] * SRC2[31:0] 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


MULSS (128-bit Legacy SSE version) 
DEST[31:0] := DEST[31:0] * SRC[31:0] 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VMULSS __m128_mm_mask_mul_ss(__m128s,__ mmask8 k,__m128 a,__m128 b); 


VMULSS __m128_mm_maskz_mul_ss(__mmask8 k,__m128 a, 
VMULSS __m128_mm_mul_round_ss(__m128 a,__m128b, int); 
VMULSS __m128_mm_mask_mul_round_ss(__m128 s,__mmask8 k, 


m128 b); 


m128 a, 


m128 b, int); 


VMULSS __m128_mm_maskz_mul_round_ss(__mmask8 k,__m128 a,__m128b, int); 


MULSS __m128_mm_mul_ss(__m128 a,__m128 b) 


SIMD Floating-Point Exceptions 
Underflow, Overflow, Invalid, Precision, Denormal 


Other Exceptions 
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Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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MULX — Unsigned Multiply Without Affecting Flags 


Opcode/ Op/ 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode | Flag 
VEX.LZ.F2.0F38.W0O F6 /r RVM | V/V BMI2 Unsigned multiply of r/m32 with EDX without affecting arithmetic 
MULX r32a, r32b, r/m32 flags. 
VEX.LZ.F2.0F38.W1 F6 /r RVM | V/N.E. | BMI2 Unsigned multiply of r/m64 with RDX without affecting arithmetic 
MULX r64a, r64b, r/m64 flags. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvwv (w) ModRMsr/m (r) RDMEDISS ee eee its 
Description 


Performs an unsigned multiplication of the implicit source operand (EDX/RDX) and the specified source operand 
(the third operand) and stores the low half of the result in the second destination (Second operand), the high half 
of the result in the first destination operand (first operand), without reading or writing the arithmetic flags. This 
enables efficient programming where the software can interleave add with carry operations and multiplications. 

If the first and second operand are identical, it will contain the high half of the multiplication result. 

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 


// DEST1: ModRM:reg 
// DEST2: VEX.vwvv 
IF (OperandSize = 32) 
SRC1 := EDX; 
DEST2 := (SRC1*SRC2)[31:0]; 
DEST1 := (SRC1*SRC2)[63:32]; 
ELSE IF (OperandSize = 64) 
SRC1 := RDX; 
DEST2 := (SRC1*SRC2)[63:0]; 
DEST1 := (SRC1*SRC2)[1 27:64]; 
Fl 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 
Auto-generated from high-level language when possible. 
unsigned int mulx_u32(unsigned int a, unsigned int b, unsigned int * hi); 


unsigned __ int64 mulx_u64(unsigned __int64 a, unsigned __int64 b, unsigned __int64 * hi); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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MWAIT—Monitor Wait 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 01 C9 MWAIT ZO ‘| Valid Valid A hint that allows the processor to stop 


instruction execution and enter an 
implementation-dependent optimized state 
until occurrence of a class of events. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


MWAIT instruction provides hints to allow the processor to enter an implementation-dependent optimized state. 
There are two principal targeted usages: address-range monitor and advanced power management. Both usages 
of MWAIT require the use of the MONITOR instruction. 


CPUID.01H:ECX.MONITOR[bit 3] indicates the availability of MONITOR and MWAIT in the processor. When set, 
MWAIT may be executed only at privilege level 0 (use at any other privilege level results in an invalid-opcode 
exception). The operating system or system BIOS may disable this instruction by using the IA32_MISC_ENABLE 
MSR; disabling MWAIT clears the CPUID feature flag and causes execution to generate an invalid-opcode excep- 
tion. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


ECX specifies optional extensions for the MWAIT instruction. EAX may contain hints such as the preferred optimized 
state the processor should enter. The first processors to implement MWAIT supported only the zero value for EAX 
and ECX. Later processors allowed setting ECX[0] to enable masked interrupts as break events for MWAIT (see 

below). Software can use the CPUID instruction to determine the extensions and hints supported by the processor. 


MWAIT for Address Range Monitoring 


For address-range monitoring, the MWAIT instruction operates with the MONITOR instruction. The two instructions 
allow the definition of an address at which to wait (MONITOR) and a implementation-dependent-optimized opera- 
tion to commence at the wait address (MWAIT). The execution of MWAIT is a hint to the processor that it can enter 
an implementation-dependent-optimized state while waiting for an event or a store operation to the address range 
armed by MONITOR. 


The following cause the processor to exit the implementation-dependent-optimized state: a store to the address 
range armed by the MONITOR instruction, an NMI or SMI, a debug exception, a machine check exception, the 
BINIT# signal, the INIT# signal, and the RESET# signal. Other implementation-dependent events may also cause 
the processor to exit the implementation-dependent-optimized state. 


In addition, an external interrupt causes the processor to exit the implementation-dependent-optimized state 
either (1) if the interrupt would be delivered to software (e.g., as it would be if HLT had been executed instead of 
MWAIT); or (2) if ECX[0] = 1. Software can execute MWAIT with ECX[0] = 1 only if CPUID.O5H:ECX[bit 1] = 1. 
(Implementation-specific conditions may result in an interrupt causing the processor to exit the implementation- 
dependent-optimized state even if interrupts are masked and ECX[0] = 0.) 


Following exit from the implementation-dependent-optimized state, control passes to the instruction following the 
MWAIT instruction. A pending interrupt that is not masked (including an NMI or an SMI) may be delivered before 
execution of that instruction. Unlike the HLT instruction, the MWAIT instruction does not support a restart at the 
MWATIT instruction following the handling of an SMI. 


If the preceding MONITOR instruction did not successfully arm an address range or if the MONITOR instruction has 
not been executed prior to executing MWAIT, then the processor will not enter the implementation-dependent-opti- 
mized state. Execution will resume at the instruction following the MWAIT. 
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MWAIT for Power Management 


MWAIT accepts a hint and optional extension to the processor that it can enter a specified target C state while 
waiting for an event or a store operation to the address range armed by MONITOR. Support for MWAIT extensions 
for power management is indicated by CPUID.O5H:ECX[bit 0] reporting 1. 


EAX and ECX are used to communicate the additional information to the MWAIT instruction, such as the kind of 

optimized state the processor should enter. ECX specifies optional extensions for the MWAIT instruction. EAX may 
contain hints such as the preferred optimized state the processor should enter. Implementation-specific conditions 
may cause a processor to ignore the hint and enter a different optimized state. Future processor implementations 
may implement several optimized “waiting” states and will select among those states based on the hint argument. 


Table 4-10 describes the meaning of ECX and EAX registers for MWAIT extensions. 


Table 4-10. MWAIT Extension Register (ECX) 


Bits Description 
0 Treat interrupts as break events even if masked (e.g., even if EFLAGS.IF=0), May be set only if 
CPUID.O5H:ECX[bit 1] = 1. 
31:1 Reserved 


Table 4-11. MWAIT Hints Register (EAX) 
Bits Description 
Sub C-state within a C-state, indicated by bits [7:4] 
Target C-state* 
Value of O means C1; 1 means C2 and so on 
Value of 01111B means CO 


Note: Target C states for MWAIT extensions are processor-specific C-states, not ACPI C-states 
31:8 Reserved 


Note that if MWAIT is used to enter any of the C-states that are numerically higher than C1, a store to the address 
range armed by the MONITOR instruction will cause the processor to exit MWAIT only if the store was originated by 
other processor agents. A store from non-processor agent might not cause the processor to exit MWAIT in such 
cases. 


For additional details of MWAIT extensions, see Chapter 14, “Power and Thermal Management,” of Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Operation 
(* MWAIT takes the argument in EAX as a hint extension and is architected to take the argument in ECX as an instruction extension 
MWAIT EAX, ECX *) 


{ 
WHILE ( (“Monitor Hardware is in armed state’)) { 


implementation_dependent_optimized_state(EAX, ECX); } 
Set the state of Monitor Hardware as triggered; 


} 


Intel C/C++ Compiler Intrinsic Equivalent 


MWAIT: void _mm_mwait(unsigned extensions, unsigned hints) 
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Example 


MONITOR/MWAIT instruction pair must be coded in the same loop because execution of the MWAIT instruction will 
trigger the monitor hardware. It is not a proper usage to execute MONITOR once and then execute MWAIT ina 
loop. Setting up MONITOR without executing MWAIT has no adverse effects. 


Typically the MONITOR/MWAIT pair is used in a sequence, such as: 


EAX = Logical Address(Trigger) 
ECX = 0 (*Hints *) 
EDX = 0 (* Hints *) 


IF ( !trigger_store_happened) { 

MONITOR EAX, ECX, EDX 

IF ( !trigger_store_happened ) { 

MWAIT EAX, ECX 

} 
} 
The above code sequence makes sure that a triggering store does not happen between the first check of the trigger 
and the execution of the monitor instruction. Without the second check that triggering store would go un-noticed. 
Typical usage of MONITOR and MWAIT would have the above code sequence within a loop. 


Numeric Exceptions 
None 


Protected Mode Exceptions 


#GP(0) If ECX[31:1] #0. 
If ECX[0] = 1 and CPUID.O5H:ECX([bit 1] = 0. 
#UD If CPUID.01H:ECX.MONITOR[bit 3] = 0. 


If current privilege level is not 0. 


Real Address Mode Exceptions 


#GP If ECX[31:1] #0. 
If ECX[0] = 1 and CPUID.O5H:ECX([bit 1] = 0. 
#UD If CPUID.01H:ECX.MONITOR[bit 3] = 0. 


Virtual 8086 Mode Exceptions 


#UD The MWAIT instruction is not recognized in virtual-8086 mode (even if 
CPUID.O1H:ECX.MONITOR[bit 3] = 1). 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If RCX[63:1] #0. 
If RCX[0] = 1 and CPUID.O5H:ECX[bit 1] = 0. 
#UD If the current privilege level is not 0. 


If CPUID.O1H:ECX.MONITOR[bit 3] = 0. 
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NEG—Two’'s Complement Negation 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
F6 /3 NEG r/m8 M Valid Valid Two's complement negate r/m8. 
REX + F6 /3 NEG r/m8* M Valid N.E. Two's complement negate r/m8. 
F7 /3 NEG r/m16 M Valid Valid Two's complement negate r/m16. 
F7 /3 NEG r/m32 M Valid Valid Two's complement negate r/m32. 
REX.W + F7 /3 NEG r/m64 M Valid N.E. Two's complement negate r/m64. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
Description 


Replaces the value of operand (the destination operand) with its two's complement. (This operation is equivalent 
to subtracting the operand from 0.) The destination operand is located in a general-purpose register or a memory 
location. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 


access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF DEST =O 
THEN CF := 0; 
ELSE CF := 1; 
Fl; 
DEST := [- (DEST)] 


Flags Affected 


The CF flag set to 0 if the source operand is 0; otherwise it is set to 1. The OF, SF, ZF, AF, and PF flags are set 
according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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NOP—No Operation 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
NP 90 NOP ZO | Valid Valid One byte no-operation instruction. 
NP OF 1F /0 NOP r/m16 M Valid Valid Multi-byte no-operation instruction. 
NP OF 1F /0 NOP r/m32 M Valid Valid Multi-byte no-operation instruction. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
M ModRM:r/m (r) NA NA NA 
Description 


This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up space in the instruction 
stream but does not impact machine context, except for the EIP register. 


The multi-byte form of NOP is available on processors with model encoding: 
¢ CPUID.O1H.EAX[Bytes 11:8] = 0110B or 1111B 


The multi-byte NOP instruction does not alter the content of a register and will not issue a memory operation. The 
instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. 


The multi-byte NOP instruction performs no operation on supported processors and generates undefined opcode 
exception on processors that do not support the multi-byte NOP instruction. 


The memory operand form of the instruction allows software to create a byte sequence of “no operation” as one 
instruction. For situations where multiple-byte NOPs are needed, the recommended operations (32-bit mode and 
64-bit mode) are: 


Table 4-12. Recommended Multi-Byte Sequence of NOP Instruction 


Length Assembly Byte Sequence 

2 bytes 66 NOP 66 90H 

3 bytes NOP DWORD ptr [EAX] OF 1F OOH 

4 bytes NOP DWORD ptr [EAX + OOH] OF 1F 40 OOH 

5 bytes NOP DWORD ptr [EAX + EAX*1 + OOH] OF 1F 44 00 OOH 

6 bytes 66 NOP DWORD ptr [EAX + EAX*1 + OOH] 66 OF 1F 44 00 OOH 

7 bytes NOP DWORD ptr [EAX + OOOO0000H] OF 1F 80 00 00 00 OOH 

8 bytes NOP DWORD ptr [EAX + EAX*1 + OOOO0000H] OF 1F 84 00 00 00 00 OOH 

9 bytes 66 NOP DWORD ptr [EAX + EAX*1 + OOOQO000H] 66 OF 1F 84 00 00 00 00 OOH 
Flags Affected 
None 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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NOT—One’s Complement Negation 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
F6 /2 NOT r/m8 M Valid Valid Reverse each bit of r/m8. 
REX + F6 /2 NOT r/m8* M Valid N.E. Reverse each bit of r/m8. 
F7 /2 NOT r/m16 M Valid Valid Reverse each bit of r/m76. 
F7 /2 NOT r/m32 M Valid Valid Reverse each bit of r/m32. 
REX.W + F7 /2 NOT r/m64 M Valid N.E. Reverse each bit of r/m64. 
NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
Description 


Performs a bitwise NOT operation (each 1 is set to 0, and each 0 is set to 1) on the destination operand and stores 
the result in the destination operand location. The destination operand can be a register or a memory location. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 
DEST := NOT DEST; 


Flags Affected 
None 


Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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OR—Logical Inclusive OR 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OC ib OR AL, imm8& | Valid Valid AL OR immé. 
OD iw OR AX, imm16 | Valid Valid AX OR imm76. 
OD id OR EAX, imm32 | Valid Valid EAX OR imm32. 
REX.W + OD id OR RAX, imm32 | Valid N.E. RAX OR imm32 (sign-extended). 
80/1 ib OR r/m8, imm8 MI | Valid Valid r/m8 OR imme. 
REX + 80/1 ib OR r/m8*, imm8& MI | Valid N.E. r/m8 OR imme. 
81/1 iw OR r/m16, imm16 MI | Valid Valid r/m16 OR imm16. 
81/1 id OR r/m32, imm32 MI | Valid Valid r/m32 OR imm32. 
REX.W + 81 /1 id OR r/m64, imm32 MI | Valid N.E. r/m64 OR imm32 (sign-extended). 
83 /1 ib OR r/m16, imm8 MI | Valid Valid r/m16 OR imm8 (sign-extended). 
83/1 ib OR r/m32, imm8 MI | Valid Valid r/m32 OR imm8& (sign-extended). 
REX.W + 83/1 ib OR r/m64, imm8 MI | Valid N.E. r/m64 OR imm8 (sign-extended). 
08 /r OR r/m8, r8 MR | Valid Valid r/m8 OR r8. 
REX + 08 /r OR r/m8*, r8* MR | Valid N.E. r/m8 OR r8. 
09 /r OR r/m16, r16 MR | Valid Valid r/m16 OR r16. 
09 /r OR r/m32, r32 MR | Valid Valid r/m32 OR r32. 
REX.W + 09 /r OR r/m64, r64 MR | Valid N.E. r/m64 OR r64. 
OA /r OR r8, r/m8 RM _ | Valid Valid r8 OR r/mé. 
REX + OA /r OR r8*, r/m8* RM _ | Valid N.E. r8 OR r/mé. 
OB /r OR r16, r/m16 RM _ | Valid Valid r16 OR r/m16. 
OB /r OR 32, r/m32 RM_ | Valid Valid r32 OR r/m32. 
REX.W + OB /r OR 164, r/m64 RM _ | Valid N.E. r64 OR r/m64. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Performs a bitwise inclusive OR operation between the destination (first) and source (second) operands and stores 
the result in the destination operand location. The source operand can be an immediate, a register, or a memory 
location; the destination operand can be a register or a memory location. (However, two memory operands cannot 
be used in one instruction.) Each bit of the result of the OR instruction is set to 0 if both corresponding bits of the 
first and second operands are 0; otherwise, each bit is set to 1. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 
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In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 
DEST := DEST OR SRC; 


Flags Affected 


The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is 
undefined. 


Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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ORPD—Bitwise Logical OR of Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 56/r A VIV SSE2 Return the bitwise logical OR of packed double-precision 
ORPD xmm1, xmm2/m128 floating-point values in xmm1 and xmm2/mem. 
VEX.128.66.0F 56 /r B VIV AVX Return the bitwise logical OR of packed double-precision 
VORPD xmm1,xmm2, xmm3/m128 floating-point values in xmm2 and xmm3/mem. 
VEX.256.66.0F 56 /r B VIV AVX Return the bitwise logical OR of packed double-precision 
VORPD ymm1, ymm2, ymm3/m256 floating-point values in ymm2 and ymm3/mem. 
EVEX.128.66.0F.W1 56 /r C VIV AVX512VL | Return the bitwise logical OR of packed double-precision 
VORPD xmm1 {k1}{z}, xmm2, AVX512DQ | floating-point values in xmm2 and xmm3/m128/m64bcst 
xmm3/m1 28/m64bcst subject to writemask k1. 
EVEX.256.66.0F.W1 56 /r C VIV AVX512VL | Return the bitwise logical OR of packed double-precision 
VORPD ymm1 {k1}{z}, ymm2, AVX512DQ | floating-point values in ymm2 and ymm3/m256/m64bcst 
ymm3/m256/m64bcst subject to writemask k1. 
EVEX.512.66.0F.W1 56 /r C VV AVX512DQ | Return the bitwise logical OR of packed double-precision 
VORPD zmm1 {k1}{z}, zmm2, floating-point values in zmm2 and zmm3/m512/m64bcst 
zmm3/m512/m64bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a bitwise logical OR of the two, four or eight packed double-precision floating-point values from the first 
source operand and the second source operand, and stores the result in the destination operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VORPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] := SRC1[i+63:i] BITWISE OR SRC2[63:0] 
ELSE 
DEST[i+63:i] := SRC1[i+63:i] BITWISE OR SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VORPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE OR SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE OR SRC2[1 27:64] 
DEST[191:128] := SRC1[191:128] BITWISE OR SRC2[191:128] 
DEST[255:192] := SRC1[255:192] BITWISE OR SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VORPD (VEX.128 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE OR SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE OR SRC2[1 27:64] 
DEST[MAXVL-1:128] := 0 


ORPD (128-bit Legacy SSE version) 

DEST[63:0] := DEST[63:0] BITWISE OR SRC[63:0] 
DEST[127:64] := DEST[127:64] BITWISE OR SRC[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VORPD __m512d_mm512_or_pd(__m512da,__m512d b); 


VORPD __m512d_mm512_mask_or_pd(__m512ds,__mmask8 k,__m512da,__m512d b); 
m512d b); 


VORPD __m512d_mm512_maskz_or_pd (__mmask8 k,___m512d a, 

VORPD __m256d_mm256_mask_or_pd(__m256ds,__ mmask8 k,__ m256d a,___ m256d b); 
VORPD __m256d _mm256_maskz_or_pd (__mmask8 k, __ m256d a, 

VORPD __m128d_mm_mask_or_pd(__m128ds,__ mmask8 k,___m128da,__m128d b); 
VORPD __m128d _mm_maskz_or_pd (__mmask8 k,___m128d a,__m128d b); 


VORPD __m256d_mm256_or_pd (__m256d a, ___m256d b); 
ORPD __m128d_mm_or_pd (__m128d a,__m128d b); 
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SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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ORPS—Bitwise Logical OR of Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 56 /r A VIV SSE Return the bitwise logical OR of packed single-precision 
ORPS xmm1, xmm2/m128 floating-point values in xmm1 and xmm2/mem. 
VEX.128.0F 56 /r B VIV AVX Return the bitwise logical OR of packed single-precision 
VORPS xmm1,xmm2, xmm3/m128 floating-point values in xmm2 and xmm3/mem. 
VEX.256.0F 56 /r B VIV AVX Return the bitwise logical OR of packed single-precision 
VORPS ymm1, ymm2, ymm3/m256 floating-point values in ymm2 and ymm3/mem. 
EVEX.128.0F.WO 56 /r C VIV AVX512VL | Return the bitwise logical OR of packed single-precision 
VORPS xmm1 {k1}{z}, xmm2, AVX512DQ | floating-point values in xmm2 and xmm3/m128/m32bcst 
xmm3/m128/m32bcst subject to writemask k1. 
EVEX.256.0F.WO 56 /r C VIV AVX512VL | Return the bitwise logical OR of packed single-precision 
VORPS ymm1 {k1}{z}, ymm2, AVX512DQ | floating-point values in ymm2 and ymm3/m256/m32bcst 
ymm3/m256/m32bcst subject to writemask k1. 
EVEX.512.0F.W0 56 /r € VV AVX512DQ | Return the bitwise logical OR of packed single-precision 
VORPS zmm1 {k1}{z}, zmm2, floating-point values in zmm2 and zmm3/m512/m32bcst 
zmm3/m512/m32bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a bitwise logical OR of the four, eight or sixteen packed single-precision floating-point values from the 
first source operand and the second source operand, and stores the result in the destination operand 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VORPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 

i:=j* 32 

IF k1[j] OR *no writemask* 

THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN 


DEST[i+31:i] = SRC1[i+31:i] BITWISE OR SRC2[31:0] 


ELSE 


DEST[i+31:i] = SRC1[i+31:i] BITWISE OR SRC2[i+31:i] 


Fl; 
ELSE 
IF *merging-masking* 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VORPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE OR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE OR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE OR SRC2[127:96] 
DEST[159:128] := SRC1[159:128] BITWISE OR SRC2[159:128] 
DEST[191:160] := SRC1[191:160] BITWISE OR SRC2[191:160] 
DEST[223:192] := SRC1[223:192] BITWISE OR SRC2[223:192] 


DEST[255:224] := SRC1[255:224] BITWISE OR SRC2[255:224]. 


DEST[MAXVL-1:256] := 0 


VORPS (VEX.128 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE OR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE OR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE OR SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


ORPS (128-bit Legacy SSE version) 

DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE OR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE OR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE OR SRC2[1 27:96] 
DEST[MAXVL-1:128] (Unmodified) 
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; merging-masking 


; zeroing-masking 


ORPS—Bitwise Logical OR of Packed Single Precision Floating-Point Values 


Intel C/C++ Compiler Intrinsic Equivalent 
VORPS __m512_mm512_or_ps(__m512a,__m512 b); 


VORPS __m512_mm512_mask_or_ps (__m512s,__mmask16k,__m512 a,__m512 b); 
VORPS __m512_mm512_maskz_or_ps (__mmask16 k,__m512 a,__m512 b); 
VORPS __m256_mm256_mask_or_ps (_m256s,___ mmask8k,__ m256 a,__ M256 b); 


VORPS __m256 _mm256_maskz_or_ps (__mmask8 k,__m256 a,__m256 b); 
VORPS __m128_mm_mask_or_ps (__m128s,__mmask8k,__m128 a,__m128 b); 
VORPS __m128_mm_maskz_or_ps (__mmask8 k,__m128a,__m128 b); 

VORPS __m256_mm256_or_ps (_m256 a,__m256 b); 

ORPS __m128_mm_or_ps (_m128a,__m128 b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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OUT—Output to Port 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
E6 ib OUT immé, AL | Valid Valid Output byte in AL to I/O port address imm8. 
E7 ib OUT immé, AX | Valid Valid Output word in AX to I/O port address immé. 
E7 ib OUT immé, EAX | Valid Valid Output doubleword in EAX to I/O port address 
immé. 
EE OUT DX, AL ZO | Valid Valid Output byte in AL to I/O port address in DX. 
EF OUT DX, AX ZO | Valid Valid Output word in AX to I/O port address in DX. 
EF OUT DX, EAX ZO | Valid Valid Output doubleword in EAX to I/O port address 
in DX. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| imm8 NA NA NA 
ZO NA NA NA NA 
Description 


Copies the value from the second operand (source operand) to the I/O port specified with the destination operand 
(first operand). The source operand can be register AL, AX, or EAX, depending on the size of the port being 
accessed (8, 16, or 32 bits, respectively); the destination operand can be a byte-immediate or the DX register. 
Using a byte immediate allows I/O port addresses 0 to 255 to be accessed; using the DX register as a source 
operand allows I/O ports from 0 to 65,535 to be accessed. 


The size of the I/O port being accessed is determined by the opcode for an 8-bit I/O port or by the operand-size 
attribute of the instruction for a 16- or 32-bit I/O port. 


At the machine code level, I/O instructions are shorter when accessing 8-bit I/O ports. Here, the upper eight bits 
of the port address will be 0. 


This instruction is only useful for accessing I/O ports located in the processor’s I/O address space. See Chapter 19, 
“Input/Output,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for more infor- 
mation on accessing I/O ports in the I/O address space. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


After executing an OUT instruction, the Pentium® processor ensures that the EWBE# pin has been sampled active 
before it begins to execute the next instruction. (Note that the instruction can be prefetched if EWBE# is not active, 
but it will not be executed until the EWBE# pin is sampled active.) Only the Pentium processor family has the 
EWBE# pin. 
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Operation 


IF ((PE = 1) and ((CPL > IOPL) or (VM = 1))) 
THEN (* Protected mode with CPL > IOPL or virtual-8086 mode *) 
IF (Any I/O Permission Bit for I/O port being accessed = 1) 
THEN (* I/O operation is not allowed *) 
#GP(0); 
ELSE ( * I/O operation is allowed *) 
DEST := SRC; (* Writes to selected I/O port *) 
Fl; 
ELSE (Real Mode or Protected Mode with CPL < IOPL *) 
DEST := SRC; (* Writes to selected I/O port *) 
FI; 


Flags Affected 
None 


Protected Mode Exceptions 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If any of the I/O permission bits in the TSS for the I/O port being accessed is 1. 
#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as protected mode exceptions. 


64-Bit Mode Exceptions 
Same as protected mode exceptions. 
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OUTS/OUTSB/OUTSW/OUTSD—Output String to Port 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

6E OUTS DX, m8 ZO | Valid Valid Output byte from memory location specified 
in DS:(E)SI or RSI to I/O port specified in DX**. 

6F OUTS DX, m16 ZO | Valid Valid Output word from memory location specified 
in DS:(E)SI or RSI to I/O port specified in DX**. 

6F OUTS DX, m32 ZO | Valid Valid Output doubleword from memory location 
specified in DS:(€)SI or RSI to I/O port specified 
in DX**, 

6E OUTSB ZO | Valid Valid Output byte from memory location specified 
in DS:(E)SI or RSI to I/O port specified in DX**. 

6F OUTSW ZO | Valid Valid Output word from memory location specified 
in DS:(E)SI or RSI to I/O port specified in DX**. 

6F OUTSD ZO | Valid Valid Output doubleword from memory location 
specified in DS:(€)SI or RSI to I/O port specified 
in DX**. 

NOTES: 


* See IA-32 Architecture Compatibility section below. 


** In 64-bit mode, only 64-bit (RSI) and 32-bit (ESI) address sizes are supported. In non-64-bit mode, only 32-bit (ESI) and 16-bit (SI) 
address sizes are supported. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Copies data from the source operand (second operand) to the I/O port specified with the destination operand (first 
operand). The source operand is a memory location, the address of which is read from either the DS:SI, DS:ESI or 
the RSI registers (depending on the address-size attribute of the instruction, 16, 32 or 64, respectively). (The DS 
segment may be overridden with a segment override prefix.) The destination operand is an I/O port address (from 
0 to 65,535) that is read from the DX register. The size of the I/O port being accessed (that is, the size of the source 
and destination operands) is determined by the opcode for an 8-bit I/O port or by the operand-size attribute of the 
instruction for a 16- or 32-bit I/O port. 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the OUTS mnemonic) allows the source and destination 
operands to be specified explicitly. Here, the source operand should be a symbol that indicates the size of the I/O 
port and the source address, and the destination operand must be DX. This explicit-operands form is provided to 
allow documentation; however, note that the documentation provided by this form can be misleading. That is, the 
source operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword), but it does 
not have to specify the correct location. The location is always specified by the DS:(E)SI or RSI registers, which 
must be loaded correctly before the OUTS instruction is executed. 


The no-operands form provides “short forms” of the byte, word, and doubleword versions of the OUTS instructions. 
Here also DS:(E)SI is assumed to be the source operand and DX is assumed to be the destination operand. The size 
of the I/O port is specified with the choice of mnemonic: OUTSB (byte), OUTSW (word), or OUTSD (doubleword). 


After the byte, word, or doubleword is transferred from the memory location to the I/O port, the SI/ESI/RSI 
register is incremented or decremented automatically according to the setting of the DF flag in the EFLAGS register. 
(If the DF flag is 0, the (E)SI register is incremented; if the DF flag is 1, the SI/ESI/RSI register is decremented. ) 
The SI/ESI/RSI register is incremented or decremented by 1 for byte operations, by 2 for word operations, and by 
4 for doubleword operations. 
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The OUTS, OUTSB, OUTSW, and OUTSD instructions can be preceded by the REP prefix for block input of ECX 
bytes, words, or doublewords. See “REP/REPE/REPZ /REPNE/REPNZ—Repeat String Operation Prefix” in this 
chapter for a description of the REP prefix. This instruction is only useful for accessing I/O ports located in the 
processor's I/O address space. See Chapter 19, “Input/Output,” in the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1, for more information on accessing I/O ports in the I/O address space. 


In 64-bit mode, the default operand size is 32 bits; operand size is not promoted by the use of REX.W. In 64-bit 
mode, the default address size is 64 bits, and 64-bit address is specified using RSI by default. 32-bit address using 
ESI is support using the prefix 67H, but 16-bit address is not supported in 64-bit mode. 


IA-32 Architecture Compatibility 


After executing an OUTS, OUTSB, OUTSW, or OUTSD instruction, the Pentium processor ensures that the EWBE# 
pin has been sampled active before it begins to execute the next instruction. (Note that the instruction can be 
prefetched if EWBE# is not active, but it will not be executed until the EWBE# pin is sampled active.) Only the 
Pentium processor family has the EWBE# pin. 


For the Pentium 4, Intel® Xeon®, and P6 processor family, upon execution of an OUTS, OUTSB, OUTSW, or OUTSD 
instruction, the processor will not execute the next instruction until the data phase of the transaction is complete. 


Operation 


IF ((PE = 1) and ((CPL > IOPL) or (VM = 1))) 
THEN (* Protected mode with CPL > IOPL or virtual-8086 mode *) 
IF (Any I/O Permission Bit for I/O port being accessed = 1) 
THEN (* I/O operation is not allowed *) 
#GP(0); 
ELSE (* I/O operation is allowed *) 
DEST := SRC; (* Writes to I/O port *) 
Fl; 
ELSE (Real Mode or Protected Mode or 64-Bit Mode with CPL < IOPL *) 
DEST := SRC; (* Writes to I/O port *) 
FI; 


Byte transfer: 


IF 64-bit mode 
Then 
IF 64-Bit Address Size 
THEN 
IF DF = O 
THEN RSI := RSI RSI + 1; 
ELSE RSI := RSI or - 1; 
Fl; 
ELSE (* 32-Bit Address Size *) 
IF DF = O 
THEN ESI := ESI +1; 
ELSE ESI := ESI - 1; 
Fl; 
Fl; 
ELSE 
IF DF = 0 
THEN —_(E)SI := (E)SI + 1; 
ELSE (E)SI := (E)S! - 1; 
Fl; 
Fl; 
Word transfer: 
IF 64-bit mode 
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Then 
IF 64-Bit Address Size 
THEN 
IF DF =O 
THEN RSI := RSI RSI + 2; 
ELSE RSI := RSI or - 2; 
Fl; 
ELSE (* 32-Bit Address Size *) 
IF DF = 0 
THEN ESI := ESI + 2; 
ELSE ESI := ESI - 2; 
Fl; 
Fl; 
ELSE 
IF DF =0 
THEN = (E)SI := (E)SI + 2; 
ELSE (E)SI := (E)SI - 2; 
Fl; 
Fl; 
Doubleword transfer: 
IF 64-bit mode 
Then 
IF 64-Bit Address Size 
THEN 
IF DF = 0 
THEN RSI := RSI RSI + 4; 
ELSE RSI := RSI or - 4; 
Fl; 
ELSE (* 32-Bit Address Size *) 
IF DF = O 
THEN ESI := ESI + 4; 
ELSE ESI := ESI - 4; 
Fl; 
Fl; 
ELSE 
IF DF =0 
THEN = (E)SI:= (E)SI + 4; 
ELSE (E)SI := (E)SI - 4; 
Fl; 
Fl; 
Flags Affected 
None 
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Protected Mode Exceptions 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


If a memory operand effective address is outside the limit of the CS, DS, ES, FS, or GS 
segment. 


If the segment register contains a NULL segment selector. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If any of the I/O permission bits in the TSS for the I/O port being accessed is 1. 
#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 


#GP(0) If the CPL is greater than (has less privilege) the I/O privilege level (IOPL) and any of the 
corresponding I/O permission bits in TSS for the I/O port being accessed is 1. 


If the memory address is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 
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PABSB/PABSW/PABSD/PABSQ — Packed Absolute Value 
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Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 1C /r’ A VIV SSSE3 Compute the absolute value of bytes in 

PABSB mm1, mm2/m64 mm2/m64 and store UNSIGNED result in mm7. 

66 OF 38 1C /r A VIV SSSE3 Compute the absolute value of bytes in 

PABSB xmm1, xmm2/m128 xmm2/m128 and store UNSIGNED result in 
xmm1. 

NP OF 38 1D /r! A VIV SSSE3 Compute the absolute value of 16-bit integers 

PABSW mm1, mm2/m64 in mm2/m64 and store UNSIGNED result in 
mm1,. 

66 OF 38 1D /r A VIV SSSE3 Compute the absolute value of 16-bit integers 

PABSW xmm1, xmm2/m128 in xmm2/m128 and store UNSIGNED result in 
xmm1. 

NP OF 38 1€ /r! A VIV SSSE3 Compute the absolute value of 32-bit integers 

PABSD mm1, mm2/m64 in mm2/m64 and store UNSIGNED result in 
mm1. 

66 OF 38 1E /r A VIV SSSE3 Compute the absolute value of 32-bit integers 

PABSD xmm1, xmm2/m128 in xmm2/m128 and store UNSIGNED result in 
xmm1. 

VEX.128.66.0F38.WIG 1C /r A VIV AVX Compute the absolute value of bytes in 

VPABSB xmm1, xmm2/m128 xmm2/m128 and store UNSIGNED result in 
xmm1. 

VEX.128.66.0F38.WIG 1D /r A VIV AVX Compute the absolute value of 16- bit 

VPABSW xmm1, xmm2/m128 integers in xmm2/m128 and store UNSIGNED 
result in xmm7. 

VEX.128.66.0F38.WIG 1€ /r A VIV AVX Compute the absolute value of 32- bit 

VPABSD xmm1, xmm2/m128 integers in xmm2/m128 and store UNSIGNED 
result in xmm7. 

VEX.256.66.0F38.WIG 1C /r A VIV AVX2 Compute the absolute value of bytes in 

VPABSB ymm1, ymm2/m256 ymm2/m256 and store UNSIGNED result in 
ymm1. 

VEX.256.66.0F38.WIG 1D /r A VIV AVX2 Compute the absolute value of 16-bit integers 

VPABSW ymm1, ymm2/m256 in ymm2/m256 and store UNSIGNED result in 
ymm1. 

VEX.256.66.0F38.WIG 1€ /r A VIV AVX2 Compute the absolute value of 32-bit integers 

VPABSD ymm1, ymm2/m256 in ymm2/m256 and store UNSIGNED result in 
ymm1. 

EVEX.128.66.0F38.WIG 1C /r B VIV AVX512VL | Compute the absolute value of bytes in 

VPABSB xmm1 {k1}{z}, xmm2/m128 AVX512BW | xmm2/m128 and store UNSIGNED result in 
xmm1 using writemask k1. 

EVEX.256.66.0F38.WIG 1C /r B VIV AVX512VL | Compute the absolute value of bytes in 

VPABSB ymm1 {k1}{z}, ymnm2/m256 AVX512BW | ymm2/m256 and store UNSIGNED result in 
ymm1 using writemask k1. 

EVEX.512.66.0F38.WIG 1C /r B VIV AVX512BW | Compute the absolute value of bytes in 

VPABSB zmm1 {k1}{z}, zmm2/m512 zmm2/m512 and store UNSIGNED result in 
zmm1 using writemask k1. 

EVEX.128.66.0F38.WIG 1D /r B VIV AVX512VL | Compute the absolute value of 16-bit integers 

VPABSW xmm1 {k1}{z}, xmm2/m128 AVX512BW | in xmm2/m128 and store UNSIGNED result in 


xmm1 using writemask k1. 
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EVEX.256.66.0F38.WIG 1D /r B VV AVX512VL | Compute the absolute value of 16-bit integers 
VPABSW ymm1 {k1}{z}, ymm2/m256 AVX512BW | in ymm2/m256 and store UNSIGNED result in 
ymm1 using writemask k1. 
EVEX.512.66.0F38.WIG 1D /r B VIV AVX512BW | Compute the absolute value of 16-bit integers 
VPABSW zmm1 {k1}{z}, zmm2/m512 in zmm2/m512 and store UNSIGNED result in 
zmm1 using writemask k1. 
EVEX.128.66.0F38.WO 1€ /r C VIV AVX512VL | Compute the absolute value of 32-bit integers 
VPABSD xmm1 {k1}{z}, xmm2/m128/m32bcst AVX512F | inxmm2/m128/m32bcst and store UNSIGNED 
result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W0 1€ /r C VV AVX512VL | Compute the absolute value of 32-bit integers 
VPABSD ymm1 {k1}{z}, ymnm2/m256/m32bcst AVX512F | in ymm2/m256/m32bcst and store UNSIGNED 
result in ymm1 using writemask k1. 
EVEX.512.66.0F38.WO 1€ /r C VIV AVX512F | Compute the absolute value of 32-bit integers 
VPABSD zmm1 {k1}{z}, zmm2/m512/m32bcst in zmm2/m512/m32bcst and store UNSIGNED 
result in zmm1 using writemask k1. 
EVEX.128.66.0F38.W1 1F /r C VIV AVX512VL | Compute the absolute value of 64-bit integers 
VPABSQ xmm1 {k1}{z}, xmm2/m128/m64bcst AVX512F | inxmm2/m128/m64bcst and store UNSIGNED 
result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 1F /r C VIV AVX512VL | Compute the absolute value of 64-bit integers 
VPABSQ ymm1 {k1}{z}, ymnm2/m256/m64bcst AVX512F | in ymm2/m256/m64bcst and store UNSIGNED 
result in ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 1F /r C VIV AVX512F | Compute the absolute value of 64-bit integers 
VPABSQ zmm1 {k1}{z}, zmm2/m512/m64bcst in zmm2/m512/m64bcst and store UNSIGNED 
result in zmm1 using writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
C Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


PABSB/W/D computes the absolute value of each data element of the source operand (the second operand) and 
stores the UNSIGNED results in the destination operand (the first operand). PABSB operates on signed bytes, 
PABSW operates on signed 16-bit words, and PABSD operates on signed 32-bit integers. 


EVEX encoded VPABSD/Q: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location, 
or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. The destination operand is a 
ZMM/YMM/XMM register updated according to the writemask. 


EVEX encoded VPABSB/W: The source operand is a ZMM/YMM/XMM register, or a 512/256/128-bit memory loca- 
tion. The destination operand is a ZMM/YMM/XMM register updated according to the writemask. 


VEX.256 encoded versions: The source operand is a YMM register or a 256-bit memory location. The destination 
operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding register destination are zeroed. 


VEX.128 encoded versions: The source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding register destination are zeroed. 
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128-bit Legacy SSE version: The source operand can be an XMM register or an 128-bit memory location. The desti- 
nation is an XMM register. The upper bits (VL_MAX-1:128) of the corresponding register destination are unmodi- 


fied. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


Operation 


PABSB with 128 bit operands: 
Unsigned DEST[7:0] := ABS(SRC[7: 0]) 
Repeat operation for 2nd through 15th bytes 
Unsigned DEST[127:120] := ABS(SRC[127:120]) 


VPABSB with 128 bit operands: 
Unsigned DEST[7:0] := ABS(SRC[7: 0]) 
Repeat operation for 2nd through 15th bytes 
Unsigned DEST[127:120] := ABS(SRC[127:120]) 


VPABSB with 256 bit operands: 
Unsigned DEST[7:0] := ABS(SRC[7: 0]) 
Repeat operation for 2nd through 31st bytes 
Unsigned DEST[255:248] := ABS(SRC[255:248]) 


VPABSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j := 0 TO KL-1 


i:=j*8 
IF k1[j] OR *no writemask* 
THEN 
Unsigned DEST[i+7:i] = ABS(SRC[i+7:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PABSW with 128 bit operands: 
Unsigned DEST[15:0] := ABS(SRC[15:0]) 
Repeat operation for 2nd through 7th 16-bit words 
Unsigned DEST[127:112] := ABS(SRC[127:11 2]) 


VPABSW with 128 bit operands: 
Unsigned DEST[15:0] := ABS(SRC[15:0]) 
Repeat operation for 2nd through 7th 16-bit words 
Unsigned DEST[127:112] := ABS(SRC[127:11 2]) 


VPABSW with 256 bit operands: 
Unsigned DEST[15:0] := ABS(SRC[15:0]) 
Repeat operation for 2nd through 15th 16-bit words 
Unsigned DEST[255:240] := ABS(SRC[255:240]) 
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VPABSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 


i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
Unsigned DEST[i+15:i] = ABS(SRC[i+1 5:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PABSD with 128 bit operands: 
Unsigned DEST[31:0] := ABS(SRC[31:0]) 
Repeat operation for 2nd through 3rd 32-bit double words 
Unsigned DEST[1 27:96] := ABS(SRC[127:96]) 


VPABSD with 128 bit operands: 
Unsigned DEST[31:0] := ABS(SRC[31:0]) 
Repeat operation for 2nd through 3rd 32-bit double words 
Unsigned DEST[1 27:96] := ABS(SRC[127:96]) 


VPABSD with 256 bit operands: 
Unsigned DEST[31:0] := ABS(SRC[31:0]) 
Repeat operation for 2nd through 7th 32-bit double words 
Unsigned DEST[255:224] := ABS(SRC[255:224]) 


VPABSD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN 
Unsigned DEST[i+31:i] = ABS(SRC[31:0]) 
ELSE 
Unsigned DEST[i+31:i] = ABS(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VPABSQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN 
Unsigned DEST[i+63:i] := ABS(SRC[63:0]) 
ELSE 
Unsigned DEST[i+63:i] := ABS(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPABSB__m512i_mm512_abs_epi8 (__m512i a) 
VPABSW__m512i__mm512_abs_epi16 (__m512i a) 
VPABSB__m512i_mm512_mask_abs_epi8 (__m512is,__ mmask64 m,_m512i a) 
VPABSW__m512i_mm512_mask_abs_epi16 (__m512is,__ mmask32 m,__m512i a) 
VPABSB__m512i_mm512_maskz_abs_epi8 (__mmask64 m,__m512i a) 
VPABSW__m512i_mm512_maskz_abs_epi16 (__mmask32 m,_m512i a) 
VPABSB__m256i __mm256_mask_abs_epi8 (__m256i s,___ mmask32 m, ___m256i a) 
VPABSW__m256i __mm256_mask_abs_epi16 (__m256is,__ mmask16 m, __m256i a) 
VPABSB__m256i __mm256_maskz_abs_epi8 (__mmask32 m, __m256i a) 
VPABSW__m256i__mm256_maskz_abs_epi16 (__mmask16 m, __m256i a) 
VPABSB__m128i __mm_mask_abs_epi8 (__m128is,__ mmask16 m, __m128i a) 
VPABSW__m128i __mm_mask_abs_epi16 (__m128is,__ mmask8 m, ___m128i a) 
VPABSB__m128i__mm_maskz_abs_epi8 (__mmask16 m, __m128i a) 
VPABSW__m128i __mm_maskz_abs_epi16 (__mmask8 m, __m128i a) 

VPABSD __m256i__mm256_mask_abs_epi32(__m256is,__ mmask8 k, __m256i a); 
VPABSD __m256i __mm256_maskz_abs_epi32(__mmask8 k, __m256i a); 

VPABSD __m128i __mm_mask_abs_epi32(__m128is,__ mmask8 k, __m128i a); 
VPABSD __m128i __mm_maskz_abs_epi32(__mmask8 k, __m128i a); 

VPABSD __m512i_mm512_abs_epi32(__m512i a); 

VPABSD __m512i_mm512_mask_abs_epi32(__m512is,__ mmask16 k,___m512i a); 
VPABSD __m512i_mm512_maskz_abs_epi32(__mmask16 k,__m512i a); 
VPABSQ __m512i_mm512_abs_epi64(__m512i a); 

VPABSQ __m512i__mm512_mask_abs_epi64(__m512i s,___mmask8 k, __m512i a); 
VPABSQ __m512i__mm512_maskz_abs_epi64(__mmask8 k, __m512i a); 

VPABSQ __m256i _mm256_mask_abs_epi64(__m256i s, __mmask8 k, __m256i a); 
VPABSQ __m256i _mm256_maskz_abs_epi64(__mmask8 k, __m256i a); 

VPABSQ __m128i _mm_mask_abs_epi64(__m128i s,___mmask8 k, __m128i a); 
VPABSQ __m128i __mm_maskz_abs_epi64(__mmask8 k, __m128i a); 

PABSB __m128i__mm_abs_epi8 (__m128i a) 

VPABSB __m128i_mm_abs_epi8 (__m128i a) 
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VPABSB __m256i_mm256_abs_epi8 (__m256i a) 
PABSW __m128i __mm_abs_epil6 (__m128i a) 
VPABSW __m128i __mm_abs_epi16 (__m128i a) 
VPABSW __m256i__mm256_abs_epi16 (__m256i a) 
PABSD __m128i_mm_abs_epi32 (__m128i a) 
VPABSD __m128i__mm_abs_epi32 (__m128i a) 
VPABSD __m256i__mm256_abs_epi32 (__m256i a) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


INSTRUCTION SET REFERENCE, M-U 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded VPABSD/Q, see Table 2-49, “Type E4 Class Exception Conditions”. 


EVEX-encoded VPABSB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PACKSSWB/PACKSSDW—Pack with Signed Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature Flag 
Support 

NP OF 63 /r! A VIV MMX Converts 4 packed signed word integers from 

PACKSSWB mm1, mm2/m64 mm1 and from mm2/m64 into 8 packed 
signed byte integers in mm17 using signed 
saturation. 

66 OF 63 /r A VIV SSE2 Converts 8 packed signed word integers from 

PACKSSWB xmm1, xmm2/m128 xmm1 and from xmm2/m128 into 16 packed 
signed byte integers in xmm7 using signed 
saturation. 

NP OF 6B /r! A VIV MMX Converts 2 packed signed doubleword 

PACKSSDW mm1, mm2/m64 integers from mm17 and from mm2/m64 into 4 
packed signed word integers in mm7 using 
signed saturation. 

66 OF 6B /r A VIV SSE2 Converts 4 packed signed doubleword 

PACKSSDW xmm1, xmm2/m128 integers from xmm17 and from xmm2/m128 
into 8 packed signed word integers in xmm1 
using signed saturation. 

VEX.128.66.0F.WIG 63 /r B VIV AVX Converts 8 packed signed word integers from 

VPACKSSWB xmm1,xmm2, xmm3/m128 xmm_2 and from xmm3/m128 into 16 packed 
signed byte integers in xmm7 using signed 
saturation. 

VEX.128.66.0F.WIG 6B /r B VIV AVX Converts 4 packed signed doubleword 

VPACKSSDW xmm1,xmm2, xmm3/m128 integers from xmm_2 and from xmm3/m128 
into 8 packed signed word integers in xmm17 
using signed saturation. 

VEX.256.66.0F.wic 63 /r B VIV AVX2 Converts 16 packed signed word integers 

VPACKSSWB ymm1, ymm2, ymm3/m256 from ymm2 and from ymm3/m256 into 32 
packed signed byte integers in ymm7 using 
signed saturation. 

VEX.256.66.0F.WIG 6B /r B VIV AVX2 Converts 8 packed signed doubleword 

VPACKSSDW ymm1, ymm2, ymm3/m256 integers from ymm2 and from ymm3/m256 
into 16 packed signed word integers in 
ymm using signed saturation. 

EVEX.128.66.0F.WIG 63 /r C VIV AVX512VL | Converts packed signed word integers from 

VPACKSSWB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2 and from xmm3/m128 into packed 
signed byte integers in xmm17 using signed 
saturation under writemask k1. 

EVEX.256.66.0F.WIG 63 /r C VIV AVX512VL | Converts packed signed word integers from 

VPACKSSWB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2 and from ymm3/m256 into packed 
signed byte integers in ymm17 using signed 
saturation under writemask k1. 

EVEX.512.66.0F.WIG 63 /r C VIV AVX512BW | Converts packed signed word integers from 

VPACKSSWB zmm1 {k1}{z}, zmm2, zmm3/m512 zmme2 and from zmm3/m512 into packed 
signed byte integers in 2mm7 using signed 
saturation under writemask k1. 

EVEX.128.66.0F.WO 6B /r D VIV AVX512VL | Converts packed signed doubleword integers 

VPACKSSDW xmm1 {k1}{z}, xmm2, AVX512BW | from xmm2 and from xmm3/m128/m32bcst 

xmm3/m128/m32bcst into packed signed word integers in xmm1 
using signed saturation under writemask k1. 
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EVEX.256.66.0F.WO 6B /r D VIV AVX512VL | Converts packed signed doubleword integers 
VPACKSSDW ymm1 {k1}{z}, ymm2, AVX512BW | from ymm2 and from ymm3/m256/m32bcst 
ymm3/m256/m32bcst into packed signed word integers in ymm1 
using signed saturation under writemask k1. 
EVEX.512.66.0F.WO 6B /r D VIV AVX512BW | Converts packed signed doubleword integers 
VPACKSSDW zmm1 {k1}{z}, zmm2, from zmm2 and from zmm3/m512/m32bcst 
zmm3/m512/m32bcst into packed signed word integers in zmm1 
using signed saturation under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts packed signed word integers into packed signed byte integers (PACKSSWB) or converts packed signed 
doubleword integers into packed signed word integers (PACKSSDW), using saturation to handle overflow condi- 
tions. See Figure 4-6 for an example of the packing operation. 


64-Bit SRC 64-Bit DEST 
aa: pe fa 


Di/CI|BIA 
64-Bit DEST 


Figure 4-6. Operation of the PACKSSDW Instruction Using 64-bit Operands 


PACKSSWEB converts packed signed word integers in the first and second source operands into packed signed byte 
integers using signed saturation to handle overflow conditions beyond the range of signed byte integers. If the 
signed word value is beyond the range of a signed byte value (i.e., greater than 7FH or less than 80H), the satu- 
rated signed byte integer value of 7FH or 80H, respectively, is stored in the destination. PACKSSDW converts 
packed signed doubleword integers in the first and second source operands into packed signed word integers using 
signed saturation to handle overflow conditions beyond 7FFFH and 8000H. 


EVEX encoded PACKSSWB: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM 
register, updated conditional under the writemask k1. 


EVEX encoded PACKSSDW: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 32- 
bit memory location. The destination operand is a ZMM/YMM/XMM register, updated conditional under the 
writemask k1. 
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VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding ZMM destination register destination are unmodified. 


Operation 


PACKSSWEB instruction (128-bit Legacy SSE version) 
DEST[7:0] := SaturateSignedWordToSignedByte (DEST[15:0)); 
DEST[15:8] := SaturateSignedWordToSignedByte (DEST[31:16]); 
DEST[23:16] := SaturateSignedWordToSignedByte (DEST[47:32]); 
DEST[31:24] := SaturateSignedWordToSignedByte (DEST[63:48)); 
DEST[39:32] := SaturateSignedWordToSignedByte (DEST[79:64)); 
DEST[47:40] := SaturateSignedWordToSignedByte (DEST[95:80)); 
DEST[55:48] := SaturateSignedWordToSignedByte (DEST[1 1 1:96)); 
DEST[63:56] := SaturateSignedWordToSignedByte (DEST[127:112]); 
DEST[7 1:64] := SaturateSignedWordToSignedByte (SRC[15:0)); 
DEST[79:72] := SaturateSignedWordToSignedByte (SRC[31:16)); 
DEST[87:80] := SaturateSignedWordToSignedByte (SRC[47:32]); 
DEST[95:88] := SaturateSignedWordToSignedByte (SRC[63:48)); 
DEST[103:96] := SaturateSignedWordToSignedByte (SRC[79:64)); 
DEST[111:104] := SaturateSignedWordToSignedByte (SRC[95:80)); 
DEST[119:112] := SaturateSignedWordToSignedByte (SRC[1 1 1:96)); 
DEST[127:120] := SaturateSignedWordToSignedByte (SRC[127:112]); 
DEST[MAXVL-1:128] (Unmodified) 


EE ee ee 


PACKSSDwW instruction (128-bit Legacy SSE version) 
DEST[15:0] := SaturateSignedDwordToSignedWord (DEST[31:0]); 
DEST[31:16] := SaturateSignedDwordToSignedWord (DEST[63:32]); 
DEST[47:32] := SaturateSignedDwordToSignedWord (DEST[95:64}); 
DEST[63:48] := SaturateSignedDwordToSignedWword (DEST[127:96)); 
DEST[79:64] := SaturateSignedDwordToSignedWord (SRC[31:0)); 
DEST[95:80] := SaturateSignedDwordToSignedWord (SRC[63:32)); 
DEST[1 11:96] := SaturateSignedDwordToSignedWord (SRC[95:64}); 
DEST[127:112] := SaturateSignedDwordT oSignedWord (SRC[127:96)); 
DEST[MAXVL-1:128] (Unmodified) 
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VPACKSSWB instruction (VEX.128 encoded version) 
DEST[7:0] := SaturateSignedWordToSignedByte (SRC1[15:0]); 
DEST[15:8] := SaturateSignedWordToSignedByte (SRC1[31:16]); 
DEST[23:16] := SaturateSignedWordT oSignedByte (SRC1[47:32]); 
DEST[31:24] := SaturateSignedWordToSignedByte (SRC1[63:48}); 
DEST[39:32] := SaturateSignedWordT oSignedByte (SRC1[79:64]) 
DEST[47:40] := SaturateSignedWordToSignedByte (SRC1[95:80}); 
DEST[55:48] := SaturateSignedWordToSignedByte (SRC1[1 1 1:96]); 
DEST[63:56] := SaturateSignedWordToSignedByte (SRC1[127:112]); 
DEST[7 1:64] := SaturateSignedWordToSignedByte (SRC2[15:0]); 
DEST[79:72] := SaturateSignedWordT oSignedByte (SRC2[31:16]); 
DEST[87:80] := SaturateSignedWordToSignedByte (SRC2[47:32]); 
DEST[95:88] := SaturateSignedWordToSignedByte (SRC2[63:48}); 
DEST[103:96] := SaturateSignedWordT oSignedByte (SRC2[79:64}); 
DEST[111:104] := SaturateSignedWordToSignedByte (SRC2[95:80)); 
DEST[119:1 12] := SaturateSignedWordToSignedByte (SRC2[1 1 1:96)); 
DEST[127:120] := SaturateSignedWordToSignedByte (SRC2[127:112]); 
DEST[MAXVL-1:128] := 0; 


In 


Ee ae a ea ee ee ee ee, 


VPACKSSDwW instruction (VEX.128 encoded version) 
DEST[15:0] := SaturateSignedDwordT oSignedWord (SRC1[31:0)); 
DEST[31:16] := SaturateSignedDwordToSignedWord (SRC1[63:32]); 
DEST[47:32] := SaturateSignedDwordToSignedWord (SRC1[95:64}); 
DEST[63:48] := SaturateSignedDwordToSignedWord (SRC1[127:96]); 
DEST[79:64] := SaturateSignedDwordToSignedWord (SRC2[31:0}); 
DEST[95:80] := SaturateSignedDwordToSignedWord (SRC2[63:32]); 
DEST[1 11:96] := SaturateSignedDwordToSignedWord (SRC2[95:64}); 
DEST[127:112] := SaturateSignedDwordToSignedWord (SRC2[127:96]); 
DEST[MAXVL-1:128] := 0; 


VPACKSSWB instruction (VEX.256 encoded version) 
DEST[7:0] := SaturateSignedWordToSignedByte (SRC1[15:0]); 
DEST[15:8] := SaturateSignedWordToSignedByte (SRC1[31:16]); 
DEST[23:16] := SaturateSignedWordToSignedByte (SRC1[47:32]); 
DEST[31:24] := SaturateSignedWordToSignedByte (SRC1[63:48}); 
DEST[39:32] := SaturateSignedWordT oSignedByte (SRC1[79:64]) 
DEST[47:40] := SaturateSignedWordToSignedByte (SRC1[95:80}); 
DEST[55:48] := SaturateSignedWordToSignedByte (SRC1[1 1 1:96]); 
DEST[63:56] := SaturateSignedWordToSignedByte (SRC1[127:112]); 
DEST[7 1:64] := SaturateSignedWordToSignedByte (SRC2[15:0]); 
DEST[79:72] := SaturateSignedWordToSignedByte (SRC2[31:16]); 
DEST[87:80] := SaturateSignedWordT oSignedByte (SRC2[47:32]); 
DEST[95:88] := SaturateSignedWordT oSignedByte (SRC2[63:48}); 
DEST[103:96] := SaturateSignedWordToSignedByte (SRC2[79:64}); 
DEST[111:104] := SaturateSignedWordToSignedByte (SRC2[95:80)); 
DEST[1 19:1 12] := SaturateSignedWordToSignedByte (SRC2[1 1 1:96)); 
DEST[127:120] := SaturateSignedWordToSignedByte (SRC2[127:112]) 
DEST[135:1 28] := SaturateSignedWordToSignedByte (SRC1[143:128]) 
DEST[143:1 36] := SaturateSignedWordToSignedByte (SRC1[159:144}) 
DEST[151:144] := SaturateSignedWordToSignedByte (SRC1[175:160}); 
DEST[159:152] := SaturateSignedWordToSignedByte (SRC1[191:176]) 
( ) 
( ) 
( ) 


in 


ima (jpn imi, ji gates, gama ‘giao, am 


DEST[167:160] := SaturateSignedWordToSignedByte (SRC1[207:192] 
DEST[175:168] := SaturateSignedWordToSignedByte (SRC1[223:208] 
DEST[183:1 76] := SaturateSignedWordToSignedByte (SRC1[239:224] 
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DEST[191:184] := SaturateSignedWordToSignedByte (SRC1[255:240}); 
DEST[199:192] := SaturateSignedWordToSignedByte (SRC2[143:128}); 
DEST[207:200] := SaturateSignedWordToSignedByte (SRC2[159:144] 

DEST[215:208] := SaturateSignedWordToSignedByte (SRC2[175:160}); 


( ) 
( ) 
( ) 
( ) 
DEST[223:216] := SaturateSignedWordToSignedByte (SRC2[191:176)); 
( ) 
( ) 
( ) 
( ) 


In 


i" 


DEST[231:224] := SaturateSignedWordToSignedByte (SRC2[207:192] 
DEST[239:232] := SaturateSignedWordToSignedByte (SRC2[223:208] 
DEST[247:240] := SaturateSignedWordToSignedByte (SRC2[239:224] 
DEST[255:248] := SaturateSignedWordToSignedByte (SRC2[255:240] 
DEST[MAXVL-1:256] := 0; 


In 


I" 


In 


VPACKSSDwW instruction (VEX.256 encoded version) 
DEST[15:0] := SaturateSignedDwordT oSignedWord (SRC1[31:0)); 
DEST[31:16] := SaturateSignedDwordToSignedWord (SRC1[63:32]); 
DEST[47:32] := SaturateSignedDwordToSignedWord (SRC1[95:64}); 
DEST[63:48] := SaturateSignedDwordToSignedWord (SRC1[127:96]); 
DEST[79:64] := SaturateSignedDwordToSignedWord (SRC2[31:0]); 
DEST[95:80] := SaturateSignedDwordToSignedWord (SRC2[63:32]); 
DEST[1 11:96] := SaturateSignedDwordToSignedWord (SRC2[95:64)); 
DEST[127:112] := SaturateSignedDwordToSignedWord (SRC2[127:96]); 
DEST[143:128] := SaturateSignedDwordToSignedWord (SRC1[159:128}) 
DEST[159:144] := SaturateSignedDwordToSignedWord (SRC1[191:160]) 
DEST[175:160] := SaturateSignedDwordToSignedWord (SRC1[223:192]) 
DEST[191:176] := SaturateSignedDwordToSignedWord (SRC1[255:224]); 
DEST[207:192] := SaturateSignedDwordToSignedWord (SRC2[159:128}) 
DEST[223:208] := SaturateSignedDwordToSignedWord (SRC2[191:160]) 
DEST[239:224] := SaturateSignedDwordToSignedWord (SRC2[223:192]) 
DEST[255:240] := SaturateSignedDwordToSignedWord (SRC2[255:224}) 
DEST[MAXVL-1:256] := 0; 


aa ina, ms Sai, Gps pata, ps 


VPACKSSWB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
TMP_DEST[7:0] := SaturateSignedWordToSignedByte (SRC1[15:0]); 
TMP_DEST[15:8] := SaturateSignedWordToSignedByte (SRC1[31:16]); 
TMP_DEST[23:16] := SaturateSignedWordToSignedByte (SRC1[47:32]); 
TMP_DEST[31:24] := SaturateSignedWordToSignedByte (SRC1[63:48)); 
TMP_DEST[39:32] := SaturateSignedWordToSignedByte (SRC1[79:64]) 
TMP_DEST[47:40] := SaturateSignedWordToSignedByte (SRC1[95:80)); 
TMP_DEST[55:48] := SaturateSignedWordToSignedByte (SRC1[1 1 1:96)); 
TMP_DEST[63:56] := SaturateSignedWordToSignedByte (SRC1[127:112]); 
TMP_DEST[7 1:64] := SaturateSignedWordToSignedByte (SRC2[15:0)); 
TMP_DEST[79:72] := SaturateSignedWordToSignedByte (SRC2[31:16]); 
TMP_DEST[87:80] := SaturateSignedWordToSignedByte (SRC2[47:32]); 
TMP_DEST[95:88] := SaturateSignedWordToSignedByte (SRC2[63:48)); 
TMP_DEST[103:96] := SaturateSignedWordToSignedByte (SRC2[79:64)); 
TMP_DEST[111:104] := SaturateSignedWordToSignedByte (SRC2[95:80)); 
TMP_DEST[119:112] := SaturateSignedWordToSignedByte (SRC2[1 1 1:96)); 
TMP_DEST[127:120] := SaturateSignedWordToSignedByte (SRC2[1 27:11 2)); 
IF VL >= 256 

TMP_DEST[135:128] := SaturateSignedWordToSignedByte (SRC1[143:128] 


In 


en a ee eee 


( ); 
TMP_DEST[143:136] := SaturateSignedWordToSignedByte (SRC1[159:144)); 
TMP_DEST[151:144] := SaturateSignedWordToSignedByte (SRC1[175:160)); 
( ); 
( ) 


TMP_DEST[159:152] := SaturateSignedWordToSignedByte (SRC1[191:176] 
TMP_DEST[167:160] := SaturateSignedWordToSignedByte (SRC1[207:192] 


I" 


In 
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Fl; 


TMP_DEST[1 75:168] := SaturateSignedWordToSignedByte (SRC1[223:208)); 
TMP_DEST[183:1 76] := SaturateSignedWordToSignedByte (SRC1[239:224]); 
TMP_DEST[191:184] := SaturateSignedWordToSignedByte (SRC1[255:240)); 
TMP_DEST[199:1 92] := SaturateSignedWordToSignedByte (SRC2[143:128)); 
TMP_DEST[207:200] := SaturateSignedWordToSignedByte (SRC2[159:144}); 
TMP_DEST[215:208] := SaturateSignedWordToSignedByte (SRC2[175:160)); 
TMP_DEST[223:216] := SaturateSignedWordToSignedByte (SRC2[191:176]); 
TMP_DEST[231:224] := SaturateSignedWordToSignedByte (SRC2[207:192)); 
TMP_DEST[239:232] := SaturateSignedWordToSignedByte (SRC2[223:208)); 
TMP_DEST[247:240] := SaturateSignedWordToSignedByte (SRC2[239:224}); 
TMP_DEST[255:248] := SaturateSignedWordToSignedByte (SRC2[255:240)); 


IF VL >=512 


Fl; 


TMP_DEST[263:256] := SaturateSignedWordToSignedByte 
TMP_DEST[271:264] := SaturateSignedWordToSignedByte 
TMP_DEST[279:272] := SaturateSignedWordToSignedByte 
TMP_DEST[287:280] := SaturateSignedWordToSignedByte 
TMP_DEST[295:288] := SaturateSignedWordToSignedByte 
TMP_DEST[303:296] := SaturateSignedWordToSignedByte 
TMP_DEST[31 1:304] := SaturateSignedWordToSignedByte 
TMP_DEST[319:312] := SaturateSignedWordToSignedByte 


SRC1[271:256]); 
SRC1[287:272]); 
SRC1[303:288)); 
SRC1[319:304)); 
SRC1[335:320] 
SRC1[351:336] 
SRC1[367:352] 
SRC1[383:368] 


in 


I" 


In 


In 


RR 
a 


TMP_DEST[327:320] := SaturateSignedWordToSignedByte 
TMP_DEST[335:328] := SaturateSignedWordToSignedByte 
TMP_DEST[343:336] := SaturateSignedWordToSignedByte 
TMP_DEST[351:344] := SaturateSignedWordToSignedByte 
TMP_DEST[359:352] := SaturateSignedWordToSignedByte 
TMP_DEST[367:360] := SaturateSignedWordToSignedByte 
TMP_DEST[375:368] := SaturateSignedWordToSignedByte 
TMP_DEST[383:376] := SaturateSignedWordToSignedByte 


SRC2[271:256)]); 
SRC2[287:272]); 
SRC2[303:288)); 
SRC2[319:304)); 
SRC2[335:320)); 
SRC2[351:336)); 
SRC2[367:352)); 
SRC2[383:368)); 


i ae pata (pati. pitas, (fata: pit 


TMP_DEST[391:384] := SaturateSignedWordToSignedByte 
TMP_DEST[399:392] := SaturateSignedWordToSignedByte 
TMP_DEST[407:400] := SaturateSignedWordToSignedByte 
TMP_DEST[415:408] := SaturateSignedWordToSignedByte 
TMP_DEST[423:416] := SaturateSignedWordToSignedByte 
TMP_DEST[431:424] := SaturateSignedWordToSignedByte 
TMP_DEST[439:432] := SaturateSignedWordToSignedByte 
TMP_DEST[447:440] := SaturateSignedWordToSignedByte 


SRC1[399:384]); 
SRC1[415:400)); 
SRC1[431:416]); 
SRC1[447:432]); 
SRC1[463:448)]) 
SRC1[479:464)); 
SRC1[495:480)); 


SRC1[511:496)); 


In 


In 


(a pn im ip i te 


TMP_DEST[455:448] := SaturateSignedWordToSignedByte 
TMP_DEST[463:456] := SaturateSignedWordToSignedByte 
TMP_DEST[471:464] := SaturateSignedWordToSignedByte 
TMP_DEST[479:472] := SaturateSignedWordToSignedByte 
TMP_DEST[487:480] := SaturateSignedWordToSignedByte 
TMP_DEST[495:488] := SaturateSignedWordToSignedByte 
TMP_DEST[503:496] := SaturateSignedWordToSignedByte 
TMP_DEST[511:504] := SaturateSignedWordToSignedByte 


SRC2[399:384)]); 
SRC2[415:400)); 
SRC2[431:416]); 
SRC2[447:432]); 
SRC2[463:448)); 
SRC2[479:464)); 
SRC2[495:480)); 
SRC2[511:496)); 


(a (iin, fits, | an pitanja, ein: Gita, 


FOR j := 0 TO KL-1 


i:=j*8 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+7:i] := TMP_DEST[i+7:i] 
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ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPACKSSDW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO ((KL/2) - 1) 

i:=j* 32 


IF (EVEX.b == 1) AND (SRC2 *is memory*) 


THEN 
TMP_SRC2[i+31:i] := SRC2[31:0] 
ELSE 
TMP_SRC2[i+31:i] := SRC2[i+31:i] 
Fl; 
ENDFOR; 


TMP_DEST[15:0] := SaturateSignedDwordToSignedWord (SRC1[31:0)); 
TMP_DEST[31:16] := SaturateSignedDwordToSignedWord (SRC1[63:32]); 
TMP_DEST[47:32] := SaturateSignedDwordToSignedword (SRC1[95:64)); 
TMP_DEST[63:48] := SaturateSignedDwordToSignedword (SRC1[127:96]); 
TMP_DEST[79:64] := SaturateSignedDwordToSignedword (TMP_SRC2[31:0]); 
TMP_DEST[95:80] := SaturateSignedDwordToSignedword (TMP_SRC2[63:32]); 
TMP_DEST[1 1 1:96] := SaturateSignedDwordToSignedword (TMP_SRC2[95:64)); 
TMP_DEST[127:112] := SaturateSignedDwordToSignedword (TMP_SRC2[127:96)); 
IF VL >= 256 
TMP_DEST[143:128] := SaturateSignedDwordToSignedWord (SRC1[159:128] 
TMP_DEST[159:144] := SaturateSignedDwordToSignedWord (SRC1[191:160] 
TMP_DEST[175:160] := SaturateSignedDwordToSignedWord (SRC1[223:192] 
TMP_DEST[191:1 76] := SaturateSignedDwordToSignedWord (SRC1[255:224] 
TMP_DEST[207:1 92] := SaturateSignedDwordToSignedword 
TMP_DEST[223:208] := SaturateSignedDwordToSignedword 
TMP_DEST[239:224] := SaturateSignedDwordToSignedword 
TMP_DEST[255:240] := SaturateSignedDwordToSignedword 


I" 


In 


In 


a) 


i" 


lO 


Fl; 
IF VL >= 512 
TMP_DEST[271:256] := SaturateSignedDwordToSignedword (SRC1[287:256]); 
TMP_DEST[287:272] := SaturateSignedDwordToSignedword (SRC1[319:288]); 
) 
) 


TMP_DEST[303:288] := SaturateSignedDwordToSignedWord (SRC1[351:320] 
TMP_DEST[319:304] := SaturateSignedDwordToSignedword (SRC1[383:352]); 


in 


TMP_DEST[335:320] := SaturateSignedDwordToSignedword (TMP_SRC2[287:256] 

(TMP_SRC2[319:288] 
TMP_DEST[367:352] := SaturateSignedDwordToSignedword (TMP_SRC2[351:320] 
TMP_DEST[383:368] := SaturateSignedDwordToSignedword (TMP_SRC2[383:352] 


TMP_DEST[351:336] := SaturateSignedDwordToSignedword 


TMP_DEST[399:384] := SaturateSignedDwordToSignedword (SRC1[415:384]); 
TMP_DEST[415:400] := SaturateSignedDwordToSignedword (SRC1[447:416]); 
TMP_DEST[431:416] := SaturateSignedDwordToSignedword (SRC1[479:448]); 


4-198 Vol. 2B 


TMP_SRC2[159:128] 
TMP_SRC2[191:160] 
TMP_SRC2[223:192] 
TMP_SRC2[255:224] 


fi 


fi 


fi 


1 


fi 


fi 


fi 


fi 
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TMP_DEST[447:432] := SaturateSignedDwordToSignedword (SRC1[51 1:480)); 

TMP_DEST[463:448] := SaturateSignedDwordT oSignedWord (TMP_SRC2[41 5:384}); 

TMP_DEST[479:464] := SaturateSignedDwordToSignedword (TMP_SRC2[447:416)]); 
( )s 
( ) 


TMP_DEST[495:480] := SaturateSignedDwordToSignedWord (TMP_SRC2[479:448] 
TMP_DEST[51 1:496] := SaturateSignedDwordToSignedWord (TMP_SRC2[51 1:480] 


in 


in 


Fl; 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPACKSSDW__m512i_mm512_packs_epi32(__m512im1,___m512i m2); 
VPACKSSDW__m512i_mm512_mask_packs_epi32(__m512is,__mmask32 k,__m512im1,__m512i m2); 
VPACKSSDW__m512i_mm512_maskz_packs_epi32(__ mmask32 k,__m512im1,__m512i m2); 
VPACKSSDW__m256i__mm256_mask_packs_epi32(__m256is,__ mmask16 k,__ m256i m1,_ m256i m2); 
VPACKSSDW__m256i __mm256_maskz_packs_epi32(__ mmask16 k,__ m256i m1, ___m256i m2); 
VPACKSSDW__m128i __mm_mask_packs_epi32(__m128is,__ mmask8 k,__m128i m1,__m128i m2); 
VPACKSSDW__m128i __mm_maskz_packs_epi32(__mmask8 k,___m128im1,__m128i m2); 
VPACKSSWB__m512i_mm512_packs_epi16(__m512im1,___m512i m2); 
VPACKSSWB__m512i__mm512_mask_packs_epi16(__m512i s,__ mmask32 k,__m512im1,__m512i m2); 
VPACKSSWB__m512i_mm512_maskz_packs_epi16(__mmask32 k,__m512im1,__m512i m2); 
VPACKSSWB__m256i__mm256_mask_packs_epi16(__m256is,__ mmask16 k,__ m256im1,__ m256i m2); 
VPACKSSWB__m256i __mm256_maskz_packs_epi16(__mmask16 k,__ m256i m1,__ m256i m2); 
VPACKSSWB__m128i __mm_mask_packs_epi16(__m128is,__ mmask8 k,__m128im1,__m128i m2); 
VPACKSSWB__m128i __mm_maskz_packs_epi16(__mmask8 k,__m128i m1,__m128i m2); 

PACKSSWB __m128i__mm_packs_epi16(__m128i m1,_m128i m2) 

PACKSSDW __m128i__mm_packs_epi32(__m128i m1, __m128i m2) 

VPACKSSWB __m256i __mm256_packs_epi16(__m256i m1,__ m256i m2) 

VPACKSSDW __m256i__mm256_packs_epi32(__m256i m1,__ m256i m2) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded VPACKSSDW, see Table 2-50, “Type E4NF Class Exception Conditions”. 

EVEX-encoded VPACKSSWB, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

66 OF 38 2B /r A VIV SSE4_1 Convert 4 packed signed doubleword integers from xmm1 

PACKUSDW xmm1, xmm2/m128 and 4 packed signed doubleword integers from 
xmm2/m1 28 into 8 packed unsigned word integers in 
Xmm71 using unsigned saturation. 

VEX.128.66.0F38 2B /r B VIV AVX Convert 4 packed signed doubleword integers from xmm2 

VPACKUSDW xmm1,xmm2, and 4 packed signed doubleword integers from 

xmm3/m128 xmm3/m1 28 into 8 packed unsigned word integers in 
Xmm_71 using unsigned saturation. 

VEX.256.66.0F38 2B /r B VIV AVX2 Convert 8 packed signed doubleword integers from ymm2 

VPACKUSDW ymm1, ymm2, and 8 packed signed doubleword integers from 

ymm3/m256 ymm3/m256 into 16 packed unsigned word integers in 
ymm1 using unsigned saturation. 

EVEX.128.66.0F38.W0 2B /r C VIV AVX512VL Convert packed signed doubleword integers from xmm2 

VPACKUSDW xmm1{k1}{z}, AVX512BW | and packed signed doubleword integers from 

xmm2, xmm3/m128/m32bcst xmm3/m128/m32bcst into packed unsigned word integers 
in xmm1 using unsigned saturation under writemask k1. 

EVEX.256.66.0F38.W0 2B /r C VIV AVX512VL Convert packed signed doubleword integers from ymm2 

VPACKUSDW ymm1{k1}{z}, AVX512BW | and packed signed doubleword integers from 

ymm2, ymm3/m256/m32bcst ymm3/m256/m32bcst into packed unsigned word integers 
in ymm1 using unsigned saturation under writemask k1. 

EVEX.512.66.0F38.W0 2B /r C VIN AVX512BW | Convert packed signed doubleword integers from zmm2 

VPACKUSDW zmm1{k1}{z}, and packed signed doubleword integers from 

zmm2, zmm3/m5 12/m32bcst zmm3/m512/m32bcst into packed unsigned word integers 
in zmm1 using unsigned saturation under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts packed signed doubleword integers in the first and second source operands into packed unsigned word 
integers using unsigned saturation to handle overflow conditions. If the signed doubleword value is beyond the 
range of an unsigned word (that is, greater than FFFFH or less than OOOOH), the saturated unsigned word integer 
value of FFFFH or OOOOH, respectively, is stored in the destination. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 32- 
bit memory location. The destination operand is a ZMM register, updated conditionally under the writemask k1. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 
corresponding ZMM register destination are zeroed. 


VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding destination register destination are unmodified. 
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Operation 


PACKUSDW (Legacy SSE instruction) 

TMP[15:0] := (DEST[31:0] < 0) ? 0: DEST[15:0); 

DEST[15:0] := (DEST[31:0] > FFFFH) ? FFFFH : TMP[15:0] ; 
TMP[31:16] := (DEST[63:32] < 0)? 0 : DEST[47:32]; 
DEST[31:16] := (DEST[63:32] > FFFFH) ? FFFFH : TMP[31:16] ; 
TMP[47:32] := (DEST[95:64] < 0) ? 0 : DEST[79:64]; 
DEST[47:32] := (DEST[95:64] > FFFFH) ? FFFFH : TMP[47:32]; 
TMP[63:48] := (DEST[127:96] < 0) ? 0: DEST[111:96]; 
DEST[63:48] := (DEST[127:96] > FFFFH) ? FFFFH : TMP[63:48] ; 
TMP[79:64] := (SRC[31:0] < 0) ? 0: SRC[15:0]; 

DEST[79:64] := (SRC[31:0] > FFFFH) ? FFFFH : TMP[79:64] ; 
TMP[95:80] := (SRC[63:32] < 0) ? 0: SRC[47:32]; 

DEST[95:80] := (SRC[63:32] > FFFFH) ? FFFFH : TMP[95:80] ; 
TMP[1 11:96] := (SRC[95:64] < 0)? 0: SRC[79:64]; 
DEST[111:96] := (SRC[95:64] > FFFFH) ? FFFFH : TMP[11 1:96] ; 
TMP[127:112] := (SRC[127:96] < 0) ? 0: SRC[11 1:96]; 
DEST[127:112] := (SRC[127:96] > FFFFH) ? FFFFH : TMP[127:112]; 
DEST[MAXVL-1:1 28] (Unmodified) 


PACKUSDW (VEX.128 encoded version) 

TMP[15:0] := (SRC1[31:0] < 0) ? 0: SRC1[15:0]; 

DEST[15:0] := (SRC1[31:0] > FFFFH) ? FFFFH : TMP[15:0] ; 
TMP[31:16] := (SRC1[63:32] < 0)? 0: SRC1[47:32]; 
DEST[31:16] := (SRC1[63:32] > FFFFH) ? FFFFH : TMP[31:16]; 
TMP[47:32] := (SRC1[95:64] < 0) ? 0: SRC1[79:64]; 
DEST[47:32] := (SRC1[95:64] > FFFFH) ? FFFFH : TMP[47:32] ; 
TMP[63:48] := (SRC1[127:96] < 0) ? 0: SRC1[111:96]; 
DEST[63:48] := (SRC1[127:96] > FFFFH) ? FFFFH : TMP[63:48] ; 
TMP[79:64] := (SRC2[31:0] < 0)? 0: SRC2[15:0]; 

DEST[79:64] := (SRC2[31:0] > FFFFH) ? FFFFH : TMP[79:64] ; 
TMP[95:80] := (SRC2[63:32] < 0) ? 0 : SRC2[47:32]; 
DEST[95:80] := (SRC2[63:32] > FFFFH) ? FFFFH : TMP[95:80] ; 
TMP[1 11:96] := (SRC2[95:64] < 0) ? 0: SRC2[79:64]; 

DEST[1 11:96] := (SRC2[95:64] > FFFFH) ? FFFFH : TMP[1 11:96]; 
TMP[127:112] := (SRC2[127:96] < 0)? 0: SRC2[111:96]; 


DEST[127:112] := (SRC2[127:96] > FFFFH) ? FFFFH : TMP[127:11 2]; 


DEST[MAXVL-1:128] := 0; 


VPACKUSDW (VEX.256 encoded version) 

TMP[15:0] := (SRC1[31:0] < 0) ? 0: SRC1[15:0]; 

DEST[15:0] := (SRC1[31:0] > FFFFH) ? FFFFH : TMP[15:0] ; 
TMP[31:16] := (SRC1[63:32] < 0) ? 0: SRC1[47:32]; 
DEST[31:16] := (SRC1[63:32] > FFFFH) ? FFFFH : TMP[31:16] ; 
TMP[47:32] := (SRC1[95:64] < 0) ? 0: SRC1[79:64]; 
DEST[47:32] := (SRC1[95:64] > FFFFH) ? FFFFH : TMP[47:32] ; 
TMP[63:48] := (SRC1[127:96] < 0) ? 0: SRC1[111:96]; 
DEST[63:48] := (SRC1[127:96] > FFFFH) ? FFFFH : TMP[63:48] ; 
TMP[79:64] := (SRC2[31:0] < 0)? 0: SRC2[15:0]; 

DEST[79:64] := (SRC2[31:0] > FFFFH) ? FFFFH : TMP[79:64] ; 
TMP[95:80] := (SRC2[63:32] < 0) ? 0: SRC2[47:32]; 
DEST[95:80] := (SRC2[63:32] > FFFFH) ? FFFFH : TMP[95:80] ; 
TMP[11 1:96] := (SRC2[95:64] < 0) ? 0: SRC2[79:64]; 

DEST[1 11:96] := (SRC2[95:64] > FFFFH) ? FFFFH : TMP[11 1:96]; 
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TMP[127:1 12] := (SRC2[127:96] < 0)? 0: SRC2[11 1:96]; 
DEST[127:112] := (SRC2[127:96] > FFFFH) ? FFFFH : TMP[127:112]; 
TMP[143:1 28] := (SRC1[159:128] < 0) ? 0: SRC1[143:128]; 
DEST[143:128] := (SRC1[159:128] > FFFFH) ? FFFFH : TMP[143:128] ; 
TMP[159:1 44] := (SRC1[191:160] < 0) ? 0: SRC1[175:160]; 
DEST[159:144] := (SRC1[191:160] > FFFFH) ? FFFFH : TMP[159:1 44] ; 
TMP[175:160] := (SRC1[223:192] < 0)? 0: SRC1[207:192]; 
DEST[175:160] := (SRC1[223:192] > FFFFH) ? FFFFH : TMP[175:160] ; 
TMP[191:1 76] := (SRC1[255:224] < 0)? 0: SRC1[239:224]; 
DEST[191:176] := (SRC1[255:224] > FFFFH) ? FFFFH : TMP[191:1 76] ; 
TMP[207:1 92] := (SRC2[159:128] < 0) ? 0: SRC2[143:1 28]; 
DEST[207:192] := (SRC2[159:128] > FFFFH) ? FFFFH : TMP[207:192] ; 
TMP[223:208] := (SRC2[191:160] < 0) ? 0: SRC2[175:160]; 
DEST[223:208] := (SRC2[191:160] > FFFFH) ? FFFFH : TMP[223:208] ; 
TMP[239:224] := (SRC2[223:192] < 0)? 0: SRC2[207:192]; 
DEST[239:224] := (SRC2[223:192] > FFFFH) ? FFFFH : TMP[239:224] ; 
TMP[255:240] := (SRC2[255:224] < 0)? 0: SRC2[239:224]; 
DEST[255:240] := (SRC2[255:224] > FFFFH) ? FFFFH : TMP[255:240] ; 
DEST[MAXVL-1:256] := 0; 


VPACKUSDW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO ((KL/2) - 1) 

i:=j* 32 


IF (EVEX.b == 1) AND (SRC2 *is memory*) 


THEN 
TMP_SRC2Z[i+31:i] := SRC2[31:0] 
ELSE 
TMP_SRC2[i+31:i] := SRC2[i+31:i] 
Fl; 
ENDFOR; 


TMP[15:0] := (SRC1[31:0] < 0)? 0: SRC1[15:0}; 
DEST[15:0] := (SRC1[31:0] > FFFFH) ? FFFFH : TMP[15:0]; 
TMP[31:16] = (SRC1[63:32] < 0)? 0: SRC1[47:32]; 
DEST[31:16] := (SRC1[63:32] > FFFFH) ? FFFFH : TMP[31:16] ; 
TMP[47:32] := (SRC1[95:64] < 0)? 0: SRC1[79:64]; 
DEST[47:32] := (SRC1[95:64] > FFFFH) ? FFFFH : TMP[47:32] ; 
TMP[63:48] := (SRC1[127:96] < 0)? 0: SRC1[111:96]; 
DEST[63:48] := (SRC1[127:96] > FFFFH) ? FFFFH : TMP[63:48] ; 
TMP[79:64] := (TMP_SRC2[31:0] < 0)? 0: TMP_SRC2[15:0]; 
DEST[79:64] := (TMP_SRC2[31:0] > FFFFH) ? FFFFH : TMP[79:64] ; 
TMP[95:80] = (TMP_SRC2[63:32] < 0)? 0: TMP_SRC2[47:32]; 
DEST[95:80] := (TMP_SRC2[63:32] > FFFFH) ? FFFFH : TMP[95:80] ; 
TMP[1 11:96] := (TMP_SRC2[95:64] < 0)? 0 : TMP_SRC2[79:64]; 
DEST[1 11:96] := (TMP_SRC2[95:64] > FFFFH) ? FFFFH : TMP[111:96]; 
TMP[127:112] := (TMP_SRC2[127:96] < 0)? 0 : TMP_SRC2[1 11:96]; 
DEST[127:112] = (TMP_SRC2[127:96] > FFFFH) ? FFFFH : TMP[127:112]; 
IF VL >= 256 
TMP[143:128] = (SRC1[159:128] < 0)? 0: SRC1[143:128]; 
DEST[143:128] := (SRC1[159:128] > FFFFH) ? FFFFH : TMP[143:128] ; 
TMP[159:144] = (SRC1[191:160] < 0)? 0: SRC1[175:160]; 
DEST[159:144] := (SRC1[191:160] > FFFFH) ? FFFFH : TMP[159:144] ; 
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TMP[175:160] := (SRC1[223:192] < 0)? 0: SRC1[207:192]; 
DEST[175:160] := (SRC1[223:192] > FFFFH) ? FFFFH : TMP[175:160] ; 
TMP[191:1 76] := (SRC1[255:224] < 0)? 0: SRC1[239:224]; 
DEST[191:1 76] := (SRC1[255:224] > FFFFH) ? FFFFH : TMP[191:1 76]; 
TMP[207:192] := (TMP_SRC2[159:1 28] < 0)? 0: TMP_SRC2[143:128]; 
DEST[207:1 92] := (TMP_SRC2[159:128] > FFFFH) ? FFFFH : TMP[207:192]; 
TMP[223:208] := (TMP_SRC2[191:160] < 0)? 0: TMP_SRC2[175:160]; 
DEST[223:208] := (TMP_SRC2[191:160] > FFFFH) ? FFFFH : TMP[223:208] ; 
TMP[239:224] := (TMP_SRC2[223:192] < 0)? 0: TMP_SRC2[207:192]; 
DEST[239:224] := (TMP_SRC2[223:192] > FFFFH) ? FFFFH : TMP[239:224] ; 
TMP[255:240] := (TMP_SRC2[255:224] < 0)? 0: TMP_SRC2[239:224)]; 
DEST[255:240] := (TMP_SRC2[255:224] > FFFFH) ? FFFFH : TMP[255:240] ; 
Fl; 
IF VL >= 512 
TMP[271:256] := (SRC1[287:256] < 0)? 0: SRC1[271:256]; 
DEST[271:256] := (SRC1[287:256] > FFFFH) ? FFFFH : TMP[271:256] ; 
TMP[287:272] := (SRC1[319:288] < 0) ? 0 : SRC1[303:288]; 
DEST[287:272] := (SRC1[319:288] > FFFFH) ? FFFFH : TMP[287:272]; 
TMP[303:288] := (SRC1[351:320] < 0)? 0: SRC1[335:320]; 
DEST[303:288] := (SRC1[351:320] > FFFFH) ? FFFFH : TMP[303:288] ; 
TMP[319:304] := (SRC1[383:352] < 0)? 0: SRC1[367:352]; 
DEST[319:304] := (SRC1[383:352] > FFFFH) ? FFFFH : TMP[319:304] ; 
TMP[335:320] := (TMP_SRC2[287:256] < 0)? 0: TMP_SRC2[271:256]; 
DEST[335:304] := (TMP_SRC2[287:256] > FFFFH) ? FFFFH : TMP[79:64] ; 
TMP[351:336] := (TMP_SRC2[319:288] < 0)? 0: TMP_SRC2[303:288]; 
DEST[351:336] := (TMP_SRC2[319:288] > FFFFH) ? FFFFH : TMP[351:336] ; 
TMP[367:352] := (TMP_SRC2[351:320] < 0)? 0: TMP_SRC2[315:320]; 
DEST[367:352] := (TMP_SRC2[351:320] > FFFFH) ? FFFFH : TMP[367:352] ; 
TMP[383:368] := (TMP_SRC2[383:352] < 0)? 0: TMP_SRC2[367:352]; 
DEST[383:368] := (TMP_SRC2[383:352] > FFFFH) ? FFFFH : TMP[383:368] ; 
TMP[399:384] := (SRC1[415:384] < 0)? 0: SRC1[399:384]; 
DEST[399:384] := (SRC1[415:384] > FFFFH) ? FFFFH : TMP[399:384] ; 
TMP[415:400] := (SRC1[447:416] < 0)? 0: SRC1[431:416]; 
DEST[415:400] := (SRC1[447:416] > FFFFH) ? FFFFH : TMP[415:400] ; 
TMP[431:416] := (SRC1[479:448] < 0)? 0: SRC1[463:448]; 
DEST[431:416] := (SRC1[479:448] > FFFFH) ? FFFFH : TMP[431:416]; 
TMP[447:432] := (SRC1[511:480] < 0)? 0: SRC1[495:480]; 
DEST[447:432] := (SRC1[511:480] > FFFFH) ? FFFFH : TMP[447:432]; 
TMP[463:448] := (TMP_SRC2[415:384] < 0)? 0: TMP_SRC2[399:384]; 
DEST[463:448] := (TMP_SRC2[415:384] > FFFFH) ? FFFFH : TMP[463:448] ; 
TMP[475:464] := (TMP_SRC2[447:416] < 0)? 0: TMP_SRC2[431:416]; 
DEST[475:464] := (TMP_SRC2[447:416] > FFFFH) ? FFFFH : TMP[475:464] ; 
TMP[491:476] := (TMP_SRC2[479:448] < 0)? 0: TMP_SRC2[463:448]; 
DEST[491:476] := (TMP_SRC2[479:448] > FFFFH) ? FFFFH : TMP[491:476] ; 
TMP[51 1:492] := (TMP_SRC2[51 1:480] < 0)? 0: TMP_SRC2[495:480]; 
DEST[511:492] := (TMP_SRC2[511:480] > FFFFH) ? FFFFH : TMP[511:492]; 
Fl; 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+15:i] = TMP_DEST[i+1 5:i] 
ELSE 
IF *merging-masking* ; merging-masking 
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THEN *DEST{[i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPACKUSDW__m512i_mm512_packus_epi32(__m512im1,__m512i m2); 
VPACKUSDW__m512i__mm512_mask_packus_epi32(__m512is,__ mmask32 k,__m512im1,__m512i m2); 
VPACKUSDW__m512i__mm512_maskz_packus_epi32(__mmask32 k,__m512im1,__m512i m2); 
VPACKUSDW__m256i __mm256_mask_packus_epi32(__m256is,__ mmask16 k,___ m256i m1,_m256i m2); 
VPACKUSDW__m256i __mm256_maskz_packus_epi32(__mmask16 k,__ m256im1,__ m256i m2); 
VPACKUSDW__m128i __mm_mask_packus_epi32(__m128is,___ mmask8 k,__m128i m1,__m128i m2); 
VPACKUSDW__m128i__mm_maskz_packus_epi32(__mmask8 k,__m128i m1,__m128i m2); 
PACKUSDW__m128i __mm_packus_epi32(__m128i m1,__m128i m2); 

VPACKUSDW__m256i _mm256_packus_epi32(__m256i m1,__ m256i m2); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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PACKUSWB—Pack with Unsigned Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature Flag 
Support 

NP OF 67 /r A VIV MMX Converts 4 signed word integers from mm and 

PACKUSWB mm, mm/m64 4 signed word integers from mm/m64 into 8 
unsigned byte integers in mm using unsigned 
saturation. 

66 OF 67 /r A VIV SSE2 Converts 8 signed word integers from xmm1 

PACKUSWB xmm1, xmm2/m128 and 8 signed word integers from xmm2/m128 
into 16 unsigned byte integers in xmm7 using 
unsigned saturation. 

VEX.128.66.0F.WIG 67 /r B VIV AVX Converts 8 signed word integers from xmm2 

VPACKUSWB xmm1, xmm2, xmm3/m128 and 8 signed word integers from xmm3/m128 
into 16 unsigned byte integers in xmm7 using 
unsigned saturation. 

VEX.256.66.0F.WIG 67 /r B VIV AVX2 Converts 16 signed word integers from ymm2 

VPACKUSWB ymm1, ymm2, ymm3/m256 and 16signed word integers from 
ymm3/m256 into 32 unsigned byte integers 
in ymm7 using unsigned saturation. 

EVEX.128.66.0F.WIG 67 /r C VIV AVX512VL ‘| Converts signed word integers from xmm2 

VPACKUSWB xmm1{k1}{z}, xmm2, xmm3/m128 AVX512BW | and signed word integers from xmm3/m128 
into unsigned byte integers in xmm7 using 
unsigned saturation under writemask k1. 

EVEX.256.66.0F.WIG 67 /r C VIV AVX512VL | Converts signed word integers from ymm2 

VPACKUSWB ymm1{k1}{z}, ymm2, ymm3/m256 AVX512BW | and signed word integers from ymm3/m256 
into unsigned byte integers in ymm7 using 
unsigned saturation under writemask k1. 

EVEX.512.66.0F.WIG 67 /r C VIV AVX512BW | Converts signed word integers from zmm2 

VPACKUSWB zmm1{k1}{z}, zmm2, zmm3/m512 and signed word integers from zmm3/m512 
into unsigned byte integers in zmm17 using 
unsigned saturation under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” in 
the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts 4, 8, 16 or 32 signed word integers from the destination operand (first operand) and 4, 8, 16 or 32 signed 
word integers from the source operand (second operand) into 8, 16, 32 or 64 unsigned byte integers and stores the 
result in the destination operand. (See Figure 4-6 for an example of the packing operation.) If a signed word 
integer value is beyond the range of an unsigned byte integer (that is, greater than FFH or less than OOH), the satu- 
rated unsigned byte integer value of FFH or OOH, respectively, is stored in the destination. 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register or a 512-bit memory location. The destination operand is a ZMM register. 
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VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand 
is a YMM register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL- 
1:256) of the corresponding ZMM register destination are zeroed. 

VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand 
is an XMM register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL- 
1:128) of the corresponding register destination are zeroed. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding register destination are unmodified. 


Operation 


PACKUSWB (with 64-bit operands) 
DEST[7:0] := SaturateSignedWordToUnsignedByte DEST[1 5:0]; 
DEST[15:8] := SaturateSignedWwordToUnsignedByte DEST[31:16]; 
DEST[23:16] := SaturateSignedwordToUnsignedByte DEST[47:32]; 
DEST[31:24] := SaturateSignedWwordToUnsignedByte DEST[63:48]; 
DEST[39:32] := SaturateSignedwordToUnsignedByte SRC[1 5:0); 
DEST[47:40] := SaturateSignedwordToUnsignedByte SRC[31:16]; 
DEST[55:48] := SaturateSignedWwordToUnsignedByte SRC[47:32]; 
DEST[63:56] := SaturateSignedWwordToUnsignedByte SRC[63:48]; 


PACKUSWB (Legacy SSE instruction) 
DEST[7:0] := SaturateSignedWordToUnsignedByte (DEST[15:0)); 
DEST[15:8] := SaturateSignedWordToUnsignedByte (DEST[31:16]); 
DEST[23:16] := SaturateSignedWordToUnsignedByte (DEST[47:32]); 
DEST[31:24] := SaturateSignedWordToUnsignedByte (DEST[63:48)); 
DEST[39:32] := SaturateSignedWordToUnsignedByte (DEST[79:64}) 
DEST[47:40] := SaturateSignedWordToUnsignedByte (DEST[95:80)); 
DEST[55:48] := SaturateSignedWordToUnsignedByte (DEST[1 1 1:96)); 
DEST[63:56] := SaturateSignedWordToUnsignedByte (DEST[127:112]); 
DEST[7 1:64] := SaturateSignedWordToUnsignedByte (SRC[15:0]); 
DEST[79:72] := SaturateSignedWordToUnsignedByte (SRC[31:16)); 
DEST[87:80] := SaturateSignedWordToUnsignedByte (SRC[47:32]); 
DEST[95:88] := SaturateSignedWordToUnsignedByte (SRC[63:48)); 
DEST[103:96] := SaturateSignedWordToUnsignedByte (SRC[79:64)); 
DEST[111:104] := SaturateSignedWordToUnsignedByte (SRC[95:80)); 
DEST[1 19:1 12] := SaturateSignedWordToUnsignedByte (SRC[1 1 1:96)); 
DEST[127:120] := SaturateSignedWordToUnsignedByte (SRC[127:112]); 


fi 


SO ne 


PACKUSWB (VEX.128 encoded version) 
DEST[7:0] := SaturateSignedWordToUnsignedByte (SRC1[15:0)); 
DEST[15:8] := SaturateSignedWordToUnsignedByte (SRC1[31:16)); 
DEST[23:16] := SaturateSignedWordToUnsignedByte (SRC1[47:32]); 
DEST[31:24] := SaturateSignedWordToUnsignedByte (SRC1[63:48}); 
DEST[39:32] := SaturateSignedWordToUnsignedByte (SRC1[79:64}); 
DEST[47:40] := SaturateSignedWordToUnsignedByte (SRC1[95:80)); 
DEST[55:48] := SaturateSignedWordToUnsignedByte (SRC1[1 1 1:96)); 
DEST[63:56] := SaturateSignedWordToUnsignedByte (SRC1[127:112]); 
DEST[7 1:64] := SaturateSignedWordToUnsignedByte (SRC2[1 5:0); 
DEST[79:72] := SaturateSignedWordToUnsignedByte (SRC2[31:16]); 
DEST[87:80] := SaturateSignedWordToUnsignedByte (SRC2[47:32]); 
DEST[95:88] := SaturateSignedWordToUnsignedByte (SRC2[63:48)); 
DEST[103:96] := SaturateSignedWordToUnsignedByte (SRC2[79:64)); 
DEST[111:104] := SaturateSignedWordToUnsignedByte (SRC2[95:80)); 


OO 
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DEST[119:1 12] := SaturateSignedWordToUnsignedByte (SRC2[1 1 1:96]); 
DEST[127:120] := SaturateSignedwordToUnsignedByte (SRC2[127:112]); 
DEST[MAXVL-1:128] := 0; 


VPACKUSWB (VEX.256 encoded version) 
DEST[7:0] := SaturateSignedWwordToUnsignedByte (SRC1[15:0]); 
DEST[15:8] := SaturateSignedwordToUnsignedByte (SRC1[31:16]); 
DEST[23:16] := SaturateSignedWwordToUnsignedByte (SRC1[47:32]); 
DEST[31:24] := SaturateSignedwordToUnsignedByte (SRC1[63:48}); 
DEST[39:32] := SaturateSignedWordToUnsignedByte (SRC1[79:64]), 
DEST[47:40] := SaturateSignedwordToUnsignedByte (SRC1[95:80}); 
DEST[55:48] := SaturateSignedwordToUnsignedByte (SRC1[1 1 1:96]); 
DEST[63:56] := SaturateSignedwordToUnsignedByte (SRC1[127:112]); 
DEST[7 1:64] := SaturateSignedWwordToUnsignedByte (SRC2[15:0]); 
DEST[79:72] := SaturateSignedWwordToUnsignedByte (SRC2[31:16]); 
DEST[87:80] := SaturateSignedWordToUnsignedByte (SRC2[47:32]); 
DEST[95:88] := SaturateSignedwordToUnsignedByte (SRC2[63:48}); 
DEST[103:96] := SaturateSignedWordToUnsignedByte (SRC2[79:64}); 
DEST[111:104] := SaturateSignedWordToUnsignedByte (SRC2[95:80}); 
DEST[119:1 12] := SaturateSignedWordToUnsignedByte (SRC2[1 1 1:96]); 
DEST[127:120] := SaturateSignedWordToUnsignedByte (SRC2[127:112]) 
DEST[135:1 28] := SaturateSignedWordT oUnsignedByte (SRC1[143:128]) 
DEST[1 43:1 36] := SaturateSignedWordToUnsignedByte (SRC1[159:144}) 
DEST[151:144] := SaturateSignedWordToUnsignedByte (SRC1[1 75:160]) 
DEST[159:152] := SaturateSignedWordToUnsignedByte (SRC1[191:176]) 
DEST[167:160] := SaturateSignedWordToUnsignedByte (SRC1[207:192]) 
DEST[175:168] := SaturateSignedWordToUnsignedByte (SRC1[223:208}) 
DEST[183:1 76] := SaturateSignedwordToUnsignedByte (SRC1[239:224]); 
DEST[191:184] := SaturateSignedwordToUnsignedByte (SRC1[255:240}); 

) 
) 
) 
) 
) 
) 
) 
) 


In 
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in 
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In 
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In 


In 


DEST[199:1 92] := SaturateSignedWordToUnsignedByte (SRC2[143:128] 
DEST[207:200] := SaturateSignedWordToUnsignedByte (SRC2[159:144] 
DEST[215:208] := SaturateSignedWordToUnsignedByte (SRC2[175:160] 
DEST[223:216] := SaturateSignedWordToUnsignedByte (SRC2[191:176] 
DEST[231:224] := SaturateSignedWordToUnsignedByte (SRC2[207:192] 
DEST[239:232] := SaturateSignedWordToUnsignedByte (SRC2[223:208] 
DEST[247:240] := SaturateSignedWordToUnsignedByte (SRC2[239:224] 
DEST[255:248] := SaturateSignedWordToUnsignedByte (SRC2[255:240] 


i" 


In 


In 


in 


In 


in 


In 
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In 


VPACKUSWB (EVEX encoded versions) 

(KL, VL) = (16, 128), (32, 256), (64, 512) 

TMP_DEST[7:0] := SaturateSignedWordToUnsignedByte (SRC1[15:0)); 
TMP_DEST[15:8] := SaturateSignedwordToUnsignedByte (SRC1[31:16]); 
TMP_DEST[23:16] := SaturateSignedWordToUnsignedByte (SRC1[47:32]); 
TMP_DEST[31:24] := SaturateSignedWordToUnsignedByte (SRC1[63:48)); 
TMP_DEST[39:32] := SaturateSignedWordToUnsignedByte (SRC1[79:64]) 
TMP_DEST[47:40] := SaturateSignedWordToUnsignedByte (SRC1[95:80)); 
TMP_DEST[55:48] := SaturateSignedWordToUnsignedByte (SRC1[1 1 1:96)); 
TMP_DEST[63:56] := SaturateSignedwordToUnsignedByte (SRC1[127:112]); 
TMP_DEST[7 1:64] := SaturateSignedWordToUnsignedByte (SRC2[15:0)); 
TMP_DEST[79:72] := SaturateSignedWordToUnsignedByte (SRC2[31:16]); 
TMP_DEST[87:80] := SaturateSignedWordToUnsignedByte (SRC2[47:32]); 
TMP_DEST[95:88] := SaturateSignedwordToUnsignedByte (SRC2[63:48)); 
TMP_DEST[103:96] := SaturateSignedwordToUnsignedByte (SRC2[79:64)); 
TMP_DEST[111:104] := SaturateSignedWordToUnsignedByte (SRC2[95:80)); 


I" 
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TMP_DEST[119:112] := SaturateSignedWwordToUnsignedByte (SRC2[1 1 1:96]); 


TMP_DEST[127:120] := SaturateSignedWordToUnsignedByte (SRC2[1 27:11 2)); 


IF VL >= 256 
TMP_DEST[135:1 28] := SaturateSignedWordToUnsignedByte 
TMP_DEST[143:136] := SaturateSignedWordToUnsignedByte 
TMP_DEST[151:144] := SaturateSignedWordToUnsignedByte 
TMP_DEST[159:152] := SaturateSignedWordToUnsignedByte 
TMP_DEST[167:160] := SaturateSignedWordToUnsignedByte 
TMP_DEST[175:168] := SaturateSignedWordToUnsignedByte 
TMP_DEST[183:1 76] := SaturateSignedWordToUnsignedByte 
TMP_DEST[191:184] := SaturateSignedWordToUnsignedByte 
TMP_DEST[199:1 92] := SaturateSignedWordToUnsignedByte 
TMP_DEST[207:200] := SaturateSignedWordToUnsignedByte 
TMP_DEST[215:208] := SaturateSignedWordToUnsignedByte 
TMP_DEST[223:216] := SaturateSignedWordToUnsignedByte 
TMP_DEST[231:224] := SaturateSignedWordToUnsignedByte 
TMP_DEST[239:232] := SaturateSignedWordToUnsignedByte 
TMP_DEST[247:240] := SaturateSignedWordToUnsignedByte 
TMP_DEST[255:248] := SaturateSignedWordToUnsignedByte 


mi, «pais, Tpit pam, ia pam eins open, ma, sam, mi se pata ope, Span oem 


Fl; 

IF VL >=512 
TMP_DEST[263:256] := SaturateSignedWordToUnsignedByte 
TMP_DEST[271:264] := SaturateSignedWordToUnsignedByte 
TMP_DEST[279:272] := SaturateSignedWordToUnsignedByte 
TMP_DEST[287:280] := SaturateSignedWordToUnsignedByte 
TMP_DEST[295:288] := SaturateSignedWordToUnsignedByte 
TMP_DEST[303:296] := SaturateSignedWordToUnsignedByte 
TMP_DEST[31 1:304] := SaturateSignedWordToUnsignedByte 
TMP_DEST[319:312] := SaturateSignedWordToUnsignedByte 


pm pee, ipa (cia, Tami pam sipama oe 


TMP_DEST[327:320] := SaturateSignedWordToUnsignedByte 
TMP_DEST[335:328] := SaturateSignedWordToUnsignedByte 
TMP_DEST[343:336] := SaturateSignedWordToUnsignedByte 
TMP_DEST[351:344] := SaturateSignedWordToUnsignedByte 
TMP_DEST[359:352] := SaturateSignedWordToUnsignedByte 
TMP_DEST[367:360] := SaturateSignedWordToUnsignedByte 
TMP_DEST[375:368] := SaturateSignedWordToUnsignedByte 
TMP_DEST[383:376] := SaturateSignedWordToUnsignedByte 


ene mc pee a pe in my an 


TMP_DEST[391:384] := SaturateSignedWordToUnsignedByte 
TMP_DEST[399:392] := SaturateSignedWordToUnsignedByte 
TMP_DEST[407:400] := SaturateSignedWordToUnsignedByte 
TMP_DEST[415:408] := SaturateSignedWordToUnsignedByte 
TMP_DEST[423:416] := SaturateSignedWordToUnsignedByte 
TMP_DEST[431:424] := SaturateSignedWordToUnsignedByte 
TMP_DEST[439:432] := SaturateSignedWordToUnsignedByte 
TMP_DEST[447:440] := SaturateSignedWordToUnsignedByte 


ma pana, imi pea tipamas cia, prs epee 


TMP_DEST[455:448] := SaturateSignedWordToUnsignedByte 
TMP_DEST[463:456] := SaturateSignedWordToUnsignedByte 
TMP_DEST[471:464] := SaturateSignedWordToUnsignedByte 
TMP_DEST[479:472] := SaturateSignedWordToUnsignedByte 
TMP_DEST[487:480] := SaturateSignedWordToUnsignedByte 
TMP_DEST[495:488] := SaturateSignedWordToUnsignedByte 


ae ce pee a pm 
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TMP_DEST[503:496] := SaturateSignedWordToUnsignedByte (SRC2[495:480)); 
TMP_DEST[51 1:504] := SaturateSignedWordToUnsignedByte (SRC2[51 1:496)); 


Fl; 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+7:i] := TMP_DEST[i+7:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPACKUSWB__m512i__mm512_packus_epi16(__m512i m1,__m512i m2); 
VPACKUSWB__m512i__mm512_mask_packus_epi16(__m512is,___ mmask64 k,__m512im1,__m512i m2); 
VPACKUSWB__m512i __mm512_maskz_packus_epi16(__mmask64 k,__m512im1,__m512i m2); 
VPACKUSWB__m256i _mm256_mask_packus_epi16(__m256i s,___ mmask32 k,__ m256i m1,___m256i m2); 
VPACKUSWB__m256i _mm256_maskz_packus_epi16(__mmask32 k,__ m256i m1, __ m256i m2); 


VPACKUSWB__m128i __mm_mask_packus_epi16(__m128is,__ mmask16 k,___m128im1,__m128i m2); 
VPACKUSWB__m128i __mm_maskz_packus_epi16(__mmask16 k,__m128i m1, __m128i m2); 
PACKUSWB: m64 __mm_packs_pu16(__m64 m1,__m64 m2) 

(V)PACKUSWB: __m128i__mm_packus_epi16(__m128i m1,_m128i m2) 

VPACKUSWB: m256i_mm256_packus_epi16(__m256i m1, _ m256i m2); 

Flags Affected 

None 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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PADDB/PADDW/PADDD/PADDQ—Add Packed Integers 


ymm3/m256 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
NP OF FC /r! A VV MMX Add packed byte integers from mm/m64 and mm. 
PADDB mm, mm/m64 
NP OF FD /r! A VV MMX Add packed word integers from mm/m64 and mm. 
PADDW mm, mm/m64 
NP OF FE /r’ A VV MMX Add packed doubleword integers from mm/m64 and 
PADDD mm, mm/m64 mm. 
NP OF D4 /r' A VV MMX Add packed quadword integers from mm/m64 and 
PADDQ mm, mm/m64 mm. 
66 OF FC /r A VIV SSE2 Add packed byte integers from xmm2/m128 and 
PADDB xmm1, xmm2/m128 xmm1. 
66 OF FD /r A VIV SSE2 Add packed word integers from xmm2/m128 and 
PADDW xmm1, xmm2/m128 xmmt1. 
66 OF FE /r A VIV SSE2 Add packed doubleword integers from xmm2/m128 
PADDD xmm1, xmm2/m128 and xmm1. 
66 OF D4 /r A VIV SSE2 Add packed quadword integers from xmm2/m128 
PADDQ xmm1, xmm2/m128 and xmm1. 
VEX.128.66.0F.WIG FC /r B VIV AVX Add packed byte integers from xmm2, and 
VPADDB xmm1, xmm2, xmm3/m128 xmm3/m128 and store in xmm1. 
VEX.128.66.0F.WIG FD /r B VIV AVX Add packed word integers from xmm2, xmm3/m128 
VPADDW xmm1, xmm2, xmm3/m128 and store in xmm1. 
VEX.128.66.0F.WIG FE /r B VV AVX Add packed doubleword integers from xmm2, 
VPADDD xmm1, xmm2, xmm3/m128 xmm3/m128 and store in xmm1. 
VEX.128.66.0F.WIG D4 /r B VV AVX Add packed quadword integers from xmm2, 
VPADDQ xmm17, xmm2, xmm3/m128 xmm3/m128 and store in xmm1. 
VEX.256.66.0F.WIG FC /r B VIV AVX2 Add packed byte integers from ymm2, and 
VPADDB ymm1, ymm2, ymm3/m256 ymm3/m256 and store in ymm7. 
VEX.256.66.0F.WIG FD /r B VV AVX2 Add packed word integers from ymm2, ymm3/m256 
VPADDW ymm17, ymm2, ymm3/m256 and store in ymm1. 
VEX.256.66.0F.WIG FE /r B VIV AVX2 Add packed doubleword integers from ymm2, 
VPADDD ymm17, ymm2, ynm3/m256 ymm3/m256 and store in ymm1. 
VEX.256.66.0F.WIG D4 /r B VIV AVX2 Add packed quadword integers from ymm2, 
VPADDQ ymm1, ymm2, ymm3/m256 ymm3/m256 and store in ymm/7. 
EVEX.128.66.0F.WIG FC /r C VIV AVX512VL_ | Add packed byte integers from xmm2, and 
VPADDB xmm1 {k1}{z}, xmm2, AVX512BW | xmm3/m128 and store in xmm1 using writemask k1. 
xmm3/m128 
EVEX.128.66.0F.WIG FD /r C VIV AVX512VL_ | Add packed word integers from xmm2, and 
VPADDW xmm1 {k1}{z}, xmm2, AVX512BW | xmm3/m128 and store in xmm1 using writemask k1. 
xmm3/m128 
EVEX.128.66.0F.WO FE /r D VIV AVX512VL_ | Add packed doubleword integers from xmm2, and 
VPADDD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m32bcst and store in xmm7 using 
xmm3/m128/m32bcst writemask k1. 
EVEX.128.66.0F.W1 D4 /r D VV AVX512VL_ | Add packed quadword integers from xmm2, and 
VPADDQ xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst and store in xmm7 using 
xmm3/m128/m64bcst writemask k1. 
EVEX.256.66.0F.WIG FC /r C VIV AVX512VL_ | Add packed byte integers from ymm2, and 
VPADDB ymm1 {k1}{z}, ymm2, AVX512BW | ymm3/m256 and store in ymm7 using writemask k1. 
ymm3/m256 
EVEX.256.66.0F.WIG FD /r C VIV AVX512VL_ | Add packed word integers from ymm2, and 
VPADDW ymm1 {k1}{z}, ymm2, AVX512BW | ymm3/m256 and store in ymm7 using writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.256.66.0F.WO FE /r D VIV AVX512VL_ | Add packed doubleword integers from ymm2, 
VPADDD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and store in ymm17 using 
ymm3/m256/m32bcst writemask k1. 
EVEX.256.66.0F.W1 D4 /r D VIV AVX512VL_ | Add packed quadword integers from ymm2, 
VPADDQ ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst and store in ymm17 using 
ymm3/m256/m64bcst writemask k1. 
EVEX.512.66.0F.WIG FC /r C VV AVX512BW | Add packed byte integers from zmm2, and 
VPADDB zmm1 {k1}{z}, zmm2, zmm3/m512 and store in zmm7 using writemask k1. 
zmm3/m512 
EVEX.512.66.0F.WIG FD /r C VV AVX512BW | Add packed word integers from zmm2, and 
VPADDW zmm1 {k1}z}, zmm2, zmm3/m512 and store in zmm7 using writemask k1. 
zmm3/m512 
EVEX.512.66.0F.W0 FE /r D VIV AVX512F Add packed doubleword integers from zmm2, 
VPADDD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and store in zmm7 using 
zmm3/m512/m32bcst writemask k1. 
EVEX.512.66.0F.W1 D4 /r D VIV AVX512F Add packed quadword integers from zmm2, 
VPADDQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and store in zmm7 using 
zmm3/m512/m64bcst writemask k1. 
NOTES: 
1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX 
Registers” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD add of the packed integers from the source operand (second operand) and the destination 
operand (first operand), and stores the packed integer results in the destination operand. See Figure 9-4 in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a SIMD operation. 
Overflow is handled with wraparound, as described in the following paragraphs. 


The PADDB and VPADDB instructions add packed byte integers from the first source operand and second source 
operand and store the packed integer results in the destination operand. When an individual result is too large to 
be represented in 8 bits (overflow), the result is wrapped around and the low 8 bits are written to the destination 
operand (that is, the carry is ignored). 


The PADDW and VPADDW instructions add packed word integers from the first source operand and second source 
operand and store the packed integer results in the destination operand. When an individual result is too large to 
be represented in 16 bits (overflow), the result is wrapped around and the low 16 bits are written to the destination 
operand (that is, the carry is ignored). 


The PADDD and VPADDD instructions add packed doubleword integers from the first source operand and second 
source operand and store the packed integer results in the destination operand. When an individual result is too 
large to be represented in 32 bits (overflow), the result is wrapped around and the low 32 bits are written to the 
destination operand (that is, the carry is ignored). 


The PADDQ and VPADDQ instructions add packed quadword integers from the first source operand and second 
source operand and store the packed integer results in the destination operand. When a quadword result is too 
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large to be represented in 64 bits (overflow), the result is wrapped around and the low 64 bits are written to the 
destination operand (that is, the carry is ignored). 

Note that the (V)PADDB, (V)PADDW, (V)PADDD and (V)PADDQ instructions can operate on either unsigned or 
signed (two's complement notation) packed integers; however, it does not set bits in the EFLAGS register to indi- 
cate overflow and/or a carry. To prevent undetected overflow conditions, software must control the ranges of 
values operated on. 

EVEX encoded VPADDD/Q: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is a ZMM/YMM/XMM register updated according to the 
writemask. 

EVEX encoded VPADDB/W: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM 
register updated according to the writemask. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. the upper bits (MAXVL-1:256) of the 
destination are cleared. 

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding ZMM register destination are unmodified. 


Operation 


PADDB (with 64-bit operands) 
DEST[7:0] := DEST[7:0] + SRC[7:0]; 
(* Repeat add operation for 2nd through 7th byte *) 
DEST[63:56] := DEST[63:56] + SRC[63:56]; 


PADDW (with 64-bit operands) 
DEST[15:0] := DEST[15:0] + SRC[15:0); 
(* Repeat add operation for 2nd and 3th word *) 
DEST[63:48] := DEST[63:48] + SRC[63:48]; 


PADDD (with 64-bit operands) 
DEST[31:0] := DEST[31:0] + SRC[3 1:0); 
DEST[63:32] := DEST[63:32] + SRC[63:32]; 


PADDQ (with 64-Bit operands) 
DEST[63:0] := DEST[63:0] + SRC[63:0); 


PADDB (Legacy SSE instruction) 
DEST[7:0] := DEST[7:0] + SRC[7:0]; 
(* Repeat add operation for 2nd through 15th byte *) 
DEST[127:120] := DEST[127:120] + SRC[127:1 20]; 
DEST[MAXVL-1:128] (Unmodified) 


PADDW (Legacy SSE instruction) 
DEST[15:0] := DEST[15:0] + SRC[1 5:0); 
(* Repeat add operation for 2nd through 7th word *) 
DEST[127:112] := DEST[127:112] + SRC[127:112]; 
DEST[MAXVL-1:128] (Unmodified) 
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PADDD (Legacy SSE instruction) 
DEST[31:0] := DEST[31:0] + SRC[31:0]; 
(* Repeat add operation for 2nd and 3th doubleword *) 
DEST[127:96] := DEST[127:96] + SRC[127:96]; 
DEST[MAXVL-1:128] (Unmodified) 


PADDQ (Legacy SSE instruction) 
DEST[63:0] := DEST[63:0] + SRC[63:0); 
DEST[127:64] := DEST[127:64] + SRC[127:64]; 
DEST[MAXVL-1:128] (Unmodified) 


VPADDB (VEX.128 encoded instruction) 
DEST[7:0] := SRC1[7:0] + SRC2[7:0]; 
(* Repeat add operation for 2nd through 15th byte *) 
DEST[127:1 20] := SRC1[127:120] + SRC2[127:120); 
DEST[MAXVL-1:128] := 0; 


VPADDW (VEX.128 encoded instruction) 
DEST[15:0] := SRC1[15:0] + SRC2[15:0]; 
(* Repeat add operation for 2nd through 7th word *) 
DEST[127:112] := SRC1[127:112] + SRC2[127:112]; 
DEST[MAXVL-1:128] := 0; 


VPADDD (VEX.128 encoded instruction) 
DEST[31:0] := SRC1[31:0] + SRC2[31:0]; 
(* Repeat add operation for 2nd and 3th doubleword *) 
DEST[127:96] := SRC1[127:96] + SRC2[1 27:96]; 
DEST[MAXVL-1:128] := 0; 


VPADDQ (VEX.128 encoded instruction) 
DEST[63:0] := SRC1[63:0] + SRC2[63:0]; 
DEST[127:64] := SRC1[127:64] + SRC2[127:64]; 
DEST[MAXVL-1:128] := 0; 


VPADDB (VEX.256 encoded instruction) 
DEST[7:0] := SRC1[7:0] + SRC2[7:0]; 
(* Repeat add operation for 2nd through 31th byte *) 
DEST[255:248] := SRC1[255:248] + SRC2[255:248]; 


VPADDW (VEX.256 encoded instruction) 
DEST[15:0] := SRC1[15:0] + SRC2[15:0]; 
(* Repeat add operation for 2nd through 15th word *) 
DEST[255:240] := SRC1[255:240] + SRC2[255:240]; 


VPADDD (VEX.256 encoded instruction) 
DEST[31:0] := SRC1[31:0] + SRC2[31:0]; 
(* Repeat add operation for 2nd and 7th doubleword *) 
DEST[255:224] = SRC1[255:224] + SRC2[255:224]; 


VPADDQ (VEX.256 encoded instruction) 
DEST[63:0] := SRC1[63:0] + SRC2[63:0]; 
DEST[127:64] := SRC1[127:64] + SRC2[127:64]; 
DEST[191:128] := SRC1[191:128] + SRC2[191:128]; 
DEST[255:192] := SRC1[255:192] + SRC2[255:192]; 
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VPADDB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j :=0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = SRC1[i+7:i] + SRC2[i+7:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


VPADDW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SRC1[i+15:i] + SRC2[i+15:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


VPADDD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] := SRC1[i+31:i] + SRC2[31:0] 
ELSE DEST[i+31:i] := SRC1[i+31:i] + SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 
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VPADDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:= 0 TO KL-1 


i:=j*64 


IF k1[j] OR *no writemask* 


THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


ELSE 
IF *merging-masking* ;merging-masking 


Fl; 
ENDFOR; 


THEN DEST[i+63:i] := SRC1[i+63:i] + SRC2[63:0] 
ELSE DEST[i+63:i] = SRC1[i+63:i] + SRCZ[i+63:i] 


THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPADDB__m512i 


mm512_add_epi8 (__m512ia,__m512ib) 


VPADDW__m512i_mm512_add_epi16 (__m512i a,_m512i b) 


VPADDB__m512i 


mm512_mask_add_epi8 (__m512is,__mmask64 m,__m512ia,__m512i b) 


VPADDW__m512i_mm512_mask_add_epi16 (__m512is,__ mmask32 m,__m512ia,__m512i b) 


VPADDB__m512i 


mm512_maskz_add_epi8 (__mmask64 m,__m512i a,__m512i b) 


VPADDW__m512i 


mm512_maskz_add_epi16 (__mmask32 m,_m512i a,__m512i b) 


VPADDB__m256i 


VPADDW__m256i 


mm256_mask_add_epi8 (__m256is,__ mmask32 m,_m256i a, __ m256i b) 
mm256_mask_add_epi16 (__m256is,__ mmask16 m,__m256i a, __ m256i b) 


VPADDB__m256i 


mm256_maskz_add_epi8 (__mmask32 m, __m256i a, ___m256i b) 


VPADDW__m256i 


mm256_maskz_add_epi16 (__mmask16 m, ___m256i a,___m256i b) 


VPADDB__m128i 


mm_mask_add_epi8 (__m128is,__ mmask16 m,__m128i a,__m128i b) 


VPADDW__m128i 


mm_mask_add_epi16 (__m128is,__ mmask8 m,__m128i a,__m128i b) 


VPADDB__m128i 


mm_maskz_add_epi8 (__mmask16 m, __m128i a, __m128i b) 


VPADDW__m128i 


mm_maskz_add_epi16 (__mmask8 m, __m128i a,__m128i b) 


VPADDD __m512i__mm512_add_epi32(__m512i a, ___m512ib); 


VPADDD __m512i_mm512_mask_add_epi32(__m512is, 


mmask16 k,__m512i a,__m512i b); 


VPADDD __m512i_mm512_maskz_add_epi32(__mmask16 k, 


m512ia,__m512ib); 


VPADDD __m256i _mm256_mask_add_epi32(__m256i s, 


mmask8 k,___m256i a, ___ m256i b); 


VPADDD __m256i __mm256_maskz_add_epi32(__mmask8 k, 


m256i a, ___m256i b); 


VPADDD __m128i _mm_mask_add_epi32(__m128i s, 


mmask8 k,___m128i a, __m128i b); 


VPADDD __m128i __mm_maskz_add_epi32(__mmask8 k, 


m128i a,__m128i b); 


VPADDQ __m512i__mm512_add_epi64(_m512i a, __m512i b); 


VPADDQ __m512i_mm512_mask_add_epi64(__m512i s, _ mmask8 k, 


m512i a,__m512ib); 


VPADDQ __m512i__mm512_maskz_add_epi64(_mmask8 k,__m512ia, 


m512i b); 


VPADDQ __m256i _mm256_mask_add_epi64(__m256i s, __ mmask8 k, 


m256i a,__m256i b); 


VPADDQ __m256i _mm256_maskz_add_epi64(__mmask8 k, __m256i a, 


m256i b); 


VPADDQ __m128i __mm_mask_add_epi64(__m128i s,__mmask8 k, 


m128i a,__m128i b); 


VPADDQ __m128i _mm_maskz_add_epi64(__mmask8 k, 
PADDB __m128i__mm_add_epi8 (__m128i a, 


m128i a,__m128i b); 
m128i b ); 


PADDW __m128i__mm_add_epi16 (__m128i a,__m128i b); 


PADDD __m128i_mm_add_epi32 (__m128i a, _m128ib); 


PADDQ __m128i __mm_add_epi64 (__m128i a, ___m128i b); 
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VPADDB __m256i__mm256_add_epi8 (__m256ia,__m256i b ); 
VPADDW __m256i __mm256_add_epi16 (__m256i a, __m256i b); 
VPADDD __m256i __mm256_add_epi32 (__m256i a, __m256i b); 
VPADDQ __m256i __mm256_add_epi64 (__m256i a, __m256i b); 
PADDB __m64 _mm_add_pi8(__m64 m1,__m64 m2) 

PADDW __m64_mm_add_pi16(__m64 m1,__ m64 m2) 

PADDD __m64_mm_add_pi32(__m64 m1,__m64 m2) 

PADDQ __m64 _mm_add_si64(__m64 m1, __m64 m2) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPADDD/Q, see Table 2-49, “Type E4 Class Exception Conditions”. 
EVEX-encoded VPADDB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PADDSB/PADDSW—Add Packed Signed Integers with Signed Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF EC /r! A VIV MMX Add packed signed byte integers from 
PADDSB mm, mm/m64 mm/m64 and mm and saturate the results. 
66 OF EC /r A VIV SSE2 Add packed signed byte integers from 
PADDSB xmm1, xmm2/m128 xmm2/m128 and xmm1 saturate the results. 
NP OF ED /r' A VIV MMX Add packed signed word integers from 
PADDSW mm, mm/m64 mm/m64 and mm and saturate the results. 
66 OF ED /r A VIV SSE2 Add packed signed word integers from 
PADDSW xmm1, xmm2/m128 xmm2/m128 and xmm17 and saturate the 
results. 
VEX.128.66.0F.WIG EC /r B VIV AVX Add packed signed byte integers from 
VPADDSB xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2 saturate the results. 
VEX.128.66.0F.WIG ED /r B VIV AVX Add packed signed word integers from 
VPADDSW xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2 and saturate the 
results. 
VEX.256.66.0F.wic EC /r B VIV AVX2 Add packed signed byte integers from ymm2, 
VPADDSB ymm1, ymm2, ymm3/m256 and ymm3/m256 and store the saturated 
results in ymm1. 
VEX.256.66.0F.wic ED /r B VIV AVX2 Add packed signed word integers from ymm2, 
VPADDSW ymm1, ymm2, ymm3/m256 and ymm3/m256 and store the saturated 
results in ymm1. 
EVEX.128.66.0F.WIG EC /r C VIV AVX512VL | Add packed signed byte integers from xmm_2, 
VPADDSB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | and xmm3/m128 and store the saturated 
results in xmm1 under writemask k1. 
EVEX.256.66.0F.WIG EC /r C VIV AVX512VL | Add packed signed byte integers from ymm2, 
VPADDSB ymm1 {k1}{z}, ymm2, ynm3/m256 AVX512BW | and ymm3/m256 and store the saturated 
results in ymm1 under writemask k1. 
EVEX.512.66.0F.WIG EC /r C VIV AVX512BW | Add packed signed byte integers from zmm2, 
VPADDSB zmm1 {k1}{z}, zmm2, zmm3/m512 and zmm3/m512 and store the saturated 
results in zmm1 under writemask k1. 
EVEX.128.66.0F.WIG ED /r G VIV AVX512VL | Add packed signed word integers from xmm2, 
VPADDSW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | and xmm3/m128 and store the saturated 
results in xmm1 under writemask k1. 
EVEX.256.66.0F.WIG ED /r C VIN AVX512VL_ | Add packed signed word integers from ymm2, 
VPADDSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | and ymm3/m256 and store the saturated 
results in ymm1 under writemask k1. 
EVEX.512.66.0F.WIG ED /r C VIV AVX512BW_ | Add packed signed word integers from zmm2, 
VPADDSW zmm1 {k1}{z}, zmm2, zmm3/m512 and zmm3/m512 and store the saturated 
results in zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD add of the packed signed integers from the source operand (second operand) and the destination 
operand (first operand), and stores the packed integer results in the destination operand. See Figure 9-4 in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a SIMD operation. 
Overflow is handled with signed saturation, as described in the following paragraphs. 


(V)PADDSB performs a SIMD add of the packed signed integers with saturation from the first source operand and 
second source operand and stores the packed integer results in the destination operand. When an individual byte 
result is beyond the range of a signed byte integer (that is, greater than 7FH or less than 80H), the saturated value 
of 7FH or 80H, respectively, is written to the destination operand. 

(V)PADDSW performs a SIMD add of the packed signed word integers with saturation from the first source operand 
and second source operand and stores the packed integer results in the destination operand. When an individual 
word result is beyond the range of a signed word integer (that is, greater than 7FFFH or less than 8000H), the satu- 
rated value of 7FFFH or 8000H, respectively, is written to the destination operand. 

EVEX encoded versions: The first source operand is an ZMM/YMM/XMM register. The second source operand is an 
ZMM/YMM/XMM register or a memory location. The destination operand is an ZMM/YMM/XMM register. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding register destination are zeroed. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding register destination are unmodified. 


Operation 


PADDSB (with 64-bit operands) 
DEST[7:0] := SaturateToSignedByte(DEST[7:0] + SRC (7:0)); 
(* Repeat add operation for 2nd through 7th bytes *) 
DEST[63:56] := SaturateToSignedByte(DEST[63:56] + SRC[63:56] ); 


PADDSB (with 128-bit operands) 
DEST[7:0] := SaturateToSignedByte (DEST[7:0] + SRC[7:0}); 
(* Repeat add operation for 2nd through 14th bytes *) 
DEST[127:120] := SaturateToSignedByte (DEST[1 11:120] + SRC[127:120)); 


VPADDSB (VEX.128 encoded version) 
DEST[7:0] := SaturateToSignedByte (SRC1[7:0] + SRC2[7:0)); 
(* Repeat subtract operation for 2nd through 14th bytes *) 
DEST[127:120] := SaturateToSignedByte (SRC1[111:120] + SRC2[127:120)); 
DEST[MAXVL-1:128] := 0 


VPADDSB (VEX.256 encoded version) 
DEST[7:0] := SaturateToSignedByte (SRC1[7:0] + SRC2[7:0)); 
(* Repeat add operation for 2nd through 31st bytes *) 
DEST[255:248] := SaturateToSignedByte (SRC1[255:248] + SRC2[255:248)); 
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VPADDSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateToSignedByte (SRC1[i+7:i] + SRC2[i+7:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PADDSW (with 64-bit operands) 
DEST[15:0] := SaturateToSignedword(DEST[1 5:0] + SRC[15:0] ); 
(* Repeat add operation for 2nd and 7th words *) 
DEST[63:48] := SaturateToSignedword(DEST[63:48] + SRC[63:48] ); 


PADDSW (with 128-bit operands) 
DEST[15:0] := SaturateToSignedword (DEST[15:0] + SRC[15:0)); 
(* Repeat add operation for 2nd through 7th words *) 
DEST[127:1 12] := SaturateToSignedWord (DEST[127:112] + SRC[127:112]); 


VPADDSW (VEX.128 encoded version) 
DEST[15:0] := SaturateToSignedword (SRC1[15:0] + SRC2[15:0)); 
(* Repeat subtract operation for 2nd through 7th words *) 
DEST[127:1 12] := SaturateToSignedWord (SRC1[127:112] + SRC2[127:112]); 
DEST[MAXVL-1:1 28] := 0 


VPADDSW (VEX.256 encoded version) 
DEST[15:0] := SaturateToSignedword (SRC1[15:0] + SRC2[15:0)); 
(* Repeat add operation for 2nd through 15th words *) 
DEST[255:240] := SaturateToSignedWord (SRC1[255:240] + SRC2[255:240}) 


VPADDSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] := SaturateToSignedWord (SRC1[i+15:i] + SRC2[i+15:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 


PADDSB: m64 _mm_adds_pi8(__m64 m1,_m64 m2) 
(V)PADDSB: m128i__mm_adds_epi8 (__m128ia,__m128i b) 
VPADDSB: m256i__mm256_adds_epi8 (__m256i a, __m256i b) 
PADDSW: m64_mm_adds_pi16(__m64 m1,__m64 m2) 
(V)PADDSW: m128i__mm_adds_epi16 (__m128i a,__m128i b) 
VPADDSW: m256i __mm256_adds_epi16 (__m256i a, __m256i b) 


VPADDSB__m512i_mm512_adds_epi8 (__m512i a, ___m512i b) 
VPADDSW__m512i__mm512_adds_epi16 (__m512ia,_m512ib) 
VPADDSB__m512i_mm512_mask_adds_epi8 (__m512is,__ mmask64 m,__m512i a,__m512i b) 
VPADDSW__m512i__mm512_mask_adds_epi16 (__m512is,__ mmask32 m,__m512ia,__m512ib) 
VPADDSB__m512i__mm512_maskz_adds_epi8 (__mmask64 m,__m512ia,__m512i b) 
VPADDSW__m512i__mm512_maskz_adds_epi16 (__mmask32 m,__m512ia,__m512ib) 
VPADDSB__m256i __mm256_mask_adds_epi8 (__m256is,__ mmask32 m,_m256i a,__ m256i b) 
VPADDSW__m256i _mm256_mask_adds_epi16 (__m256i s,___ mmask16 m, ___m256i a,__ m256i b) 
VPADDSB__m256i _mm256_maskz_adds_epi8 (__mmask32 m,__m256i a, __m256i b) 
VPADDSW__m256i _mm256_maskz_adds_epi16 (__mmask16 m,__m256i a,___ m256i b) 
VPADDSB__m128i__mm_mask_adds_epi8 (__m128is,___ mmask16 m, ___m128i a,__m128i b) 
VPADDSW__m128i __mm_mask_adds_epi16 (__m128is,___ mmask8 m, __m128i a,__m128i b) 


VPADDSB__m128i __mm_maskz_adds_epi8 (__mmask16 m,__m128i a, __m128ib) 
VPADDSW__m128i __mm_maskz_adds_epi16 (__mmask8 m, __m128i a,_m128ib) 
Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 


4-220 Vol. 2B PADDSB/PADDSW—Add Packed Signed Integers with Signed Saturation 


INSTRUCTION SET REFERENCE, M-U 


PADDUSB/PADDUSW—Add Packed Unsigned Integers with Unsigned Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature Flag 
Support 

NP OF DC /r A VIV MMX Add packed unsigned byte integers from 

PADDUSB mm, mm/m64 mm/m64 and mm and saturate the results. 

66 OF DC /r A VIV SSE2 Add packed unsigned byte integers from 

PADDUSB xmm1, xmm2/m128 xmm2/m128 and xmm1 saturate the results. 

NP OF DD /r' A VIV MMX Add packed unsigned word integers from 

PADDUSW mm, mm/m64 mm/m64 and mm and saturate the results. 

66 OF DD /r A VIV SSE2 Add packed unsigned word integers from 

PADDUSW xmm1, xmm2/m128 xmm2/m128 to xmm7 and saturate the 
results. 

VEX.128.660F.WIG DC /r B VIV AVX Add packed unsigned byte integers from 

VPADDUSB xmm1, xmm2, xmm3/m128 xmm3/m128 to xmm2 and saturate the 
results. 

VEX.128.66.0F.WIG DD /r B VN AVX Add packed unsigned word integers from 

VPADDUSW xmm1, xmm2, xmm3/m128 xmm3/m128 to xmm2 and saturate the 
results. 

VEX.256.66.0F.wic DC /r B VIV AVX2 Add packed unsigned byte integers from 

VPADDUSB ymm1, ymm2, ymm3/m256 ymmd2, and ymm3/m256 and store the 
saturated results in ymm/7. 

VEX.256.66.0F.wic DD /r B VIV AVX2 Add packed unsigned word integers from 

VPADDUSW ymm1, ymm2, ymm3/m256 ymmd2, and ymm3/m256 and store the 
saturated results in ymm1. 

EVEX.128.66.0F.WIG DC /r C VIV AVX512VL | Add packed unsigned byte integers from 

VPADDUSB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2, and xmm3/m128 and store the 
saturated results in xmm1 under writemask 
k1. 

EVEX.256.66.0F.WIG DC /r C VV AVX512VL | Add packed unsigned byte integers from 

VPADDUSB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2, and ymm3/m256 and store the 
saturated results in ymm1 under writemask 
k1. 

EVEX.512.66.0F.WIG DC /r C VIV AVX512BW | Add packed unsigned byte integers from 

VPADDUSB zmm1 {k1}{z}, zmm2, zmm3/m512 zmm2, and zmm3/m512 and store the 
saturated results in zmm1 under writemask 
k1. 

EVEX.128.66.0F.WIG DD /r C VIV AVX512VL | Add packed unsigned word integers from 

VPADDUSW xmm17 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2, and xmm3/m128 and store the 
saturated results in xmm1 under writemask 
k1. 

EVEX.256.66.0F.WIG DD /r C VIV AVX512VL ‘| Add packed unsigned word integers from 

VPADDUSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2, and ymm3/m256 and store the 


saturated results in ymm1 under writemask 
k1. 
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EVEX.512.66.0F.WIG DD /r Cc VIV AVX512BW | Add packed unsigned word integers from 

VPADDUSW zmm17 {k1}{z}, zmm2, zmm3/m512 zmm2, and zmm3/m512 and store the 
saturated results in zmm1 under writemask 
k1. 

NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD add of the packed unsigned integers from the source operand (second operand) and the destina- 
tion operand (first operand), and stores the packed integer results in the destination operand. See Figure 9-4 in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a SIMD operation. 
Overflow is handled with unsigned saturation, as described in the following paragraphs. 


(V)PADDUSB performs a SIMD add of the packed unsigned integers with saturation from the first source operand 
and second source operand and stores the packed integer results in the destination operand. When an individual 
byte result is beyond the range of an unsigned byte integer (that is, greater than FFH), the saturated value of FFH 
is written to the destination operand. 

(V)PADDUSW performs a SIMD add of the packed unsigned word integers with saturation from the first source 
operand and second source operand and stores the packed integer results in the destination operand. When an 
individual word result is beyond the range of an unsigned word integer (that is, greater than FFFFH), the saturated 
value of FFFFH is written to the destination operand. 


EVEX encoded versions: The first source operand is an ZMM/YMM/XMM register. The second source operand is an 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination is an ZMM/YMM/XMM register. 
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding destination register destination are zeroed. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding register destination are unmodified. 


Operation 


PADDUSB (with 64-bit operands) 
DEST[7:0] := SaturateToUnsignedByte(DEST[7:0] + SRC (7:0] ); 
(* Repeat add operation for 2nd through 7th bytes *) 
DEST[63:56] := SaturateToUnsignedByte(DEST[63:56] + SRC[63:56] 


PADDUSB (with 128-bit operands) 
DEST[7:0] := SaturateToUnsignedByte (DEST[7:0] + SRC[7:0]); 
(* Repeat add operation for 2nd through 14th bytes *) 
DEST[127:120] := SaturateToUnSignedByte (DEST[127:120] + SRC[127:120)); 
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VPADDUSB (VEX.128 encoded version) 
DEST[7:0] := SaturateToUnsignedByte (SRC1[7:0] + SRC2[7:0)); 
(* Repeat subtract operation for 2nd through 14th bytes *) 
DEST[127:120] := SaturateToUnsignedByte (SRC1[111:120] + SRC2[127:120)); 
DEST[MAXVL-1:1 28] := 0 


VPADDUSB (VEX.256 encoded version) 
DEST[7:0] := SaturateToUnsignedByte (SRC1[7:0] + SRC2[7:0)); 
(* Repeat add operation for 2nd through 31st bytes *) 
DEST[255:248] := SaturateToUnsignedByte (SRC1[255:248] + SRC2[255:248)); 


PADDUSW (with 64-bit operands) 
DEST[15:0] := SaturateToUnsignedWord(DEST[15:0] + SRC[15:0] ); 
(* Repeat add operation for 2nd and 3rd words *) 
DEST[63:48] := SaturateToUnsignedword(DEST[63:48] + SRC[63:48] ); 


PADDUSW (with 128-bit operands) 
DEST[15:0] := SaturateToUnsignedWord (DEST[15:0] + SRC[15:0)); 
(* Repeat add operation for 2nd through 7th words *) 
DEST[127:1 12] := SaturateToUnSignedWord (DEST[127:112] + SRC[127:112]); 


VPADDUSW (VEX.128 encoded version) 
DEST[15:0] := SaturateToUnsignedWord (SRC1[15:0] + SRC2[15:0)); 
(* Repeat subtract operation for 2nd through 7th words *) 
DEST[127:112] := SaturateToUnsignedword (SRC1[127:112] + SRC2[127:112)); 
DEST[MAXVL-1:1 28] := 0 


VPADDUSW (VEX.256 encoded version) 
DEST[15:0] := SaturateToUnsignedWord (SRC1[15:0] + SRC2[15:0)); 
(* Repeat add operation for 2nd through 15th words *) 
DEST[255:240] := SaturateToUnsignedWord (SRC1[255:240] + SRC2[255:240]) 


VPADDUSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST{i+7:i] = SaturateToUnsignedByte (SRC1[i+7:i] + SRC2[i+7:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VPADDUSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] = SaturateToUnsignedWord (SRC1[i+15:i] + SRC2[i+15:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


PADDUSB: m64__mm_adds_pu8(__m64 m1,__m64 m2) 
PADDUSW: m64 __mm_adds_pu16(__m64 m1,__ m64 m2) 
(V)PADDUSB: m128i__mm_adds_epu8 (__m128i a,__m128i b) 
(V)PADDUSW: m128i_mm_adds_epu16 (__m128ia,__m128i b) 
VPADDUSB: m256i__mm256_adds_epu8 (__m256i a,__ m256i b) 
VPADDUSW: m256i__mm256_adds_epu16 (__m256i a,__ m256i b) 
VPADDUSB__m512i_mm512_adds_epu8 (__m512ia,__m512i b) 


VPADDUSW__m512i_mm512_adds_epu16 (__m512ia,__m512i b) 
VPADDUSB__m512i_mm512_mask_adds_epu8 (__m512is,__mmask64 m,__m512ia,__m512ib) 
VPADDUSW__m512i_mm512_mask_adds_epu16 (__m512is,__ mmask32 m,_m512i a,__m512i b) 
VPADDUSB__m512i_mm512_maskz_adds_epu8 (__mmask64 m,__m512i a,__m512i b) 
VPADDUSW__m512i_mm512_maskz_adds_epu16 (__mmask32 m,__m512ia,__m512i b) 
VPADDUSB__m256i__mm256_mask_adds_epu8 (__m256i s,__ mmask32 m,__m256i a, ___ m256i b) 
VPADDUSW__m256i __mm256_mask_adds_epu16 (__m256i s,__mmask16 m,__m256i a, ___m256i b) 
VPADDUSB__m256i__mm256_maskz_adds_epu8 (__mmask32 m, __m256i a,__ m256i b) 
VPADDUSW__m256i __mm256_maskz_adds_epu16 (__mmask16 m,_m256i a, ___ m256i b) 
VPADDUSB__m128i__mm_mask_adds_epu8 (__m128is,__ mmask16 m,__m128i a, ___m128i b) 
VPADDUSW__m128i __mm_mask_adds_epu16 (__m128is,___ mmask8 m, ___m128i a,__m128i b) 


VPADDUSB__m128i__mm_maskz_adds_epu8 (__mmask16 m, ___m128i a,__m128i b) 
VPADDUSW__m128i __mm_maskz_adds_epu16 (__mmask8 m,_m128i a,__m128i b) 
Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PALIGNR — Packed Align Right 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
NP OF 3A OF /r ib! A VV SSSE3 Concatenate destination and source operands, 


extract byte-aligned result shifted to the right by 


PALIGNR mm1, mm2/m64, imm8 
constant value in imm8 into mm1. 


66 OF 3A OF /r ib A VIV SSSE3 
PALIGNR xmm1, xmm2/m128, imm8& 


Concatenate destination and source operands, 
extract byte-aligned result shifted to the right by 
constant value in imm8 into xmm1. 


VEX.128.66.0F3A.WIG OF /r ib B VIV AVX 
VPALIGNR xmm1, xmm2, xmm3/m128, imm& 


Concatenate xmm2 and xmm3/m128, extract 
byte aligned result shifted to the right by 
constant value in imm8 and result is stored in 
xmm1. 


VEX.256.66.0F3A.WIG OF /r ib B VIN AVX2 
VPALIGNR ymm1, ymm2, ymm3/m256, imm8 


Concatenate pairs of 16 bytes in ymm2 and 
ymm3/m256 into 32-byte intermediate result, 
extract byte-aligned, 16-byte result shifted to 
the right by constant values in imm8 from each 
intermediate result, and two 16-byte results are 
stored in ymm1. 


EVEX.128.66.0F3A.WIG OF /r ib C VN AVX512VL | Concatenate xmm2 and xmm3/m128 into a 32- 
VPALIGNR xmm1 {k1}{z}, xmm2, xmm3/m1 28, AVX512BW | byte intermediate result, extract byte aligned 
imm8 result shifted to the right by constant value in 
imm8 and result is stored in xmm1. 


EVEX.256.66.0F3A.WIG OF /r ib C VV AVX512VL | Concatenate pairs of 16 bytes in ymm2 and 
VPALIGNR ymm1 {k1}{z}, ymm2, ymm3/m256, AVX512BW | ymm3/m256 into 32-byte intermediate result, 
imm8 extract byte-aligned, 16-byte result shifted to 
the right by constant values in imm8 from each 
intermediate result, and two 16-byte results are 
stored in ymm1. 


EVEX.512.66.0F3A.WIG OF /r ib C VV AVX512BW | Concatenate pairs of 16 bytes in zmm2 and 
VPALIGNR zmm1 {k1}{z}, zmm2, zmm3/m512, zmm3/m512 into 32-byte intermediate result, 
imm8 extract byte-aligned, 16-byte result shifted to 
the right by constant values in imm8 from each 
intermediate result, and four 16-byte results are 
stored in zmm1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


(V)PALIGNR concatenates the destination operand (the first operand) and the source operand (the second 


operand) into an intermediate composite, shifts the composite at byte granularity to the right by a constant imme- 
diate, and extracts the right-aligned result into the destination. The first and the second operands can be an MMX, 
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XMM or a YMM register. The immediate value is considered unsigned. Immediate shift counts larger than the 2L 
(i.e. 32 for 128-bit operands, or 16 for 64-bit operands) produce a zero result. Both operands can be MMxX regis- 
ters, XMM registers or YMM registers. When the source operand is a 128-bit memory operand, the operand must 
be aligned on a 16-byte boundary or a general-protection exception (#GP) will be generated. 


In 64-bit mode and not encoded by VEX/EVEX prefix, use the REX prefix to access additional registers. 
128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain unchanged. 


EVEX.512 encoded version: The first source operand is a ZMM register and contains four 16-byte blocks. The 
second source operand is a ZMM register or a 512-bit memory location containing four 16-byte block. The destina- 
tion operand is a ZMM register and contain four 16-byte results. The imm8[7:0] is the common shift count 


used for each of the four successive 16-byte block sources. The low 16-byte block of the two source operands 
produce the low 16-byte result of the destination operand, the high 16-byte block of the two source operands 
produce the high 16-byte result of the destination operand and so on for the blocks in the middle. 


VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register and contains two 16-byte 
blocks. The second source operand is a YMM register or a 256-bit memory location containing two 16-byte block. 
The destination operand is a YMM register and contain two 16-byte results. The imm8[7:0] is the common shift 
count used for the two lower 16-byte block sources and the two upper 16-byte block sources. The low 16-byte 
block of the two source operands produce the low 16-byte result of the destination operand, the high 16-byte block 
of the two source operands produce the high 16-byte result of the destination operand. The upper bits (MAXVL- 
1:256) of the corresponding ZMM register destination are zeroed. 


VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand 
is an XMM register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL- 
1:128) of the corresponding ZMM register destination are zeroed. 


Concatenation is done with 128-bit data in the first and second source operand for both 128-bit and 256-bit 
instructions. The high 128-bits of the intermediate composite 256-bit result came from the 128-bit data from the 
first source operand; the low 128-bits of the intermediate result came from the 128-bit data of the second source 
operand. 


127 0 127 0 
SRC1 SRC2 
Imm8[7:0]*8 
255 128 255 
SRC1 | sRc2 
|<] fj | 
Imm8[7:0]*8 
255 128 1 0 
DEST | | | | Vv pest 


Figure 4-7. 256-bit VPALIGN Instruction Operation 


Operation 


PALIGNR (with 64-bit operands) 
temp1[127:0] = CONCATENATE(DEST,SRC)>>(imm8*8) 
DEST[63:0] = temp1[63:0] 
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PALIGNR (with 128-bit operands) 

temp1[255:0] := ((DEST[1 27:0] << 128) OR SRC[127:0])>>(imm8*8); 
DEST[127:0] := temp1[127:0] 

DEST[MAXVL-1:128] (Unmodified) 


VPALIGNR (VEX.128 encoded version) 

temp1[255:0] := ((SRC1[127:0] << 128) OR SRC2[127:0])>>(imm8*8); 
DEST[127:0] := temp1[127:0] 

DEST[MAXVL-1:128] := 0 


VPALIGNR (VEX.256 encoded version) 

temp1[255:0] := ((SRC1[127:0] << 128) OR SRC2[127:0])>>(imm8[7:0]*8); 
DEST[127:0] := temp1[127:0] 

temp1[255:0] := ((SRC1[255:1 28] << 128) OR SRC2[255:128])>>(imm8[7:0]*8); 
DEST[MAXVL-1:128] := temp1[127:0] 


VPALIGNR (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR | := 0 TO VL-1 with increments of 128 
temp1[255:0] := ((SRC1[I+127:I] << 128) OR SRC2[I+1 27:1])>>(imm8[7:0]*8); 
TMP_DEST[I+127:l] := temp1[127:0] 

ENDFOR; 


FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TMP_DEST[i+7:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


PALIGNR: m64 _mm_alignr_pi8 (__m64 a,__m64 b, int n) 
(V)PALIGNR: m128i _mm_alignr_epi8 (__m128i a,__m128i, int n) 
VPALIGNR: m256i __mm256_alignr_epi8 (__m256i a,__ m256i b, const int n) 


VPALIGNR __m512i_mm512_alignr_epi8 (__m512i a,__m512ib, const int n) 

VPALIGNR __m512i_mm512_mask_alignr_epi8 (__m512is,__ mmask64 m,_m512i a,__m512ib, const int n) 
VPALIGNR __m512i_mm512_maskz_alignr_epi8 (__mmask64 m,__m512i a,__m512ib, const int n) 
VPALIGNR __m256i_mm256_mask_alignr_epi8 (__m256is,__ mmask32 m,___m256i a,__m256i b, const int n) 
VPALIGNR __m256i__mm256_maskz_alignr_epi8 (__mmask32 m,___m256i a, ___m256i b, const int n) 
VPALIGNR __m128i__mm_mask_alignr_epi8 (__m128is,__ mmask16 m,__m128i a, ___m128i b, const int n) 
VPALIGNR __m128i__mm_maskz_alignr_epi8 (__mmask16 m,___m128i a,__m128i b, const int n) 


SIMD Floating-Point Exceptions 
None. 
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Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature Flag 

Support 
NP OF DB /r' A VN MMX Bitwise AND mm/m64 and mm. 
PAND mm, mm/m64 
66 OF DB /r A VN SSE2 Bitwise AND of xmm2/m128 and xmm1. 
PAND xmm1, xmm2/m128 
VEX.128.66.0F.WIG DB /r B VV AVX Bitwise AND of xmm3/m128 and xmm. 
VPAND xmm1, xmm2, xmm3/m128 
VEX.256.66.0F.wic DB /r B VV AVX2 Bitwise AND of ymm2, and ymm3/m256 and 
VPAND ymm1, ymm2, ymm3/.m256 store result in ymm1. 
EVEX.128.66.0F.WO DB /r C VV AVX512VL | Bitwise AND of packed doubleword integers in 
VPANDD xmm1 {k1}{z}, xmm2, AVX512F xmme2 and xmm3/m128/m32bcst and store 
xmm3/m128/m32bcst result in xmm1 using writemask k1. 
EVEX.256.66.0F.WO DB /r C VV AVX512VL | Bitwise AND of packed doubleword integers in 
VPANDD ymm1 {k1}{z}, ymm2, AVX512F ymme and ymm3/m256/m32bcst and store 
ymm3/m256/m32bcst result in ymm1 using writemask k1. 
EVEX.512.66.0F.WO DB /r C VV AVX512F Bitwise AND of packed doubleword integers in 
VPANDD zmm1 {k1}{z}, zmm2, zmme2 and zmm3/m512/m32bcst and store 
zmm3/m512/m32bcst result in zmm1 using writemask k1. 
EVEX.128.66.0F.W1 DB /r C VIV AVX512VL | Bitwise AND of packed quadword integers in 
VPANDQ xmm1 {k1}{z}, xmm2, AVX512F xmme2 and xmm3/m128/m64bcst and store 
xmm3/m128/m64bcst result in xmm1 using writemask k1. 
EVEX.256.66.0F.W1 DB /r C VIV AVX512VL | Bitwise AND of packed quadword integers in 
VPANDQ ymm1 {k1}{z}, ymm2, AVX512F ymme and ymm3/m256/m64bcst and store 
ymm3/m256/m64bcst result in ymm1 using writemask k1. 
EVEX.512.66.0F.W1 DB /r C VV AVX512F Bitwise AND of packed quadword integers in 
VPANDQ zmm1 {k1}{z}, zmm2, zmme2 and zmm3/m512/m64bcst and store 
zmm3/m512/m64bcst result in zmm1 using writemask k1. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical AND operation on the first source operand and second source operand and stores the 
result in the destination operand. Each bit of the result is set to 1 if the corresponding bits of the first and second 
operands are 1, otherwise it is set to 0. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 
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Legacy SSE instructions: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand can be an MMX technology register. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding ZMM register destination are unmodified. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask ki at 32/64-bit granularity. 

VEX.256 encoded versions: The first source operand is a YMM register. The second source operand is a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 

VEX.128 encoded versions: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


Operation 


PAND (64-bit operand) 
DEST := DEST AND SRC 


PAND (128-bit Legacy SSE version) 
DEST := DEST AND SRC 
DEST[MAXVL-1:128] (Unmodified) 


VPAND (VEX.128 encoded version) 
DEST := SRC1 AND SRC2 
DEST[MAXVL-1:128] := 0 


VPAND (VEX.256 encoded instruction) 
DEST[255:0] := (SRC1[255:0] AND SRC2[255:0]) 
DEST[MAXVL-1:256] := 0 


VPANDD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] := SRC1[i+31:i] BITWISE AND SRC2[31:0] 
ELSE DEST[i+31:i] := SRC1[i+31:i] BITWISE AND SRC2[i+31:i] 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPANDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST{i+63:i] = SRC1[i+63:i] BITWISE AND SRC2[63:0] 
ELSE DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[i+63:i] 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPANDD __m512i__mm512_and_epi32(__m512i a,__m512ib); 

VPANDD __m512i_mm512_mask_and_epi32(__m512is,__ mmask16 k,___m512ia, 
VPANDD __m512i_mm512_maskz_and_epi32(__mmask16 k,__m512ia,__m512ib); 
VPANDQ __m512i__mm512_and_epi64(__m512i a,__m512i b); 

VPANDQ __m512i__mm512_mask_and_epi64(__m512is, __mmask8 k, __m512i a, __m512i b); 
VPANDQ __m512i _mm512_maskz_and_epi64(__mmask8 k, __m512i a, ___m512i b); 
VPANDND __m256i __mm256_mask_and_epi32(__m256is,___ mmask8 k,___ m256i a, __m256i b); 
VPANDND __m256i __mm256_maskz_and_epi32(__mmask8 k,___ m256i a, __ m256i b); 
VPANDND __m128i __mm_mask_and_epi32(__m128i s, __mmask8 k,__m128i a,___m128i b); 
VPANDND __m128i __mm_maskz_and_epi32(__ mmask8 k,___m128i a,__m128i b); 

VPANDNQ __m256i__mm256_mask_and_epi64(__m256i s, __mmask8 k, __m256i a, __m256i b); 


m512i b); 


VPANDNQ __m256i__mm256_maskz_and_epi64(__mmask8 k, __m256i a, __m256i b); 
VPANDNQ __m128i__mm_mask_and_epi64(__m128i s,__mmask8 k, __m128i a, ___m128i b); 
VPANDNQ __m128i__mm_maskz_and_epi64(__mmask8 k, __m128i a, __m128i b); 

PAND: m64 _mm_and_si64 (__m64 m1,__m64 m2) 

(V)PAND:__m128i __mm_and_si128 (__m128i a, ___m128i b) 

VPAND: m256i __mm256_and_si256 (__m256i a, __m256i b) 

Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PANDN—Logical AND NOT 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF DF /r! A VIN MMX Bitwise AND NOT of mm/m64 and mm. 
PANDN mm, mm/m64 
66 OF DF /r A VIN SSE2 Bitwise AND NOT of xmm2/m128 and xmm1. 
PANDN xmm1, xmm2/m128 
VEX.128.66.0F.WIG DF /r B VN AVX Bitwise AND NOT of xmm3/m128 and xmm2. 
VPANDN xmm1, xmm2, xmm3/m128 
VEX.256.66.0F.wic DF /r B VV AVX2 Bitwise AND NOT of ymm2, and ynm3/m256 
VPANDN ymm1, ymm2, ymm3/m256 and store result in ymm/7. 
EVEX.128.66.0F.WO DF /r C VIN AVX512VL_ | Bitwise AND NOT of packed doubleword 
VPANDND xmm1 {k1}{z}, xmm2, AVX512F integers in xmm2 and xmm3/m128/m32bcst 
xmm3/m1 28/m32bcst and store result in xmm1 using writemask k1. 
EVEX.256.66.0F.WO DF /r C VN AVX512VL_ | Bitwise AND NOT of packed doubleword 
VPANDND ymm1 {k1}{z}, ymm2, AVX512F integers in ymm2 and ymm3/m256/m32bcst 
ymm3/m256/m32bcst and store result in ymm1 using writemask k1. 
EVEX.512.66.0F.WO DF /r C VV AVX512F Bitwise AND NOT of packed doubleword 
VPANDND zmm1 {k1}{z}, zmm2, integers in zmm2 and zmm3/m512/m32bcst 
zmm3/m51 2/m32bcst and store result in zmm1 using writemask k1. 
EVEX.128.66.0F.W1 DF /r C VV AVX512VL_ | Bitwise AND NOT of packed quadword 
VPANDNQ xmm1 {k1}{z}, xmm2, AVX512F integers in xmm2 and xmm3/m128/m64bcst 
xmm3/m1 28/m64bcst and store result in xmm1 using writemask k1. 
EVEX.256.66.0F.W1 DF /r C VV AVX512VL_ | Bitwise AND NOT of packed quadword 
VPANDNQ ymm1 {k1}{z}, ymm2, AVX512F integers in ymm2 and ymm3/m256/m64bcst 
ymm3/m256/m64bcst and store result in ymm1 using writemask k1. 
EVEX.512.66.0F.W1 DF /r C VV AVX512F Bitwise AND NOT of packed quadword 
VPANDNQ zmm1 {k1}{z}, zmm2, integers in zmm2 and zmm3/m512/m64bcst 
zmm3/m512/m64bcst and store result in zmm1 using writemask k1. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical NOT operation on the first source operand, then performs bitwise AND with second 
source operand and stores the result in the destination operand. Each bit of the result is set to 1 if the corre- 


sponding bit in the first operand is 0 and the corresponding bit in the second operand is 1, otherwise it is set to 0. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 
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Legacy SSE instructions: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand can be an MMxX technology register. 

128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding ZMM register destination are unmodified. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask ki at 32/64-bit granularity. 

VEX.256 encoded versions: The first source operand is a YMM register. The second source operand is a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of 
the corresponding ZMM register destination are zeroed. 

VEX.128 encoded versions: The first source operand is an XMM register. The second source operand is an XMM 
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


Operation 


PANDN (64-bit operand) 
DEST := NOT(DEST) AND SRC 


PANDN (128-bit Legacy SSE version) 
DEST := NOT(DEST) AND SRC 
DEST[MAXVL-1:128] (Unmodified) 


VPANDN (VEX.128 encoded version) 
DEST := NOT(SRC1) AND SRC2 
DEST[MAXVL-1:128] := 0 


VPANDN (VEX.256 encoded instruction) 
DEST[255:0] := ((NOT SRC1[255:0]) AND SRC2[255:0]) 
DEST[MAXVL-1:256] := 0 


VPANDND (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] := (NOT SRC1[i+31:i]) AND SRC2[31:0]) 
ELSE DEST[i+31:i] := (NOT SRC1[i+31:i]) AND SRC2[i+31:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPANDNQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST{[i+63:i] = (NOT SRC1[i+63:i]) AND SRC2[63:0]) 
ELSE DEST[i+63:i] = ((NOT SRC1[i+63:i]) AND SRC2[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPANDND __m512i_mm512_andnot_epi32(__m512i a,__m512i b); 

VPANDND __m512i_mm512_mask_andnot_epi32(__m512i s,__ mmask16 k,__m512i a,__m512ib); 
VPANDND __m512i_mm512_maskz_andnot_epi32(__mmask16 k,__m512i a,__m512i b); 
VPANDND __m256i__mm256_mask_andnot_epi32(__m256i s,___mmask8 k, __ m256i a, ___m256i b); 
VPANDND __m256i_mm256_maskz_andnot_epi32(__mmask8 k,__ m256i a, __m256i b); 
VPANDND __m128i __mm_mask_andnot_epi32(__m128i s,__ mmask8 k,__m128i a,__m128i b); 
VPANDND __m128i __mm_maskz_andnot_epi32(__mmask8 k,___m128i a,__m128i b); 

VPANDNQ __m512i_mm512_andnot_epi64(__m512i a, __m512i b); 

VPANDNQ __m512i__mm512_mask_andnot_epi64(__m512i s, __mmask8 k,__m512i a, __m512i b); 
VPANDNQ __m512i_mm512_maskz_andnot_epi64(__mmask8 k,__m512i a, ___m512i b); 
VPANDNQ __m256i__mm256_mask_andnot_epi64(__m256i s, __mmask8 k, __m256i a, __m256i b); 
VPANDNQ __m256i__mm256_maskz_andnot_epi64(__mmask8 k, __m256i a, __m256i b); 
VPANDNQ __m128i__mm_mask_andnot_epi64(__m128i s,___ mmask8 k, __m128i a, __m128i b); 
VPANDNQ __m128i __mm_maskz_andnot_epi64(__mmask8 k, __m128i a, __m128i b); 

PANDN: __m64 _mm_andnot_si64 (__m64 m1,___m64 m2) 


(V)PANDN:__m128i _mm_andnot_si128 (__m128i a, ___m128i b) 
VPANDN: m256i_mm256_andnot_si256 (__m256i a,__ m256i b) 
Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PAUSE-—Spin Loop Hint 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
F3 90 PAUSE ZO | Valid Valid Gives hint to processor that improves 
performance of spin-wait loops. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Improves the performance of spin-wait loops. When executing a “spin-wait loop,” processors will suffer a severe 
performance penalty when exiting the loop because it detects a possible memory order violation. The PAUSE 
instruction provides a hint to the processor that the code sequence is a spin-wait loop. The processor uses this hint 
to avoid the memory order violation in most situations, which greatly improves processor performance. For this 
reason, it is recommended that a PAUSE instruction be placed in all spin-wait loops. 

An additional function of the PAUSE instruction is to reduce the power consumed by a processor while executing a 
spin loop. A processor can execute a spin-wait loop extremely quickly, causing the processor to consume a lot of 
power while it waits for the resource it is spinning on to become available. Inserting a pause instruction in a spin- 
wait loop greatly reduces the processor’s power consumption. 

This instruction was introduced in the Pentium 4 processors, but is backward compatible with all IA-32 processors. 
In earlier IA-32 processors, the PAUSE instruction operates like a NOP instruction. The Pentium 4 and Intel Xeon 
processors implement the PAUSE instruction as a delay. The delay is finite and can be zero for some processors. 
This instruction does not change the architectural state of the processor (that is, it performs essentially a delaying 
no-op operation). 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
Execute_Next_Instruction(DELAY); 


Numeric Exceptions 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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PAVGB/PAVGW—Average Packed Integers 


VPAVGW zmm1 {k1}{z}, zmm2, zmm3/m512 


NOTES: 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF €0 /r' A VIV SSE Average packed unsigned byte integers from 

PAVGB mm1, mm2/m64 mm2/m64 and mm1 with rounding. 

66 OF E0, /r A VIV SSE2 Average packed unsigned byte integers from 

PAVGB xmm1, xmm2/m128 xmm2/m128 and xmm1 with rounding. 

NP OF €3 /r' A VIV SSE Average packed unsigned word integers from 

PAVGW mm1, mm2/m64 mm2/m64 and mm17 with rounding. 

66 OF E3 /r A VIV SSE2 Average packed unsigned word integers from 

PAVGW xmm1, xmm2/m128 xmm2/m128 and xmm7 with rounding. 

VEX.128.66.0F.WIG EO /r B VIV AVX Average packed unsigned byte integers from 

VPAVGB xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2é with rounding. 

VEX.128.66.0F.WIG E3 /r B VIV AVX Average packed unsigned word integers from 

VPAVGW xmm1, xmm2, xmm3/m128 xmm3/m128 and xmmé with rounding. 

VEX.256.66.0F.wiG EO /r B VIV AVX2 Average packed unsigned byte integers from 

VPAVGB ymm1, ymm2, ymm3/m256 ymm2, and ymm3/m256 with rounding and 
store to ymm!1. 

VEX.256.66.0F.wic €3 /r B VIV AVX2 Average packed unsigned word integers from 

VPAVGW ymm1, ymm2, ymm3/m256 ymmé, ynm3/m256 with rounding to ymm7. 

EVEX.128.66.0F.WIG EO /r C VIV AVX512VL | Average packed unsigned byte integers from 

VPAVGB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2, and xmm3/m128 with rounding and 
store to xmm1 under writemask k1. 

EVEX.256.66.0F.WIG EO /r C VIV AVX512VL | Average packed unsigned byte integers from 

VPAVGB ymm7 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2, and ymm3/m256 with rounding and 
store to ymm1 under writemask k1. 

EVEX.512.66.0F.WIG EO /r C VIV AVX512BW | Average packed unsigned byte integers from 

VPAVGB zmm1 {k1}{z}, zmm2, zmm3/m512 zmm2, and zmm3/m512 with rounding and 
store to zmm1 under writemask k1. 

EVEX.128.66.0F.WIG E3 /r C VIV AVX512VL | Average packed unsigned word integers from 

VPAVGW xmm7 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2, xmm3/m128 with rounding to xmm1 
under writemask k1. 

EVEX.256.66.0F.WIG E3 /r C VIN AVX512VL | Average packed unsigned word integers from 

VPAVGW ymm 17 {k1}{z}, ynm2, ynm3/m256 AVX512BW | ymm2, ymm3/m256 with rounding to ymm1 
under writemask k1. 

EVEX.512.66.0F.WIG E3 /r C VIV AVX512BW | Average packed unsigned word integers from 


zmm2, zmm3/m512 with rounding to zmm1 
under writemask k1. 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 
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Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD average of the packed unsigned integers from the source operand (second operand) and the 
destination operand (first operand), and stores the results in the destination operand. For each corresponding pair 
of data elements in the first and second operands, the elements are added together, a 1 is added to the temporary 
sum, and that result is shifted right one bit position. 


The (V)PAVGB instruction operates on packed unsigned bytes and the (V)PAVGW instruction operates on packed 
unsigned words. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand can be an MMxX technology register. 


128-bit Legacy SSE version: The first source operand is an XMM register. The second operand can be an XMM 
register or an 128-bit memory location. The destination is not distinct from the first source XMM register and the 
upper bits (MAXVL-1:128) of the corresponding register destination are unmodified. 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register or a 512-bit memory location. The destination operand is a ZMM register. 

VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand 
is a YMM register or a 256-bit memory location. The destination operand is a YMM register. 

VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand 


is an XMM register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL- 
1:128) of the corresponding register destination are zeroed. 


Operation 


PAVGB (with 64-bit operands) 
DEST[7:0] := (SRC[7:0] + DEST[7:0] + 1) >> 1; (* Temp sum before shifting is 9 bits *) 
(* Repeat operation performed for bytes 2 through 6 *) 
DEST[63:56] := (SRC[63:56] + DEST[63:56] + 1) >> 1; 


PAVGW (with 64-bit operands) 
DEST[15:0] := (SRC[15:0] + DEST[15:0] + 1) >> 1; (* Temp sum before shifting is 17 bits *) 
(* Repeat operation performed for words 2 and 3 *) 
DEST[63:48] := (SRC[63:48] + DEST[63:48] + 1) >> 1; 


PAVGB (with 128-bit operands) 
DEST[7:0] := (SRC[7:0] + DEST[7:0] + 1) >> 1; (* Temp sum before shifting is 9 bits *) 
(* Repeat operation performed for bytes 2 through 14 *) 
DEST[127:1 20] := (SRC[127:120] + DEST[127:120] + 1) >> 1; 


PAVGW (with 128-bit operands) 
DEST[15:0] := (SRC[15:0] + DEST[15:0] + 1) >> 1; (* Temp sum before shifting is 17 bits *) 
(* Repeat operation performed for words 2 through 6 *) 
DEST[127:112] := (SRC[127:112] + DEST[127:112] + 1) >> 1; 
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VPAVGB (VEX.128 encoded version) 
DEST[7:0] := (SRC1[7:0] + SRC2[7:0] + 1) >> 1; 
(* Repeat operation performed for bytes 2 through 15 *) 
DEST[127:120] := (SRC1[127:120] + SRC2[127:120] + 1) >> 1 
DEST[MAXVL-1:128] := 0 


VPAVGW (VEX.128 encoded version) 
DEST[15:0] := (SRC1[15:0] + SRC2[15:0] + 1) >> 1; 
(* Repeat operation performed for 16-bit words 2 through 7 *) 
DEST[127:112] := (SRC1[127:112] + SRC2[127:112] + 1)>>1 
DEST[MAXVL-1:1 28] := 0 


VPAVGB (VEX.256 encoded instruction) 
DEST[7:0] := (SRC1[7:0] + SRC2[7:0] + 1) >> 1; (* Temp sum before shifting is 9 bits *) 
(* Repeat operation performed for bytes 2 through 31) 
DEST[255:248] := (SRC1[255:248] + SRC2[255:248] + 1) >> 1; 


VPAVGW (VEX.256 encoded instruction) 
DEST[15:0] := (SRC1[15:0] + SRC2[15:0] + 1) >> 1; (* Temp sum before shifting is 17 bits *) 
(* Repeat operation performed for words 2 through 15) 
DEST[255:14]) := (SRC1[255:240] + SRC2[255:240] + 1) >> 1; 
VPAVGB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j :=0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST{i+7:i] := (SRC1[i+7:i] + SRC2[i+7:i] + 1) >> 1; (* Temp sum before shifting is 9 bits *) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPAVGW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] = (SRC1[i+15:i] + SRC2[i+ 15:4] + 1) >> 1 
;(* Temp sum before shifting is 17 bits *) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 


VPAVGB ___m512i_mm512_avg_epu8(__m512i a,__m512i b); 

VPAVGW __m512i_mm512_avg_epu16(__m512ia,__m512i b); 

VPAVGB __m512i_mm512_mask_avg_epu8(__m512is,__ mmask64 m,__m512i a,__m512ib); 
VPAVGW __m512i_mm512_mask_avg_epu16(__m512is,__mmask32 m,__m512ia,__m512ib); 
VPAVGB __m512i_mm512_maskz_avg_epu8(__mmask64 m,___m512i a,__m512i b); 

VPAVGW __m512i_mm512_maskz_avg_epu16(__mmask32 m,_m512i a,__m512ib); 
VPAVGB __m256i__mm256_mask_avg_epu8(__m256i s,__ mmask32 m,___m256i a,___m256i b); 
VPAVGW __m256i__mm256_mask_avg_epu16(__m256is,__ mmask16 m,_m256i a, __m256i b); 
VPAVGB __m256i__mm256_maskz_avg_epu8(__mmask32 m,___m256i a, __m256i b); 

VPAVGW __m256i __mm256_maskz_avg_epu16(__mmask16 m,___m256i a, __ m256i b); 

VPAVGB __m128i_mm_mask_avg_epu8(__m128i s,___ mmask16 m,___m128i a,__m128i b); 
VPAVGW __m128i__mm_mask_avg_epu16(__m128i s, __mmask8 m,_m128i a, __m128i b); 
VPAVGB __m128i _mm_maskz_avg_epu8(__mmask16 m, __m128i a,__m128i b); 


VPAVGW __m128i__mm_maskz_avg_epu16(__mmask8 m, ___m128i a,__m128i b); 
PAVGB: ___m64 _mm_avg_pu8 (__m64 a,___m64 b) 

PAVGW: __m64_mm_avg_pu16 (__m64 a,__m64 b) 

(V)PAVGB: __m128i __mm_avg_epu8 (__m128i a, ___m128i b) 

(V)PAVGW: __m128i__mm_avg_epu16 (__m128i a,__m128i b) 

VPAVGB: m256i_mm256_avg_epu8 (__m256i a,__m256i b) 
VPAVGW: m256i_mm256_avg_epu16 (__m256i a, ___ m256i b) 

Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
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EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PBLENDVB — Variable Blend Packed Bytes 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
66 OF 38 10 /r RM VIV SSE4_1 Select byte values from xmm17 and 


PBLENDVB xmm1, xmm2/m128, <XMMO> xmm2/m1 28 from mask specified in the high 
bit of each byte in XMMO and store the 


values into xmm1. 


VEX.128.66.0F3A.WO 4C /r /is4 RVMR | V/V AVX 
VPBLENDVB xmm1, xmm2, xmm3/m128, xmm4 


Select byte values from xmm2 and 
xmm3/m128 using mask bits in the specified 
mask register, xmm4, and store the values 
into xmm1. 


VEX.256.66.0F3A.WO 4C /r /is4 RVMR | V/V AVX2 
VPBLENDVB ymm17, ymm2, ynm3/m256, ymm4 


Select byte values from ymm2 and 
ymm3/m256 from mask specified in the high 
bit of each byte in ymm4 and store the 
values into ymm7. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) <XMMO> NA 
RVMR ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8[7:4] 
Description 


Conditionally copies byte elements from the source operand (second operand) to the destination operand (first 
operand) depending on mask bits defined in the implicit third register argument, XMMO. The mask bits are the most 
significant bit in each byte element of the XMMO register. 


If a mask bit is “1", then the corresponding byte element in the source operand is copied to the destination, else 
the byte element in the destination operand is left unchanged. 


The register assignment of the implicit third operand is defined to be the architectural register XMMO. 


128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128) 
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined 
to be the architectural register XMMO. An attempt to execute PBLENDVB with a VEX prefix will cause #UD. 


VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second 
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. VEX.L 
must be 0, otherwise the instruction will #UD. VEX.W must be 0, otherwise, the instruction will #UD. 

VEX.256 encoded version: The first source operand and the destination operand are YMM registers. The second 
source operand is an YMM register or 256-bit memory location. The third source register is an YMM register and 
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is 
ignored. 

VPBLENDVB permits the mask to be any XMM or YMM register. In contrast, PBLENDVB treats XMMO implicitly as the 


mask and do not support non-destructive destination operation. An attempt to execute PBLENDVB encoded with a 
VEX prefix will cause a #UD exception. 


Operation 

PBLENDVB (128-bit Legacy SSE version) 

MASK := XMMO 

IF (MASK[7] = 1) THEN DEST[7:0] := SRC[7:0]; 
ELSE DEST[7:0] := DEST[7:0]; 

IF (MASK[15] = 1) THEN DEST[15:8] := SRC[15:8]; 
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ELSE DEST[15:8] := DEST[15:8]; 
IF (MASK[23] = 1) THEN DEST[23:16] := SRC[23:16] 
ELSE DEST[23:16] := DEST[23:16]; 
IF (MASK[31] = 1) THEN DEST[31:24] := SRC[31:24] 
ELSE DEST[31:24] := DEST[31:24]; 
IF (MASK[39] = 1) THEN DEST[39:32] := SRC[39:32] 
ELSE DEST[39:32] := DEST[39:32]; 
IF (MASK[47] = 1) THEN DEST[47:40] := SRC[47:40] 
ELSE DEST[47:40] := DEST[47:40]; 
IF (MASK[55] = 1) THEN DEST[55:48] := SRC[55:48] 
ELSE DEST[55:48] := DEST[55:48]; 
IF (MASK[63] = 1) THEN DEST[63:56] := SRC[63:56] 
ELSE DEST[63:56] := DEST[63:56]; 
IF (MASK[71] = 1) THEN DEST[71:64] := SRC[71:64] 
ELSE DEST[71:64] := DEST[71:64]; 
IF (MASK[79] = 1) THEN DEST[79:72] := SRC[79:72] 
ELSE DEST[79:72] := DEST[79:72]; 
IF (MASK[87] = 1) THEN DEST[87:80] := SRC[87:80] 
ELSE DEST[87:80] := DEST[87:80]; 
IF (MASK[95] = 1) THEN DEST[95:88] := SRC[95:88] 
ELSE DEST[95:88] := DEST[95:88]; 


IF (MASK[103] = 1) THEN DEST[103:96] := SRC[103:96] 


ELSE DEST[103:96] := DEST[103:96]; 


IF (MASK[111] = 1) THEN DEST[111:104] := SRC[111:104}] 


ELSE DEST[111:104] := DEST[111:104]; 


IF (MASK[119] = 1) THEN DEST[1 19:1 12] := SRC[119:112] 


ELSE DEST[119:112] := DEST[119:112]; 


IF (MASK[127] = 1) THEN DEST[127:1 20] := SRC[127:120] 


ELSE DEST[127:120] := DEST[127:120]) 
DEST[MAXVL-1:1 28] (Unmodified) 


VPBLENDVB (VEX.128 encoded version) 

MASK := SRC3 

IF (MASK[7] = 1) THEN DEST[7:0] := SRC2[7:0); 

ELSE DEST[7:0] := SRC1[7:0]; 

IF (MASK[15] = 1) THEN DEST[15:8] := SRC2[1 5:8); 
ELSE DEST[15:8] := SRC1[15:8]; 

IF (MASK[23] = 1) THEN DEST[23:16] := SRC2[23:16] 
ELSE DEST[23:16] := SRC1[23:16]; 

IF (MASK[31] = 1) THEN DEST[31:24] := SRC2[31:24] 
ELSE DEST[31:24] := SRC1[31:24]; 

IF (MASK[39] = 1) THEN DEST[39:32] := SRC2[39:32] 
ELSE DEST[39:32] := SRC1[39:32]; 

IF (MASK[47] = 1) THEN DEST[47:40] := SRC2[47:40] 
ELSE DEST[47:40] := SRC1[47:40]; 

IF (MASK[55] = 1) THEN DEST[55:48] := SRC2[55:48] 
ELSE DEST[55:48] := SRC1[55:48]; 

IF (MASK[63] = 1) THEN DEST[63:56] := SRC2[63:56] 
ELSE DEST[63:56] := SRC1[63:56]; 

IF (MASK[71] = 1) THEN DEST[71:64] := SRC2[7 1:64] 
ELSE DEST[71:64] := SRC1[71:64]; 

IF (MASK[79] = 1) THEN DEST[79:72] := SRC2[79:72] 
ELSE DEST[79:72] := SRC1[79:72]; 

IF (MASK[87] = 1) THEN DEST[87:80] := SRC2[87:80] 
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ELSE DEST[87:80] := SRC1[87:80]; 
IF (MASK[95] = 1) THEN DEST[95:88] := SRC2[95:88] 

ELSE DEST[95:88] := SRC1[95:88]; 

IF (MASK[103] = 1) THEN DEST[103:96] := SRC2[103:96] 
ELSE DEST[103:96] := SRC1[103:96]; 

IF (MASK[111] = 1) THEN DEST[111:104] := SRC2[111:104] 
ELSE DEST[111:104] = SRC1[111:104]; 

IF (MASK[119] = 1) THEN DEST[119:112] := SRC2[119:112] 
ELSE DEST[119:112] = SRC1[119:1 12]; 

IF (MASK[127] = 1) THEN DEST[127:120] := SRC2[127:120] 
ELSE DEST[127:120] = SRC1[127:120]) 
DEST[MAXVL-1:128] := 0 


VPBLENDVB (VEX.256 encoded version) 

MASK := SRC3 

IF (MASK[7] == 1) THEN DEST[7:0] := SRC2[7:0]; 

ELSE DEST[7:0] := SRC1[7:0]; 

IF (MASK[15] == 1) THEN DEST[15:8] := SRC2[15:8]; 

ELSE DEST[15:8] := SRC1[15:8]; 

IF (MASK[23] == 1) THEN DEST[23:16] := SRC2[23:16] 

ELSE DEST[23:16] := SRC1[23:16]; 

IF (MASK[31] == 1) THEN DEST[31:24] := SRC2[31:24] 

ELSE DEST[31:24] := SRC1[31:24]; 

IF (MASK[39] == 1) THEN DEST[39:32] := SRC2[39:32] 

ELSE DEST[39:32] := SRC1[39:32]; 

IF (MASK[47] == 1) THEN DEST[47:40] := SRC2[47:40] 

ELSE DEST[47:40] := SRC1[47:40]; 

IF (MASK[55] == 1) THEN DEST[55:48] := SRC2[55:48] 

ELSE DEST[55:48] := SRC1[55:48]; 

IF (MASK[63] == 1) THEN DEST[63:56] := SRC2[63:56] 

ELSE DEST[63:56] := SRC1[63:56]; 

IF (MASK[71] == 1) THEN DEST[71:64] := SRC2[7 1:64] 

ELSE DEST[71:64] := SRC1[71:64]; 

IF (MASK[79] == 1) THEN DEST[79:72] := SRC2[79:72] 

ELSE DEST[79:72] := SRC1[79:72]; 

IF (MASK[87] == 1) THEN DEST[87:80] := SRC2[87:80] 

ELSE DEST[87:80] := SRC1[87:80]; 

IF (MASK[95] == 1) THEN DEST[95:88] := SRC2[95:88] 

ELSE DEST[95:88] := SRC1[95:88]; 

IF (MASK[103] == 1) THEN DEST[103:96] := SRC2[103:96] 
ELSE DEST[103:96] := SRC1[103:96]; 

IF (MASK[111] == 1) THEN DEST[111:104] := SRC2[111:104] 
ELSE DEST[111:104] := SRC1[111:104]; 

IF (MASK[119] == 1) THEN DEST[119:112] := SRC2[119:112] 
ELSE DEST[119:112] := SRC1[119:112]; 

IF (MASK[127] == 1) THEN DEST[127:1 20] := SRC2[127:120] 
ELSE DEST[127:120] := SRC1[127:120]) 

IF (MASK[135] == 1) THEN DEST[135:1 28] := SRC2[135:128]; 
ELSE DEST[135:128] := SRC1[135:128]; 

IF (MASK[143] == 1) THEN DEST[143:1 36] := SRC2[143:136]; 
ELSE DEST[[143:136] := SRC1[143:136]; 

IF (MASK[151] == 1) THEN DEST[151:144] := SRC2[151:144] 
ELSE DEST[151:144] := SRC1[151:144]; 

IF (MASK[159] == 1) THEN DEST[159:152] := SRC2[159:152] 
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ELSE DEST[159:152] := SRC1[159:152]; 
IF (MASK[167] == 1) THEN DEST[167:160] := SRC2[167:160] 
ELSE DEST[167:160] := SRC1[167:160]; 
IF (MASK[175] == 1) THEN DEST[175:168] := SRC2[175:168] 
ELSE DEST[175:168] := SRC1[175:168]; 
IF (MASK[183] == 1) THEN DEST[183:1 76] := SRC2[183:1 76] 
ELSE DEST[183:1 76] := SRC1[183:1 76]; 
IF (MASK[191] == 1) THEN DEST[191:184] := SRC2[191:184] 
ELSE DEST[191:184] := SRC1[191:184]; 
IF (MASK[199] == 1) THEN DEST[199:192] := SRC2[199:192] 
ELSE DEST[199:1 92] := SRC1[199:192]; 
IF (MASK[207] == 1) THEN DEST[207:200] := SRC2[207:200] 
ELSE DEST[207:200] := SRC1[207:200] 
IF (MASK[215] == 1) THEN DEST[215:208] := SRC2[215:208] 
ELSE DEST[215:208] := SRC1[215:208]; 
IF (MASK[223] == 1) THEN DEST[223:216] := SRC2[223:216] 
ELSE DEST[223:216] := SRC1[223:216]; 
IF (MASK[231] == 1) THEN DEST[231:224] := SRC2[231:224] 
ELSE DEST[231:224] := SRC1[231:224]; 
IF (MASK[239] == 1) THEN DEST[239:232] := SRC2[239:232] 
ELSE DEST[239:232] := SRC1[239:232]; 
IF (MASK[247] == 1) THEN DEST[247:240] := SRC2[247:240] 
ELSE DEST[247:240] := SRC1[247:240]; 
IF (MASK[255] == 1) THEN DEST[255:248] := SRC2[255:248] 
ELSE DEST[255:248] := SRC1[255:248] 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)PBLENDVB: m128i_mm_blendv_epi8 (__m128i v1,__m128i v2, __m128i mask); 
VPBLENDVB: m256i _mm256_blendv_epi8 (__m256i v1, 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD If VEX.W = 1. 
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Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
66 OF 3A OE /r ib RMI | V/V SSE4_1 Select words from xmm1 and xmm2/m128 
PBLENDW xmm1, xmm2/m128, imm8 from mask specified in imm8 and store the 
values into xmm7. 
VEX.128.66.0F3A.WIG OE /r ib RVMI | V/V AVX Select words from xmm2 and xmm3/m128 
VPBLENDW xmm1, xmm2, xmm3/m128, imm8 from mask specified in imm8 and store the 
values into xmm7. 
VEX.256.66.0F3A.WIG OE /r ib RVMI | V/V AVX2 Select words from ymm2 and ymm3/m256 
VPBLENDW ymm17, ymm2, ymm3/m256, imm8 from mask specified in imm8 and store the 
values into ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r, w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 

Description 


Words from the source operand (second operand) are conditionally written to the destination operand (first 
operand) depending on bits in the immediate operand (third operand). The immediate bits (bits 7:0) form a mask 
that determines whether the corresponding word in the destination is copied from the source. If a bit in the mask, 
corresponding to a word, is “1", then the word is copied, else the word element in the destination operand is 
unchanged. 

128-bit Legacy SSE version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM destination 
register remain unchanged. 

VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register 
are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


Operation 


PBLENDW (128-bit Legacy SSE version) 

IF (imm8[O] = 1) THEN DEST[15:0] := SRC[15:0] 

ELSE DEST[15:0] := DEST[15:0] 

IF (imm8[1] = 1) THEN DEST[31:16] := SRC[31:16] 
ELSE DEST[31:16] := DEST[31:16] 

IF (imm8[2] = 1) THEN DEST[47:32] := SRC[47:32] 
ELSE DEST[47:32] := DEST[47:32] 

IF (imm8[3] = 1) THEN DEST[63:48] := SRC[63:48] 
ELSE DEST[63:48] := DEST[63:48] 

IF (imm8[4] = 1) THEN DEST[79:64] := SRC[79:64] 
ELSE DEST[79:64] := DEST[79:64] 

IF (imm8[5] = 1) THEN DEST[95:80] := SRC[95:80] 
ELSE DEST[95:80] := DEST[95:80] 

IF (imm8[6] = 1) THEN DEST[11 1:96] := SRC[1 11:96] 
ELSE DEST[1 11:96] := DEST[11 1:96] 

IF (imm8[7] = 1) THEN DEST[127:112] := SRC[127:112] 
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ELSE DEST[127:112] := DEST[127:112] 


VPBLENDW (VEX.128 encoded version) 

IF (imm8[O] = 1) THEN DEST[15:0] := SRC2[15:0] 
ELSE DEST[15:0] := SRC1[15:0] 

IF (imm8[1] = 1) THEN DEST[31:16] := SRC2[31:16] 
ELSE DEST[31:16] := SRC1[31:16] 

IF (imm8[2] = 1) THEN DEST[47:32] := SRC2[47:32] 
ELSE DEST[47:32] := SRC1[47:32] 

IF (imm8[3] = 1) THEN DEST[63:48] := SRC2[63:48] 
ELSE DEST[63:48] := SRC1[63:48] 

IF (imm8[4] = 1) THEN DEST[79:64] := SRC2[79:64] 
ELSE DEST[79:64] := SRC1[79:64] 

IF (imm8[5] = 1) THEN DEST[95:80] := SRC2[95:80] 
ELSE DEST[95:80] := SRC1[95:80] 

IF (imm8[6] = 1) THEN DEST[1 11:96] := SRC2[111:96] 
ELSE DEST[11 1:96] := SRC1[111:96] 

IF (imm8[7] = 1) THEN DEST[127:112] := SRC2[127:112] 
ELSE DEST[127:112] := SRC1[127:112] 
DEST[MAXVL-1:128] := 0 


VPBLENDW (VEX.256 encoded version) 

IF (imm8[O] == 1) THEN DEST[15:0] := SRC2[15:0] 

ELSE DEST[15:0] := SRC1[15:0] 

IF (imm8[1] == 1) THEN DEST[31:16] := SRC2[31:16] 
ELSE DEST[31:16] := SRC1[31:16] 

IF (imm8[2] == 1) THEN DEST[47:32] := SRC2[47:32] 
ELSE DEST[47:32] := SRC1[47:32] 

IF (imm8[3] == 1) THEN DEST[63:48] := SRC2[63:48] 
ELSE DEST[63:48] := SRC1[63:48] 

IF (imm8[4] == 1) THEN DEST[79:64] := SRC2[79:64] 
ELSE DEST[79:64] := SRC1[79:64] 

IF (imm8[5] == 1) THEN DEST[95:80] := SRC2[95:80] 
ELSE DEST[95:80] := SRC1[95:80] 

IF (imm8[6] == 1) THEN DEST[1 11:96] := SRC2[111:96] 
ELSE DEST[11 1:96] := SRC1[111:96] 

IF (imm8[7] == 1) THEN DEST[127:1 12] := SRC2[127:112] 
ELSE DEST[127:112] := SRC1[127:112] 

IF (imm8[0] == 1) THEN DEST[143:1 28] := SRC2[143:128] 
ELSE DEST[143:128] := SRC1[143:128] 

IF (imm8[1] == 1) THEN DEST[159:144] := SRC2[159:144] 
ELSE DEST[159:144] := SRC1[159:144] 

IF (imm8[2] == 1) THEN DEST[175:160] := SRC2[175:160] 
ELSE DEST[175:160] := SRC1[175:160] 

IF (imm8[3] == 1) THEN DEST[191:1 76] := SRC2[191:176] 
ELSE DEST[191:176] := SRC1[191:176] 

IF (imm8[4] == 1) THEN DEST[207:192] := SRC2[207:192] 
ELSE DEST[207:192] := SRC1[207:192] 

IF (imm8[5] == 1) THEN DEST[223:208] := SRC2[223:208] 
ELSE DEST[223:208] := SRC1[223:208] 

IF (imm8[6] == 1) THEN DEST[239:224] := SRC2[239:224] 
ELSE DEST[239:224] := SRC1[239:224] 

IF (imm8[7] == 1) THEN DEST[255:240] := SRC2[255:240] 
ELSE DEST[255:240] := SRC1[255:240] 
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Intel C/C++ Compiler Intrinsic Equivalent 
(V)PBLENDW: m128i __mm_blend_epi16 (__m128i v1,_m128i v2, const int mask); 
VPBLENDW: m256i __mm256_blend_epi16 (__m256i v1, 


m256i v2, const int mask) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1 and AVX2 = 0. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature Flag 
Support 
66 OF 3A 44 /r ib A VIN PCLMULQDQ_ | Carry-less multiplication of one quadword of 
PCLMULQDQ xmm1, xmm2/m128, imm8& xmm1 by one quadword of xmm2/m128, 
stores the 128-bit result in xmm17. The imme- 
diate is used to determine which quadwords 
of xmm1 and xmm2/m128 should be used. 
VEX.128.66.0F3A.WIG 44 /r ib B VV PCLMULQDQ | Carry-less multiplication of one quadword of 
VPCLMULQDQ xmm7, xmm2, xmm3/m128, imm&8 AVX xmmc2 by one quadword of xmm3/m128, 
stores the 128-bit result in xmm17. The imme- 
diate is used to determine which quadwords 
of xmm2 and xmm3/m128 should be used. 
VEX.256.66.0F3A.WIG 44 /r /ib B VIN VPCLMULQDO | Carry-less multiplication of one quadword of 
VPCLMULQDQ ymm1, ymm2, ymm3/m256, imm8 ymm2 by one quadword of ymm3/m256, 
stores the 128-bit result in ymm1. The imme- 
diate is used to determine which quadwords 
of ymm2 and ymm3/m256 should be used. 
EVEX.128.66.0F3A.WIG 44 /r /ib C VV VPCLMULQDO | Carry-less multiplication of one quadword of 
VPCLMULQDQ xmm1, xmm2, xmm3/m1 28, imm8 AVX512VL xmm_2 by one quadword of xmm3/m128, 
stores the 128-bit result in xmm1. The imme- 
diate is used to determine which quadwords 
of xmme2 and xmm3/m128 should be used. 
EVEX.256.66.0F3A.WIG 44 /r /ib C VV VPCLMULQDO | Carry-less multiplication of one quadword of 
VPCLMULQDQ ymm1, ymm2, ymm3/m256, imm8 AVX512VL ymm2z by one quadword of ymm3/m256, 
stores the 128-bit result in ymm1. The imme- 
diate is used to determine which quadwords 
of ymm2 and ymm3/m256 should be used. 
EVEX.512.66.0F3A.WIG 44 /r /ib C VV VPCLMULQDO | Carry-less multiplication of one quadword of 
VPCLMULQDQ zmm1, zmm2, zmm3/m512, imm8 AVX512F zmm_2 by one quadword of zmm3/m512, 
stores the 128-bit result in zmm1. The imme- 
diate is used to determine which quadwords 
of zmm2 and zmm3/m512 should be used. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand2 Operand3 Operand4 
A NA ModRM:reg (r, w) ModRM:r/m (r) imm8s NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé (r) 
Description 


Performs a carry-less multiplication of two quadwords, selected from the first source and second source operand 
according to the value of the immediate byte. Bits 4 and 0 are used to select which 64-bit half of each operand to 
use according to Table 4-13, other bits of the immediate byte are ignored. 


The EVEX encoded form of this instruction does not support memory fault suppression. 
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Table 4-13. PCLMULQDQ Quadword Selection of Immediate Byte 


Imm[4] Imm [0] PCLMULQDQ Operation 
0 0 CL_MUL( SRC2![63:0], SRC1[63:0] ) 
0 1 CL_MUL( SRC2[63:0], SRC1[127:64] ) 
1 0 CL_MUL( SRC2[127:64], SRC1[63:0] ) 
1 1 CL_MUL( SRC2[127:64], SRC1[127:64] ) 
NOTES: 


1. SRC2 denotes the second source operand, which can be a register or memory; SRC1 denotes the first source and destination oper- 
and. 


The first source operand and the destination operand are the same and must be a ZMM/YMM/XMM register. The 
second source operand can be a ZMM/YMM/XMM register or a 512/256/128-bit memory location. Bits (VL_MAX- 
1:128) of the corresponding YMM destination register remain unchanged. 


Compilers and assemblers may implement the following pseudo-op syntax to simplify programming and emit the 
required encoding for immés. 


Table 4-14. Pseudo-Op and PCLMULQDQ Implementation 


Pseudo-Op Imm8 Encoding 
PCLMULLQLQDQ xmm1, xmm2 0000_0000B 
PCLMULHQLQDQ xmm1, xmm2 0000_0001B 
PCLMULLQHQDQ xmm1, xmm2 0001_0000B 
PCLMULHQHQDQ xmm1, xmm2 0001_0001B 
Operation 
define PCLMUL1 28(X,Y): // helper function 
FOR i := 0 to 63: 
TMP [i]:= X[O] and Y[i] 
FOR j := 1 toi: 


TMP [i] := TMP [i] xor (X[j ] and Y[i-j]) 
DEST[i]:= TMPLi] 
FOR i := 64 to 126: 
TMP [i]:=0 
FOR j = i- 63 to 63: 
TMP [i]:= TMP [i] xor (X[j]and Y[i-j]) 
DEST[ i ]:= TMPLi] 
DEST[127] := 0; 
RETURN DEST // 128b vector 
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PCLMULQDQ (SSE version) 
IF Imm8[O] = 0: 

TEMP1 := SRC1.qword[0] 
ELSE: 

TEMP1 := SRC1.qword[1] 
IF Imm8[4] = 0: 

TEMP2 := SRC2.qword[0] 
ELSE: 

TEMP2 := SRC2.qword[1] 
DEST[127:0] := PCLMUL128(TEMP1, TEMP2) 
DEST[MAXVL-1:128] (Unmodified) 


VPCLMULQDQ (128b and 256b VEX encoded versions) 
(KL,VL) = (1,128), (2,256) 


FOR i= 0 to KL-1: 

IF Imm8[O] = 0: 

TEMP1 := SRC1.xmm{[i].qword[0] 
ELSE: 

TEMP1 := SRC1.xmm[i].qword[1] 
IF Imm8[4] = 0: 

TEMP2 := SRC2.xmm[i].qword[0] 
ELSE: 


TEMP2 := SRC2.xmm[i].qword[1] 
DEST.xmm[i] := PCLMUL1 28(TEMP1, TEMP2) 
DEST[MAXVL-1:VL] := 0 


VPCLMULQDQ (EVEX encoded version) 
(KL,VL) = (1,128), (2,256), (4,512) 


FOR i = O to KL-1: 

IF Imm8[O] = 0: 

TEMP1 := SRC1.xmm[i].qword[0] 
ELSE: 

TEMP1 := SRC1.xmm{[i].qword[1] 
IF Imm8[4] = 0: 

TEMP2 := SRC2.xmm[i].qword[0] 
ELSE: 


TEMP2 := SRC2.xmm[i].qword[1] 
DEST.xmm[i] := PCLMUL1 28(TEMP1, TEMP2) 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)PCLMULQDQ. = ___m128i _mm_clmulepi64_si128 (__m128i, __m128i, const int) 
VPCLMULQDQ m256i __mm256_clmulepi64_epi128(__m256i, __m256i, const int); 
VPCLMULQDQ m512i_mm512_clmulepi64_epi128(__m512i, __m512i, const int); 


SIMD Floating-Point Exceptions 
None. 
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Other Exceptions 

See Table 2-21, “Type 4 Class Exception Conditions”, additionally: 

#UD If VEX.L = 1. 

EVEX-encoded: See Table 2-50, “Type E4NF Class Exception Conditions”. 
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PCMPEQB/PCMPEQW/PCMPEQD— Compare Packed Data for Equal 


Opcode/ Op/ En | 64/32 bit | CPUID Description 
Instruction Mode Feature 
Support | Flag 

NP OF 74 /r! A VIV MMX Compare packed bytes in mm/m64 and mm 

PCMPEQB mm, mm/m64 for equality. 

66 OF 74 /r A VIV SSE2 Compare packed bytes in xmm2/m128 and 

PCMPEQB xmm1, xmm2/m128 xmm1 for equality. 

NP OF 75 /r| A VIV MMX Compare packed words in mm/m64 and mm 

PCMPEQW mm, mm/m64 for equality. 

66 OF 75 /r A VIV SSE2 Compare packed words in xmm2/m128 and 

PCMPEQW xmm1, xmm2/m128 xmm1 for equality. 

NP OF 76 /r! A VIV MMX Compare packed doublewords in mm/m64 and 

PCMPEQD mm, mm/m64 mm for equality. 

66 OF 76 /r A VIV SSE2 Compare packed doublewords in xmm2/m128 

PCMPEQD xmm1, xmm2/m128 and xmm1 for equality. 

VEX.128.66.0F.WIG 74 /r B VIV AVX Compare packed bytes in xmm3/m128 and 

VPCMPEQB xmm1, xmm2, xmm3/m128 xmmé for equality. 

VEX.128.66.0F.WIG 75 /r B VIV AVX Compare packed words in xmm3/m128 and 

VPCMPEQW xmm1, xmm2, xmm3/m128 xmme for equality. 

VEX.128.66.0F.WIG 76 /r B VIV AVX Compare packed doublewords in xmm3/m128 

VPCMPEQD xmm1, xmm2, xmm3/m128 and xmmeé for equality. 

VEX.256.66.0F.WIG 74 /r B VIV AVX2 Compare packed bytes in ymm3/m256 and 

VPCMPEQB ymm1, ymm2, ymm3 /m256 ymm2 for equality. 

VEX.256.66.0F.WIG 75 /r B VIV AVX2 Compare packed words in ymm3/m256 and 

VPCMPEQW ymm1, ymm2, ymm3 /m256 ymm2 for equality. 

VEX.256.66.0F.WIG 76 /r B VIV AVX2 Compare packed doublewords in ymm3/m256 

VPCMPEQD ymm1, ymm2, ymm3 /m256 and ymm2 for equality. 

EVEX.128.66.0F.WO 76 /r C VIV AVX512VL | Compare Equal between int32 vector xmm2 

VPCMPEQD k1 {k2}, xmm2, xmm3/m128/m32bcst AVX512F | and int32 vector xmm3/m128/m32ebcst, and 
set vector mask k1 to reflect the 
zero/nonzero status of each element of the 
result, under writemask. 

EVEX.256.66.0F.WO 76 /r C VIV AVX512VL | Compare Equal between int32 vector ymm2 

VPCMPEQD k1 {k2}, ymm2, ymm3/m256/m32bcst AVX512F | and int32 vector ymm3/m256/m32bcst, and 
set vector mask k1 to reflect the 
zero/nonzero status of each element of the 
result, under writemask. 

EVEX.512.66.0F.WO 76 /r C VIV AVX512F | Compare Equal between int32 vectors in 

VPCMPEQD k1 {k2}, zmm2, zmm3/m512/m32bcst zmme2 and zmm3/m512/m32bcst, and set 
destination k1 according to the comparison 
results under writemask k2. 

EVEX.128.66.0F.WIG 74 /r D VIV AVX512VL | Compare packed bytes in xmm3/m128 and 

VPCMPEQB k1 {k2}, xmm2, xmm3 /m128 AVX512BW | xmm2 for equality and set vector mask k1 to 


reflect the zero/nonzero status of each 
element of the result, under writemask. 
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EVEX.256.66.0F.WIG 74 /r D VIV AVX512VL | Compare packed bytes in ymm3/m256 and 
VPCMPEQB k1 {k2}, ymm2, ymm3 /m256 AVX512BW | ymm2 for equality and set vector mask k1 to 
reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.512.66.0F.WIG 74 /r D VIV AVX512BW | Compare packed bytes in zmm3/m512 and 
VPCMPEQB k1 {k2}, zmm2, zmm3 /m512 zmm_2 for equality and set vector mask k1 to 
reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.128.66.0F.WIG 75 /r D VIV AVX512VL | Compare packed words in xmm3/m128 and 
VPCMPEQW k1 {k2}, xmm2, xmm3 /m128 AVX512BW | xmmz for equality and set vector mask k1 to 
reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.256.66.0F.WIG 75 /r D VIV AVX512VL | Compare packed words in ymm3/m256 and 
VPCMPEQW k1 {k2}, ymm2, ymm3 /m256 AVX512BW | ymm2 for equality and set vector mask k1 to 
reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.512.66.0F.WIG 75 /r D VIV AVX512BW | Compare packed words in zmm3/m512 and 
VPCMPEQW k1 {k2}, zmm2, zmm3 /m512 zmm_2 for equality and set vector mask k1 to 
reflect the zero/nonzero status of each 
element of the result, under writemask. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare for equality of the packed bytes, words, or doublewords in the destination operand (first 
operand) and the source operand (second operand). If a pair of data elements is equal, the corresponding data 
element in the destination operand is set to all 1s; otherwise, it is set to all Os. 


The (V)PCMPEQB instruction compares the corresponding bytes in the destination and source operands; the 
(V)PCMPEQW instruction compares the corresponding words in the destination and source operands; and the 
(V)PCMPEQD instruction compares the corresponding doublewords in the destination and source operands. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand can be an MMX technology register. 


128-bit Legacy SSE version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM destination 
register remain unchanged. 


VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register 
are zeroed. 
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INSTRUCTION SET REFERENCE, M-U 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 

EVEX encoded VPCMPEQD: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand (first operand) is a mask register updated 
according to the writemask k2. 

EVEX encoded VPCMPEQB/W: The first source operand (second operand) is aZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand 
(first operand) is a mask register updated according to the writemask k2. 


Operation 


PCMPEQB (with 64-bit operands) 
IF DEST[7:0] = SRC[7:0] 
THEN DEST[7:0) := FFH; 
ELSE DEST[7:0] := O; Fl; 
(* Continue comparison of 2nd through 7th bytes in DEST and SRC *) 
IF DEST[63:56] = SRC[63:56] 
THEN DEST[63:56] := FFH; 
ELSE DEST[63:56] := 0; FI; 


COMPARE_BYTES_EQUAL (SRC1, SRC2) 
IF SRC1[7:0] = SRC2[7:0] 
THEN DEST[7:0] := FFH; 
ELSE DEST[7:0] := O; Fl; 
(* Continue comparison of 2nd through 15th bytes in SRC1 and SRC2 *) 
IF SRC1[127:120] = SRC2[127:120] 
THEN DEST[127:120] := FFH; 
ELSE DEST[127:120] := O; Fl; 


COMPARE_WORDS_EQUAL (SRC1, SRC2) 
IF SRC1[15:0] = SRC2[15:0] 
THEN DEST[15:0] := FFFFH; 
ELSE DEST[15:0] := 0; FI; 
(* Continue comparison of 2nd through 7th 16-bit words in SRC1 and SRC2 *) 
IF SRC1[127:112] = SRC2[127:112] 
THEN DEST[127:112] := FFFFH; 
ELSE DEST[127:112] := 0; FI; 


COMPARE_DWORDS_EQUAL (SRC1, SRC2) 
IF SRC1[31:0] = SRC2[31:0] 
THEN DEST[31:0] := FFFFFFFFH; 
ELSE DEST[31:0] := 0; FI; 
(* Continue comparison of 2nd through 3rd 32-bit dwords in SRC1 and SRC2 *) 
IF SRC1[127:96] = SRC2[127:96] 
THEN DEST[1 27:96] := FFFFFFFFH; 
ELSE DEST[127:96] := 0; Fl; 


PCMPEQB (with 128-bit operands) 
DEST[127:0] := COMPARE_BYTES_EQUAL(DEST[127:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 
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VPCMPEQB (VEX.128 encoded version) 
DEST[1 27:0] := COMPARE_BYTES_EQUAL(SRC1[127:0],SRC2[1 27:0]) 
DEST[MAXVL-1:128] := 0 


VPCMPEQB (VEX.256 encoded version) 
DEST[1 27:0] := COMPARE_BYTES_EQUAL(SRC1[127:0],SRC2[1 27:0]) 


DEST[255:128] := COMPARE_BYTES_EQUAL(SRC1[255:1 28],SRC2[255:1 28)) 


DEST[MAXVL-1:256] := 0 


VPCMPEQB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j := 0 TO KL-1 
i:=j*8 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
CMP := SRC1[i+7:i] == SRC2[i+7:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{[j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


PCMPEQW (with 64-bit operands) 
IF DEST[15:0] = SRC[15:0] 
THEN DEST[15:0] := FFFFH; 
ELSE DEST[1 5:0] := 0; FI; 
(* Continue comparison of 2nd and 3rd words in DEST and SRC *) 
IF DEST[63:48] = SRC[63:48] 
THEN DEST[63:48] := FFFFH; 
ELSE DEST[63:48] := O; Fl; 


PCMPEQW (with 128-bit operands) 
DEST[127:0] := COMPARE_WORDS_EQUAL(DEST[1 27:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 


VPCMPEQW (VEX.128 encoded version) 
DEST[127:0] := COMPARE_WORDS_EQUAL(SRC1[127:0],SRC2[1 27:0) 
DEST[MAXVL-1:128] := 0 


VPCMPEQW (VEX.256 encoded version) 
DEST[127:0] := COMPARE_WORDS_EQUAL(SRC1[127:0],SRC2[1 27:0) 


DEST[255:128] := COMPARE_WORDS_EQUAL(SRC1[255:128],SRC2[255:1 28]) 


DEST[MAXVL-1:256] := 0 
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VPCMPEQW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
CMP := SRC1[i+15:i] == SRC2[i+15:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


PCMPEQD (with 64-bit operands) 
IF DEST[31:0] = SRC[31:0] 
THEN DEST[31:0] := FFFFFFFFH; 
ELSE DEST[31:0] := 0; FI; 
IF DEST[63:32] = SRC[63:32] 
THEN DEST[63:32] := FFFFFFFFH; 
ELSE DEST[63:32] := 0; FI; 


PCMPEQD (with 128-bit operands) 
DEST[127:0] := COMPARE_DWORDS_EQUAL(DEST[127:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 


VPCMPEQD (VEX.128 encoded version) 
DEST[127:0] := COMPARE_DWORDS_EQUAL(SRC1[127:0],SRC2[1 27:0]) 
DEST[MAXVL-1:128] := 0 


VPCMPEQD (VEX.256 encoded version) 

DEST[127:0] := COMPARE_DWORDS_EQUAL(SRC1[127:0],SRC2[1 27:0]) 
DEST[255:128] := COMPARE_DWORDS_EQUAL(SRC1[255:128],SRC2[255:1 28)) 
DEST[MAXVL-1:256] := 0 


VPCMPEQD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN CMP := SRC1[i+31:i] = SRC2[3 1:0]; 
ELSE CMP := SRC1[i+31:i] = SRC2[i+31:i]; 


Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 
VPCMPEQB __mmask64 _mm512_cmpeq_epi8_mask(__m512i a,__m512ib); 


VPCMPEQB __mmask64 __mm512_mask_cmpeq_epi8_mask(__mmask64 k,___m512i a,__m512i b); 
VPCMPEQB __mmask32 _mm256_cmpeq_epi8_mask(__m256i a, __m256i b); 

VPCMPEQB __mmask32 _mm256_mask_cmpeq_epi8_mask(__mmask32 k,___ m256i a, ___m256i b); 
VPCMPEQB __mmask16 _mm_cmpeq_epi8_mask(__m128i a, ___m128i b); 

VPCMPEQB __mmask16 _mm_mask_cmpeq_epi8_mask(__mmask16 k,___m128i a,___m128i b); 
VPCMPEQW __mmask32 _mm512_cmpeq_epil16_mask(__m512i a,__m512i b); 

VPCMPEQW __mmask32 _mm512_mask_cmpeq_epil6_mask(__mmask32 k,___m512i a,__m512i b); 
VPCMPEQW __mmask16 _mm256_cmpeq_epi16_mask(__m256i a, __m256i b); 

VPCMPEQW __mmask16 _mm256_mask_cmpeq_epi16_mask(__mmask16 k, __m256i a, ___m256i b); 
VPCMPEQW __mmask8 _mm_cmpeq_epi16_mask(__m128i a,__m128i b); 

VPCMPEQW __mmask8 _mm_mask_cmpeq_epi16_mask(__mmask8 k, __m128i a,__m128i b); 
VPCMPEQD __mmask16 _mm512_cmpeq_epi32_mask(__m512ia,__m512i b); 

VPCMPEQD __mmask16 _mm512_mask_cmpeq_epi32_mask(__mmask16 k, __m512i a,__m512i b); 
VPCMPEQD __mmask8 _mm256_cmpeq_epi32_mask(__m256i a, __m256i b); 

VPCMPEQD __mmask8 _mm256_mask_cmpeq_epi32_mask(__mmask8 k, __ m256i a, ___m256i b); 


VPCMPEQD __mmask8 _mm_cmpeq_epi32_mask(__m128i a, ___m128i b); 

VPCMPEQD __mmask8 _mm_mask_cmpeq_epi32_mask(__mmask8 k, __m128i a,__m128i b); 
PCMPEQB: __m64_mm_cmpeq_pi8 (__m64 m1,__m64 m2) 

PCMPEQW: __m64_mm_cmpeq_pi16 (_m64 m1,__m64 m2) 

PCMPEQD: __m64 _mm_cmpeq_pi32 (__m64 m1,__m64 m2) 

(V)PCMPEQB: __m128i _mm_cmpeq_epi8 (__m128i a, __m128i b) 

(V)PCMPEQW: __m128i _mm_cmpeq_epi16 (__m128i a, ___m128i b) 


(V)PCMPEQD: __m128i __mm_cmpeq_epi32 (__m128i a, __m128i b) 

VPCMPEQB: m256i _mm256_cmpeq_epi8 (__m256i a,__ m256i b) 
VPCMPEQW: m256i_mm256_cmpeq_epi16 (__m256i a,__ m256i b) 
VPCMPEQD: m256i __mm256_cmpeq_epi32 (__m256i a,__m256i b) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPCMPEQD, see Table 2-49, “Type E4 Class Exception Conditions”. 


EVEX-encoded VPCMPEQB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

66 OF 38 29 /r A VIV SSE4_1 Compare packed qwords in xmm2/m128 and 

PCMPEQQ xmm1, xmm2/m128 xmm1 for equality. 

VEX.128.66.0F38.WIG 29 /r B VIV AVX Compare packed quadwords in xmm3/m128 

VPCMPEQQ xmm1, xmm2, xmm3/m128 and xmm2 for equality. 

VEX.256.66.0F38.WIG 29 /r B VIV AVX2 Compare packed quadwords in ymm3/m256 

VPCMPEQQ ymm7, ymm2, ymm3 /m256 and ymm2 for equality. 

EVEX.128.66.0F38.W1 29 /r C VIV AVX512VL | Compare Equal between int64 vector xmm2 

VPCMPEQQ k1 {k2}, xmm2, xmm3/m128/m64bcst AVX512F | and int64 vector xmm3/m128/m64bcst, and 
set vector mask k1 to reflect the zero/nonzero 
status of each element of the result, under 
writemask. 

EVEX.256.66.0F38.W1 29 /r C VIV AVX512VL | Compare Equal between int64 vector ymm2 

VPCMPEQQ k1 {k2}, ymm2, ymm3/m256/m64bcst AVX512F | and int64 vector ymnm3/m256/m64bcst, and 
set vector mask k1 to reflect the zero/nonzero 
status of each element of the result, under 
writemask. 

EVEX.512.66.0F38.W1 29 /r C VIV AVX512F | Compare Equal between int64 vector zmm2 

VPCMPEQQ k1 {k2}, zmm2, zmm3/m512/m64bcst and int64 vector zmm3/m512/m64bcst, and 
set vector mask k1 to reflect the zero/nonzero 
status of each element of the result, under 
writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an SIMD compare for equality of the packed quadwords in the destination operand (first operand) and the 
source operand (second operand). If a pair of data elements is equal, the corresponding data element in the desti- 
nation is set to all 1s; otherwise, it is set to Os. 


128-bit Legacy SSE version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM destination 
register remain unchanged. 


VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register 
are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


EVEX encoded VPCMPEQQ: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand (first operand) is a mask register updated 
according to the writemask k2. 
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Operation 


PCMPEQQ (with 128-bit operands) 


IF (DEST[63:0] = SRC[63:0]) 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := 0; Fl; 

IF (DEST[127:64] = SRC[127:64]) 

THEN DEST[127:64] := FFFFFFFFFFFFFEFFH; 
ELSE DEST[127:64] := 0; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


COMPARE_QWORDS_EQUAL (SRC1, SRC2) 
IF SRC1[63:0] = SRC2[63:0] 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := 0; Fl; 
IF SRC1[127:64] = SRC2[127:64] 
THEN DEST[127:64] := FFFFFFFFFFFFFFEFH; 
ELSE DEST[127:64] := 0; Fl; 


VPCMPEQQ (VEX.128 encoded version) 
DEST[127:0] := COMPARE_QWORDS_EQUAL(SRC1,SRC2) 
DEST[MAXVL-1:128] := 0 


VPCMPEQQ (VEX.256 encoded version) 

DEST[127:0] := COMPARE_QWORDS_EQUAL(SRC1[127:0],SRC2[1 27:0]) 
DEST[255:128] := COMPARE_QWORDS_EQUAL(SRC1[255:128],SRC2[255:1 28]) 
DEST[MAXVL-1:256] := 0 


VPCMPEQQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN CMP := SRC1[i+63:i] = SRC2[63:0); 
ELSE CMP := SRC1[i+63:i] = SRC2[i+63:i]; 


Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VPCMPEQQ __mmask8 __mm512_cmpeq_epi64_mask(__m512i a,__m512ib); 


VPCMPEQQ __mmask8 _mm512_mask_cmpeq_epi64_mask(__mmask8 k, __m512i a,__m512i b); 
VPCMPEQQ __mmask8 __mm256_cmpeq_epi64_mask(__m256i a, __m256i b); 

VPCMPEQQ __mmask8 _mm256_mask_cmpeq_epi64_mask(__mmask8 k, __m256i a, ___m256i b); 
VPCMPEQQ __mmask8 _mm_cmpeq_epi64_mask(__m128i a,__m128i b); 

VPCMPEQQ __mmask8 _mm_mask_cmpeq_epi64_mask(__mmask8 k,___m128i a,__m128i b); 
(V)PCMPEQQ: m128i _mm_cmpeq_epi64(__m128i a, __m128ib); 

VPCMPEQQ: m256i__mm256_cmpeq_epi64(__m256i a,__ m256i b); 

Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPCMPEQQ, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PCMPESTRI — Packed Compare Explicit Length Strings, Return Index 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A 61 /r imm8 RMI | V/V SSE4_2 Perform a packed comparison of string data 
PCMPESTRI xmm1, xmm2/m128, imm8 with explicit lengths, generating an index, and 
storing the result in ECX. 
VEX.128.66.0F3A 61 /r ib RMI | V/V AVX Perform a packed comparison of string data 
VPCMPESTRI xmm1, xmm2/m128, imm8 with explicit lengths, generating an index, and 
storing the result in ECX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r) ModRM:r/m (r) imm8 NA 
Description 


The instruction compares and processes data from two string fragments based on the encoded value in the Imm8 
Control Byte (see Section 4.1, “Imm8 Control Byte Operation for PCMPESTRI / PCMPESTRM / PCMPISTRI / PCMP- 
ISTRM”), and generates an index stored to the count register (ECX). 


Each string fragment is represented by two values. The first value is an xmm (or possibly m128 for the second 
operand) which contains the data elements of the string (byte or word data). The second value is stored in an input 
length register. The input length register is EAX/RAX (for xmm1) or EDX/RDX (for xmm2/m128). The length repre- 
sents the number of bytes/words which are valid for the respective xmm/m128 data. 


The length of each input is interpreted as being the absolute-value of the value in the length register. The absolute- 
value computation saturates to 16 (for bytes) and 8 (for words), based on the value of imm8[bit3] when the value 
in the length register is greater than 16 (8) or less than -16 (-8). 


The comparison and aggregation operations are performed according to the encoded value of Imm8 bit fields (see 
Section 4.1). The index of the first (or last, according to imm8[6]) set bit of IntRes2 (see Section 4.1.4) is returned 
in ECX. If no bits are set in IntRes2, ECX is set to 16 (8). 


Note that the Arithmetic Flags are written in a non-standard manner in order to supply the most relevant informa- 
tion: 


CFlag - Reset if IntRes2 is equal to zero, set otherwise 

ZFlag - Set if absolute-value of EDX is < 16 (8), reset otherwise 
SFlag - Set if absolute-value of EAX is < 16 (8), reset otherwise 
OFlag - IntRes2[0] 

AFlag - Reset 

PFlag - Reset 


Effective Operand Size 


Operating mode/size Operand 1 Operand 2 Length 1 Length 2 Result 
16 bit xmm xmm/m128 EAX EDX ECX 
32 bit xmm xmm/m128 EAX EDX ECX 
64 bit xmm xmm/m128 EAX EDX ECX 
64 bit + REX.W xmm xmm/m1 28 RAX RDX ECX 


Intel C/C++ Compiler Intrinsic Equivalent For Returning Index 


int _mm_cmpestri (__m128i a, int la,__m128i b, int Ib, const int mode); 
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Intel C/C++ Compiler Intrinsics For Reading EFlag Results 


int _mm_cmpestra (__m128i a, int la,__m128i, int Ib, const int mode); 


int _mm_cmpestrc (__m128i a, int la,__m128i b, int Ib, const int mode); 


int _mm_cmpestro (__m128i a, int la,__m128ib, int Ib, const int mode); 


int _mm_cmpestrs (__m128i a, int la, 


m128i b, int Ib, const int mode); 


( 
int _mm_cmpestrz (__m128i a, int la,__m128i b, int Ib, const int mode); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


INSTRUCTION SET REFERENCE, M-U 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally, this instruction does not cause #GP if the 


memory operand is not aligned to 16 Byte boundary, and: 
#UD If VEX.L = 1. 
If VEX.vvvv # 1111B. 
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PCMPESTRM — Packed Compare Explicit Length Strings, Return Mask 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A 60 /r imm8 RMI | V/V SSE4_2 Perform a packed comparison of string data 
PCMPESTRM xmm1, xmm2/m128, imm8 with explicit lengths, generating a mask, and 
storing the result in XMMO. 
VEX.128.66.0F3A 60 /r ib RMI | V/V AVX Perform a packed comparison of string data 
VPCMPESTRM xmm1, xmm2/m128, imm8 with explicit lengths, generating a mask, and 
storing the result in XMMO. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (r) ModRM:r/m (r) imm8 NA 
Description 


The instruction compares data from two string fragments based on the encoded value in the imm8 contol byte (see 
Section 4.1, “Imm8 Control Byte Operation for PCMPESTRI / PCMPESTRM / PCMPISTRI / PCMPISTRM”), and gener- 


ates a mask stored to XMMO. 


Each string fragment is represented by two values. The first value is an xmm (or possibly m128 for the second 
operand) which contains the data elements of the string (byte or word data). The second value is stored in an input 
length register. The input length register is EAX/RAX (for xmm1) or EDX/RDX (for xmm2/m128). The length repre- 
sents the number of bytes/words which are valid for the respective xmm/m128 data. 


The length of each input is interpreted as being the absolute-value of the value in the length register. The absolute- 
value computation saturates to 16 (for bytes) and 8 (for words), based on the value of imm8[bit3] when the value 
in the length register is greater than 16 (8) or less than -16 (-8). 


The comparison and aggregation operations are performed according to the encoded value of Imm8 bit fields (see 
Section 4.1). As defined by imm8[6], IntRes2 is then either stored to the least significant bits of XMMO (zero 
extended to 128 bits) or expanded into a byte/word-mask and then stored to XMMO. 


Note that the Arithmetic Flags are written in a non-standard manner in order to supply the most relevant informa- 


tion: 


CFlag - Reset if IntRes2 is equal to zero, set otherwise 
ZFlag - Set if absolute-value of EDX is < 16 (8), reset otherwise 
SFlag - Set if absolute-value of EAX is < 16 (8), reset otherwise 


OFlag -IntRes2[0] 
AFlag - Reset 
PFlag - Reset 


Note: In VEX.128 encoded versions, bits (MAXVL-1:128) of XMMO are zeroed. VEX.vvvv is reserved and must be 
1111b, VEX.L must be 0, otherwise the instruction will #UD. 
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Operating mode/size | Operand1 Operand 2 Length1 Length2 Result 
16 bit xmm xmm/m128 EAX EDX XMMO 
32 bit xmm xmm/m128 EAX EDX XMMO 
64 bit xmm xmm/m128 EAX EDX XMMO 
64 bit + REX.W xmm xmm/m128 RAX RDX XMMO 


Intel C/C++ Compiler Intrinsic Equivalent For Returning Mask 


__m128i__mm_cmpestrm (__m128i a, int la, 


Intel C/C++ Compiler Intrinsics For Reading EFlag Results 


int _mm_cmpestra (__m128i a, int la, 


int _mm_cmpestrc ( 


m128i b, int Ib, const int mode); 


m1 28i b, int Ib, const int mode); 


m128i a, int la,__m128i b, int Ib, const int mode); 


int _mm_cmpestro (__m128i a, int la,__m128ib, int Ib, const int mode); 


int _mm_cmpestrs ( 


( 
int _mm_cmpestrz ( 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


m128i a, int la, 


m1 28i b, int Ib, const int mode); 


m128i a, int la,__m128i b, int Ib, const int mode); 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally, this instruction does not cause #GP if the 


memory operand is not aligned to 16 Byte boundary, and: 
If VEX.L = 1. 
If VEX.vvvv # 1111B. 


#UD 
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PCMPGTB/PCMPGTW/PCMPGTD—Compare Packed Signed Integers for Greater Than 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 64 /r| A VIV MMX Compare packed signed byte integers in mm and 
PCMPGTB mm, mm/m64 mm/m64 for greater than. 
66 OF 64 /r A VV SSE2 Compare packed signed byte integers in xmm1 
PCMPGTB xmm1, xmm2/m128 and xmm2/m1 28 for greater than. 
NP OF 65 /r! A VIV MMX Compare packed signed word integers in mm and 
PCMPGTW mm, mm/m64 mm/m64 for greater than. 
66 OF 65 /r A VIN SSE2 Compare packed signed word integers in xmm1 
PCMPGTW xmm1, xmm2/m128 and xmm2/m1 28 for greater than. 
NP OF 66 /r A VIV MMX Compare packed signed doubleword integers in 
PCMPGTD mm, mm/m64 mm and mm/m64 for greater than. 
66 OF 66 /r A VIV SSE2 Compare packed signed doubleword integers in 
PCMPGTD xmm1, xmm2/m128 xmm1 and xmm2/m128 for greater than. 
VEX.128.66.0F.WIG 64 /r B VIV AVX Compare packed signed byte integers in xmm2 
VPCMPGTB xmm1, xmm2, xmm3/m128 and xmm3/m1 28 for greater than. 
VEX.128.66.0F.WIG 65 /r B VIV AVX Compare packed signed word integers in xmm2 
VPCMPGTW xmm1, xmm2, xmm3/m128 and xmm3/m1 28 for greater than. 
VEX.128.66.0F.WIG 66 /r B VIV AVX Compare packed signed doubleword integers in 
VPCMPGTD xmm1, xmm2, xmm3/m128 xmm_2 and xmm3/m128 for greater than. 
VEX.256.66.0F.WIG 64 /r B VIV AVX2 Compare packed signed byte integers in ynm2 
VPCMPGTB ymm1, ymm2, ymm3/m256 and ymm3/m256 for greater than. 
VEX.256.66.0F.WIG 65 /r B VV AVX2 Compare packed signed word integers in ynm2 
VPCMPGTW ymm1, ymm2, ymm3/m256 and ymm3/m256 for greater than. 
VEX.256.66.0F.WIG 66 /r B VIV AVX2 Compare packed signed doubleword integers in 
VPCMPGTD ymm1, ymm2, ymm3/m256 ymm2 and ymm3/m256 for greater than. 
EVEX.128.66.0F.WO 66 /r C VIV AVX512VL_ | Compare Greater between int32 vector xmm2 and 
VPCMPGTD k1 {k2}, xmm2, AVX512F int32 vector xmm3/m1 28/m32bcst, and set 
xmm3/m128/m32bcst vector mask k1 to reflect the zero/nonzero status 
of each element of the result, under writemask. 
EVEX.256.66.0F.WO 66 /r C VIV AVX512VL_ | Compare Greater between int32 vector ymm2 and 
VPCMPGTD k1 {k2}, ymm2, AVX512F int32 vector ymm3/m256/m32bcst, and set 
ymm3/m256/m32bcst vector mask k1 to reflect the zero/nonzero status 
of each element of the result, under writemask. 
EVEX.512.66.0F.WO 66 /r C VIV AVX512F Compare Greater between int32 elements in 
VPCMPGTD k1 {k2}, zmm2, zmme2 and zmm3/m512/m32bcst, and set 
zmm3/m51 2/m32bcst destination k1 according to the comparison results 
under writemask. k2. 
EVEX.128.66.0F.WIG 64 /r D VIV AVX512VL_ | Compare packed signed byte integers in xmm2 
VPCMPGTB k1 {k2}, xmm2, xmm3/m128 AVX512BW | and xmm3/m128 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 
EVEX.256.66.0F.WIG 64 /r D VIV AVX512VL_ | Compare packed signed byte integers in ymm2 
VPCMPGTB k1 {k2}, ymm2, ymm3/m256 AVX512BW | and ymm3/m256 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 
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EVEX.512.66.0F.WIG 64 /r D VN 
VPCMPGTB k1 {k2}, zmm2, zmm3/m512 


AVX512BW | Compare packed signed byte integers in zmm2 and 
zmm3/m512 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.128.66.0F.WIG 65 /r D VV 
VPCMPGTW k1 {k2}, xmm2, xmm3/m128 


AVX512VL_ | Compare packed signed word integers in xmm2 
AVX512BW | and xmm3/m128 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.256.66.0F.WIG 65 /r D |v 
VPCMPGTW k1 {k2}, ymm2, ymm3/m256 


AVX512VL_ | Compare packed signed word integers in ymm2 
AVX512BW | and ymm3/m256 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 


EVEX.512.66.0F.WIG 65 /r D VV 
VPCMPGTW k1 {k2}, zmm2, zmm3/m512 


AVX512BW | Compare packed signed word integers in zmm2 
and zmm3/m512 for greater than, and set vector 
mask k1 to reflect the zero/nonzero status of each 
element of the result, under writemask. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an SIMD signed compare for the greater value of the packed byte, word, or doubleword integers in the 
destination operand (first operand) and the source operand (second operand). If a data element in the destination 
operand is greater than the corresponding date element in the source operand, the corresponding data element in 
the destination operand is set to all 1s; otherwise, it is set to all Os. 


The PCMPGTB instruction compares the corresponding signed byte integers in the destination and source oper- 
ands; the PCMPGTW instruction compares the corresponding signed word integers in the destination and source 
operands; and the PCMPGTD instruction compares the corresponding signed doubleword integers in the destina- 
tion and source operands. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand can be an MMxX technology register. 


128-bit Legacy SSE version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source operand and destination operand are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 
destination register remain unchanged. 


VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source operand and destination operand are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 
register are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


PCMPGTB/PCMPGTW/PCMPGTD—Compare Packed Signed Integers for Greater Than Vol.2B 4-265 


INSTRUCTION SET REFERENCE, M-U 


EVEX encoded VPCMPGTD: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand (first operand) is a mask register updated 
according to the writemask k2. 

EVEX encoded VPCMPGTB/W: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand 
(first operand) is a mask register updated according to the writemask k2. 


Operation 


PCMPGTB (with 64-bit operands) 
IF DEST[7:0] > SRC[7:0] 
THEN DEST[7:0) := FFH; 
ELSE DEST[7:0] := 0; Fl; 
(* Continue comparison of 2nd through 7th bytes in DEST and SRC *) 
IF DEST[63:56] > SRC[63:56] 
THEN DEST[63:56] := FFH; 
ELSE DEST[63:56] := O; FI; 


COMPARE_BYTES_GREATER (SRC1, SRC2) 
IF SRC1[7:0] > SRC2[7:0] 
THEN DEST[7:0] := FFH; 
ELSE DEST[7:0] := 0; Fl; 
(* Continue comparison of 2nd through 15th bytes in SRC1 and SRC2 *) 
IF SRC1[127:120] > SRC2[127:1 20] 
THEN DEST[127:120] := FFH; 
ELSE DEST[127:120] := O; Fl; 


COMPARE_WORDS_GREATER (SRC1, SRC2) 
IF SRC1[15:0] > SRC2[15:0] 
THEN DEST[15:0] := FFFFH; 
ELSE DEST[1 5:0] := 0; FI; 
(* Continue comparison of 2nd through 7th 16-bit words in SRC1 and SRC2 *) 
IF SRC1[127:112] > SRC2[127:112] 
THEN DEST[127:112] := FFFFH; 
ELSE DEST[1 27:11 2] := 0; FI; 


COMPARE_DWORDS_GREATER (SRC1, SRC2) 
IF SRC1[31:0] > SRC2[31:0] 
THEN DEST[31:0] := FFFFFFFFH; 
ELSE DEST[31:0] := 0; FI; 
(* Continue comparison of 2nd through 3rd 32-bit dwords in SRC1 and SRC2 *) 
IF SRC1[127:96] > SRC2[1 27:96] 
THEN DEST[1 27:96] := FFFFFFFFH; 
ELSE DEST[127:96] := 0; FI; 


PCMPGTB (with 128-bit operands) 
DEST[127:0] := COMPARE_BYTES_GREATER(DEST[127:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 


VPCMPGTB (VEX.128 encoded version) 


DEST[127:0] := COMPARE_BYTES_GREATER(SRC1,SRC2) 
DEST[MAXVL-1:128] := 0 
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VPCMPGTB (VEX.256 encoded version) 

DEST[127:0] := COMPARE_BYTES_GREATER(SRC1[127:0],SRC2[127:0]) 
DEST[255:1 28] := COMPARE_BYTES_GREATER(SRC1[255:128],SRC2[255:128]) 
DEST[MAXVL-1:256] := 0 


VPCMPGTB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 


i:=j*8 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
CMP := SRC1[i+7:i] > SRC2[i+7:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 


PCMPGTW (with 64-bit operands) 
IF DEST[15:0] > SRC[15:0] 
THEN DEST[15:0] := FFFFH; 
ELSE DEST[15:0] := 0; FI; 
(* Continue comparison of 2nd and 3rd words in DEST and SRC *) 
IF DEST[63:48] > SRC[63:48] 
THEN DEST[63:48] := FFFFH; 
ELSE DEST[63:48] := 0; FI; 


PCMPGTW (with 128-bit operands) 
DEST[127:0] := COMPARE_WORDS_GREATER(DEST[1 27:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 


VPCMPGTW (VEX.128 encoded version) 
DEST[127:0] := COMPARE_WORDS_GREATER(SRC1,SRC2) 
DEST[MAXVL-1:128] := 0 


VPCMPGTW (VEX.256 encoded version) 

DEST[127:0] := COMPARE_WORDS_GREATER(SRC1[127:0],SRC2[1 27:0]) 
DEST[255:1 28] := COMPARE_WORDS_GREATER(SRC1[255:128],SRC2[255:128]) 
DEST[MAXVL-1:256] := 0 


VPCMPGTW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
CMP := SRC1[i+15:i] > SRC2[i+15:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
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ELSE DEST{[j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


PCMPGTD (with 64-bit operands) 
IF DEST[31:0] > SRC[31:0] 
THEN DEST[31:0] := FFFFFFFFH; 
ELSE DEST[31:0] := 0; FI; 
IF DEST[63:32] > SRC[63:32] 
THEN DEST[63:32] := FFFFFFFFH; 
ELSE DEST[63:32] := O; Fl; 


PCMPGTD (with 128-bit operands) 
DEST[127:0] := COMPARE_DWORDS_GREATER(DEST[127:0],SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 


VPCMPGTD (VEX.128 encoded version) 
DEST[127:0] := COMPARE_DWORDS_GREATER(SRC1,SRC2) 
DEST[MAXVL-1:128] := 0 


VPCMPGTD (VEX.256 encoded version) 

DEST[127:0] := COMPARE_DWORDS_GREATER(SRC1[127:0],SRC2[1 27:0]) 
DEST[255:128] := COMPARE_DWORDS_GREATER(SRC1[255:128],SRC2[255:128]) 
DEST[MAXVL-1:256] := 0 


VPCMPGTD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN CMP := SRC1[i+31:i] > SRC2[31:0]; 
ELSE CMP := SRC1[i+31:i] > SRC2[i+31:i]; 


Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 
VPCMPGTB __mmask64 _mm512_cmpgt_epi8_mask(__m512i a,__m512i b); 


VPCMPGTB __mmask64 __mm512_mask_cmpgt_epi8_mask(__mmask64 k,___m512i a,__m512ib); 
VPCMPGTB __mmask32 _mm256_cmpgt_epi8_mask(__m256i a, ___m256i b); 

VPCMPGTB __mmask32 _mm256_mask_cmpgt_epi8_mask(__mmask32 k,__ m256i a, __m256i b); 
VPCMPGTB __mmask16 _mm_cmpgt_epi8_mask(__m128i a, ___m128i b); 

VPCMPGTB __mmask16 _mm_mask_cmpgt_epi8_mask(__mmask16 k, __m128i a,__m128i b); 
VPCMPGTD __mmask16 _mm512_cmpgt_epi32_mask(__m512i a, ___m512i b); 

VPCMPGTD __mmask16 _mm512_mask_cmpgt_epi32_mask(__mmask16 k,___m512i a,__m512i b); 
VPCMPGTD __mmask8 _mm256_cmpgt_epi32_mask(__m256i a, __ m256i b); 

VPCMPGTD __mmask8 _mm256_mask_cmpgt_epi32_mask(__mmask8 k,___m256i a, __ m256i b); 


VPCMPGTD __mmask8 _mm_cmpgt_epi32_mask(__m128i a, ___m128i b); 
VPCMPGTD __mmask8 _mm_mask_cmpgt_epi32_mask(__mmask8 k, __m128i a, ___m128i b); 
VPCMPGTW __mmask32 _mm512_cmpgt_epi16_mask(__m512i a,__m512i b); 


VPCMPGTW __mmask32 _mm512_mask_cmpgt_epi16_mask(__mmask32 k,___m512i a,__m512i b); 
VPCMPGTW __mmask16 _mm256_cmpgt_epi16_mask(__m256i a, ___ m256i b); 
VPCMPGTW __mmask16 _mm256_mask_cmpgt_epi16_mask(__mmask16 k,___ m256i a, __m256i b); 


VPCMPGTW __mmask8 _mm_cmpgt_epi16_mask(__m128i a, __m128i b); 

VPCMPGTW __mmask8 _mm_mask_cmpgt_epi16_mask(__mmask8 k, __m128i a, __m128i b); 
PCMPGTB:__m64 _mm_cmpgt_pi8 (__m64 m1,___m64 m2) 

PCMPGTW:__m64 __mm_cmpgt_pi16 (__m64 m1,__m64 m2) 

PCMPGTD:__m64 _mm_cmpgt_pi32 (__m64 m1,__m64 m2) 

(V)PCMPGTB:__m128i _mm_cmpgt_epi8 (__m128i a,__m128i b) 

(V)PCMPGTW:__m128i _mm_cmpgt_epi16 (__m128i a,__m128i b) 

(V)DCMPGTD:__m128i __mm_cmpgt_epi32 (__m128i a, ___m128i b) 


VPCMPGTB: m256i_mm256_cmpgt_epi8 (__m256i a, ___ m256i b) 
VPCMPGTW: m256i_mm256_cmpgt_epi16 (__m256i a,___ m256i b) 
VPCMPGTD: m256i_mm256_cmpgt_epi32 (__m256i a,__ m256i b) 
Flags Affected 

None. 


Numeric Exceptions 


None. 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded VPCMPGTD, see Table 2-49, “Type E4 Class Exception Conditions”. 

EVEX-encoded VPCMPGTB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PCMPGTQ — Compare Packed Data for Greater Than 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 38 37 /r A VIV SSE4_2 Compare packed signed qwords in xmm2/m128 
PCMPGTQ xmm1,xmm2/m128 and xmm1 for greater than. 
VEX.128.66.0F38.WIG 37 /r B VIV AVX Compare packed signed qwords in xmm2 and 
VPCMPGTQ xmm1, xmm2, xmm3/m128 xmm3/m128 for greater than. 
VEX.256.66.0F38.WIG 37 /r B VIV AVX2 Compare packed signed qwords in ymm2 and 
VPCMPGTQ ymm1, ymm2, ymm3/m256 ymm3/m256 for greater than. 
EVEX.128.66.0F38.W1 37 /r C VIV AVX512VL | Compare Greater between int64 vector xmm2 and 
VPCMPGTQ k1 {k2}, xmm2, AVX512F | int64 vector xmm3/m128/m64bcst, and set 
xmm3/m128/m64bcst vector mask k1 to reflect the zero/nonzero status 
of each element of the result, under writemask. 
EVEX.256.66.0F38.W1 37 /r C VIN AVX512VL | Compare Greater between int64 vector ymm2 and 
VPCMPGTQ k1 {k2}, ymm2, AVX512F | int64 vector ymm3/m256/m64bcst, and set 
ymm3/m256/m64bcst vector mask k1 to reflect the zero/nonzero status 
of each element of the result, under writemask. 
EVEX.512.66.0F38.W1 37 /r C VIV AVX512F | Compare Greater between int64 vector zmm2 and 
VPCMPGTQ k1 {k2}, zmm2, zmm3/m512/m64bcst int64 vector zmm3/m512/m64bcst, and set 
vector mask k1 to reflect the zero/nonzero status 
of each element of the result, under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an SIMD signed compare for the packed quadwords in the destination operand (first operand) and the 
source operand (second operand). If the data element in the first (destination) operand is greater than the 
corresponding element in the second (source) operand, the corresponding data element in the destination is set 


to all 1s; otherwise, it is set to Os. 


128-bit Legacy SSE version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source operand and destination operand are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 


destination register remain unchanged. 


VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source operand and destination operand are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 


register are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


EVEX encoded VPCMPGTD/Q: The first source operand (second operand) is a ZMM/YMM/XMM register. The second 
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand (first operand) is a mask register updated 


according to the writemask k2. 
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Operation 

COMPARE_QWORDS_GREATER (SRC1, SRC2) 
IF SRC1[63:0] > SRC2[63:0] 
THEN DEST[63:0] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[63:0] := 0; Fl; 
IF SRC1[127:64] > SRC2[127:64] 
THEN DEST[127:64] := FFFFFFFFFFFFFFFFH; 
ELSE DEST[127:64] := 0; Fl; 


VPCMPGTQ (VEX.128 encoded version) 
DEST[127:0] := COMPARE_QWORDS_GREATER(SRC1,SRC2) 
DEST[MAXVL-1:128] := 0 


VPCMPGTQ (VEX.256 encoded version) 

DEST[127:0] := COMPARE_QWORDS_GREATER(SRC1[127:0],SRC2[1 27:0]) 
DEST[255:1 28] := COMPARE_QWORDS_GREATER(SRC1[255:128],SRC2[255:1 28]) 
DEST[MAXVL-1:256] := 0 


VPCMPGTQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k2[j] OR *no writemask* 
THEN 
/* signed comparison */ 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN CMP := SRC1[i+63:i] > SRC2[63:0]; 
ELSE CMP := SRC1[i+63:i] > SRC2[i+63:i]; 
Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPCMPGTQ __mmask8 __mm512_cmpgt_epi64_mask(__m512i a, 
VPCMPGTQ __mmask8 _mm512_mask_cmpgt_epi64_mask(__mmask8 k, 
VPCMPGTQ __mmask8 __mm256_cmpgt_epi64_mask(__m256i a, __ m256i b); 
VPCMPGTQ __mmask8 _mm256_mask_cmpgt_epi64_mask(__mmask8 k, 
VPCMPGTQ __mmask8 _mm_cmpgt_epi64_mask(__m128i a,__m128i b); 
VPCMPGTQ __mmask8 _mm_mask_cmpgt_epi64_mask(__mmask8 k, 


m512i b); 


(V)PCMPGTQ: m128i __mm_cmpgt_epi64(__m128i a, __m128i b) 
VPCMPGTQ: m256i_mm256_cmpgt_epi64(__m256i a, ___m256i b); 
Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None. 
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m512ia,__m512i b); 
m256i a, ___m256i b); 


m128i a,__m128i b); 
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Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPCMPGTQ, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PCMPISTRI — Packed Compare Implicit Length Strings, Return Index 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A 63 /r imm8 RM |V/V SSE4_2 Perform a packed comparison of string data 
PCMPISTRI xmm1, xmm2/m128, imm8 with implicit lengths, generating an index, and 
storing the result in ECX. 
VEX.128.66.0F3A.WIG 63 /r ib RM |V/V AVX Perform a packed comparison of string data 
VPCMPISTRI xmm1, xmm2/m128, imm8 with implicit lengths, generating an index, and 
storing the result in ECX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) imm8s NA 
Description 


The instruction compares data from two strings based on the encoded value in the Imm8 Control Byte (see Section 
4.1, “Imm8 Control Byte Operation for PCMPESTRI / PCMPESTRM / PCMPISTRI / PCMPISTRM”), and generates an 
index stored to ECX. 


Each string is represented by a single value. The value is an xmm (or possibly m128 for the second operand) which 
contains the data elements of the string (byte or word data). Each input byte/word is augmented with a 
valid/invalid tag. A byte/word is considered valid only if it has a lower index than the least significant null 
byte/word. (The least significant null byte/word is also considered invalid.) 


The comparison and aggregation operations are performed according to the encoded value of Imm8 bit fields (see 
Section 4.1). The index of the first (or last, according to imm8[6]) set bit of IntRes2 is returned in ECX. If no bits 
are set in IntRes2, ECX is set to 16 (8). 


Note that the Arithmetic Flags are written in a non-standard manner in order to supply the most relevant informa- 
tion: 


CFlag - Reset if IntRes2 is equal to zero, set otherwise 

ZFlag - Set if any byte/word of xmm2/mem1 28 is null, reset otherwise 
SFlag - Set if any byte/word of xmm1 is null, reset otherwise 

OFlag -IntRes2[0] 

AFlag - Reset 

PFlag - Reset 


Note: In VEX.128 encoded version, VEX.vvvv is reserved and must be 1111b, VEX.L must be 0, otherwise the 
instruction will #UD. 


Effective Operand Size 


Operating mode/size Operand1 Operand 2 Result 
16 bit xmm xmm/m128 ECX 
32 bit xmm xmm/m128 ECX 
64 bit xmm xmm/m128 ECX 


Intel C/C++ Compiler Intrinsic Equivalent For Returning Index 


int _mm_cmpistri (__m128i a, ___m128i b, const int mode); 
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Intel C/C++ Compiler Intrinsics For Reading EFlag Results 


int _mm_cmpistra (__m128i a, ___m128i b, const int mode); 
int _mm_cmpistrc (__m128i a,__m128i b, const int mode); 
int _mm_cmpistro (__m128i a,_m128ib, const int mode); 


int _mm_cmpistrs (__m128i a,__m128i b, const int mode); 


int _mm_cmpistrz (_m128i a,__m128i b, const int mode); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally, this instruction does not cause #GP if the 
memory operand is not aligned to 16 Byte boundary, and: 


#UD If VEX.L = 1. 
If VEX.vvvv # 1111B. 
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PCMPISTRM — Packed Compare Implicit Length Strings, Return Mask 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A 62 /r imm8 RM |V/V SSE4_2 Perform a packed comparison of string data 
PCMPISTRM xmm1, xmm2/m128, imm8 with implicit lengths, generating a mask, and 
storing the result in XMMO. 
VEX.128.66.0F3A.WIG 62 /r ib RM |V/V AVX Perform a packed comparison of string data 
VPCMPISTRM xmm1, xmm2/m128, imm8 with implicit lengths, generating a Mask, and 
storing the result in XMMO. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) imm8 NA 
Description 


The instruction compares data from two strings based on the encoded value in the imm§8 byte (see Section 4.1, 
“Imm8 Control Byte Operation for PCMPESTRI / PCMPESTRM / PCMPISTRI / PCMPISTRM”) generating a mask 
stored to XMMO. 


Each string is represented by a single value. The value is an xmm (or possibly m128 for the second operand) which 
contains the data elements of the string (byte or word data). Each input byte/word is augmented with a 
valid/invalid tag. A byte/word is considered valid only if it has a lower index than the least significant null 
byte/word. (The least significant null byte/word is also considered invalid.) 


The comparison and aggregation operation are performed according to the encoded value of Immé8 bit fields (see 
Section 4.1). As defined by imm8[6], IntRes2 is then either stored to the least significant bits of XMMO (zero 
extended to 128 bits) or expanded into a byte/word-mask and then stored to XMMO. 


Note that the Arithmetic Flags are written in a non-standard manner in order to supply the most relevant informa- 
tion: 


CFlag - Reset if IntRes2 is equal to zero, set otherwise 

ZFlag - Set if any byte/word of xmm2/mem128 is null, reset otherwise 
SFlag - Set if any byte/word of xmm1 is null, reset otherwise 

OFlag - IntRes2[0] 

AFlag - Reset 

PFlag - Reset 


Note: In VEX.128 encoded versions, bits (MAXVL-1:128) of XMMO are zeroed. VEX.vvvv is reserved and must be 
1111b, VEX.L must be 0, otherwise the instruction will #UD. 


Effective Operand Size 


Operating mode/size Operand1 Operand 2 Result 
16 bit xmm xmm/m128 XMMO 
32 bit xmm xmm/m128 XMMO 
64 bit xmm xmm/m128 XMMO 


Intel C/C++ Compiler Intrinsic Equivalent For Returning Mask 


__m128i_mm_cmpistrm (__m128i a,__m128i b, const int mode); 
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Intel C/C++ Compiler Intrinsics For Reading EFlag Results 


int _mm_cmpistra (__m128i a, ___m128i b, const int mode); 
int _mm_cmpistrc (__m128i a,__m128i b, const int mode); 
int _mm_cmpistro (__m128i a,_m128ib, const int mode); 


int _mm_cmpistrs (__m128i a,__m128i b, const int mode); 


int _mm_cmpistrz (_m128i a,__m128i b, const int mode); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally, this instruction does not cause #GP if the 
memory operand is not aligned to 16 Byte boundary, and: 


#UD If VEX.L = 1. 
If VEX.vvvv # 1111B. 
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PCONFIG — Platform Configuration 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
NP OF 01 C5 A VV PCONFIG This instruction is used to execute functions for 
PCONFIG configuring platform features. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA NA NA NA NA 
Description 


PCONFIG allows software to configure certain platform features. PCONFIG supports multiple leaf functions, with a 
leaf function identified by the value in EAX. The registers RBX, RCX, and RDX may provide input or output informa- 
tion for certain leaves. All leaves write status information to EAX but do not modify RBX, RCX, or RDX unless they 
are being used as leaf-specific output. 


Each PCONFIG leaf function applies to a specific hardware block called a PCONFIG target, and each PCONFIG target 
is associated with a numerical target identifier. Supported target identifiers are enumerated, along with other 
PCONFIG capabilities, in the sub-leaves of the PCONFIG-information leaf of CPUID (EAX = 1BH). An attempt to 
execute an undefined leaf function, or a leaf function that applies to an unsupported target identifier, results in a 
general-protection exception (#GP). (In the future, the PCONFIG-information leaf of CPUID may enumerate 
PCONFIG capabilities in addition to the supported target identifiers.) 


Addresses and operands are 32 bits outside 64-bit mode and are 64 bits in 64-bit mode. The value of CS.D does 
not affect operand size or address size. 


Table 4-15 shows the leaf encodings for PCONFIG, and Table 4-16 shows the leaf register usage for PCONFIG. 


Table 4-15. PCONFIG Leaf Encodings 


Leaf Encoding Description 

MKTME_KEY_PROGRAM OOO00000H This leaf is used to program the key and encryption mode associated 
with a KeylD. 

RESERVED 00000001H - FFFFFFFFH Reserved for future use (#GP(0) if used). 


Table 4-16. PCONFIG Leaf Register Usage 


Leaf RBX RCX RDX 
MKTME_KEY_PROGRAM Input only. Input only. Input only. 
RESERVED Reserved for future use. Reserved for future use. Reserved for future use. 


The MKTME_KEY_PROGRAM leaf of PCONFIG pertains to the MKTME! target, which has target identifier 1. It is used 
by software to manage the key associated with a KeyID. The leaf function is invoked by setting the leaf value of 0 
in EAX and the address of MKTME_KEY_PROGRAM_STRUCT in RBX. Successful execution of the leaf clears RAX (set 
to zero) and ZF, CF, PF, AF, OF, and SF are cleared. In case of failure, the failure reason is indicated in RAX with ZF 
set to 1 and CF, PF, AF, OF, and SF are cleared. The MKTME_KEY_PROGRAM leaf uses the 
MKTME_KEY_PROGRAM_STRUCT in memory shown in Table 4-17. 


1. Further details on MKTME usage can be found here: 
https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Total-Memory-Encryption-Spec.pdf 
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Table 4-17. MKTME_KEY_PROGRAM_STRUCT Format 


Field Offset (bytes) | Size (bytes) Comments 
KEYID 0 2 Key Identifier. 
KEYID_CTRL 2 4 KeylD control: 
* Bits [7:0]: COMMAND. 
* Bits [23:8]: ENC_ALG. 
« Bits [31:24]: Reserved, must be zero. 
RESERVED 6 58 Reserved, must be zero. 
KEY_FIELD_1 64 64 Software supplied KeylD data key or entropy for KeyID data key. 
KEY_FIELD_2 128 64 Software supplied KeyID tweak key or entropy for KeylD tweak key. 


A description of each of the fields in MKTME_KEY_PROGRAM_STRUCT is provided below: 


KEYID: Key Identifier being programmed to the MKTME engine. 


KEYID_CTRL: The KEYID_CTRL field carries two sub-fields used by software to control the behavior of a 
KeyID: Command and KeyID encryption algorithm. 


The command used controls the encryption mode for a KeyID. Table 4-18 provides a summary of the 
commands supported. 


Table 4-18. Supported Key Programming Commands 


Command Encoding Description 
KEYID_SET_KEY_DIRECT 0 Software uses this mode to directly program a key for use with KeyID. 
KEYID_SET_KEY_RANDOM 1 CPU generates and assigns an ephemeral key for use with a KeylD. Each time the 


instruction is executed, the CPU generates a new key using a hardware random 
number generator and the keys are discarded on reset. 


KEYID_CLEAR_KEY 2 Clear the (software programmed) key associated with the KeylD. On execution of this 
command, the KeylD gets TME behavior (encrypt with platform TME key or bypass 
TME encryption). 

KEYID_NO_ENCRYPT 3 Do not encrypt memory when this KeyID is in use. 


The encryption algorithm field (ENC_ALG) allows software to select one of the activated encryption algorithms 
for the KeyID. The BIOS can activate a set of algorithms to allow for use when programming keys using the 
IA32_TME_ACTIVATE MSR (does not apply to KeyID 0 which uses the TME policy when TME encryption is not 
bypassed). The processor checks to ensure that the algorithm selected by software is one of the algorithms 
that has been activated by the BIOS. 


KEY_FIELD_1s: This field carries the software supplied data key to be used for the KeyID if the direct key 
programming option is used (KEYID_SET_KEY_DIRECT). When the random key programming option is used 
(KEYID_SET_KEY_RANDOM), this field carries the software supplied entropy to be mixed in the CPU generated 
random data key. It is software's responsibility to ensure that the key supplied for the direct programming 
option or the entropy supplied for the random programming option does not result in weak keys. There are no 
explicit checks in the instruction to detect or prevent weak keys. When AES XTS-128 is used, the upper 48B are 
treated as reserved and must be zeroed out by software before executing the instruction. 


KEY_FIELD_2: This field carries the software supplied tweak key to be used for the KeyID if the direct key 
programming option is used (KEYID_SET_KEY_DIRECT). When the random key programming option is used 
(KEYID_SET_KEY_RANDOM), this field carries the software supplied entropy to be mixed in the CPU generated 
random tweak key. It is software's responsibility to ensure that the key supplied for the direct programming 
option or the entropy supplied for the random programming option does not result in weak keys. There are no 
explicit checks in the instruction to detect or prevent weak keys. When AES XTS-128 is used, the upper 48B are 
treated as reserved and must be zeroed out by software before executing the instruction. 


All KeyIDs default to TME behavior (encrypt with TME key or bypass encryption) on MKTME activation. 
Software can at any point decide to change the key for a KeyID using the PCONFIG instruction. Change of 
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keys for a KeyID does NOT change the state of the TLB caches or memory pipeline. It is software's responsi- 
bility to take appropriate actions to ensure correct behavior. 


Table 4-19 shows the return values associated with the MKTME_KEY_PROGRAM leaf of PCONFIG. On 
instruction execution, RAX is populated with the return value. 


Table 4-19. Supported Key Error Codes 


Return Value Encoding Description 

PROG_SUCCESS 0 KeylD was successfully programmed. 
INVALID_PROG_CMD 1 Invalid KeyID programming command. 
ENTROPY_ERROR 2 Insufficient entropy. 

INVALID_KEYID 3 KeylD not valid. 

INVALID_ENC_ALG 4 Invalid encryption algorithm chosen (not supported). 
DEVICE_BUSY 5 Failure to access key table. 


PCONFIG Virtualization 


Software in VMX root operation can control the execution of PCONFIG in VMX non-root operation using the 
following VM-execution controls introduced for PCONFIG: 


¢ PCONFIG_ENABLE: This control is a single bit control and enables the PCONFIG instruction in VMX non-root 
operation. If 0, the execution of PCONFIG in VMX non-root operation causes #UD. Otherwise, execution of 
PCONFIG works according to PCONFIG_EXITING. 


¢ PCONFIG_EXITING: This is a 64b control and allows VMX root operation to cause a VM-exit for various leaf 
functions of PCONFIG. This control does not have any effect if the PCONFIG_ENABLE control is clear. It is 
recommended that VMMs intercept execution of any PCONFIG leaves with which they are not familiar and 
convert such executions into #GP(0). 


PCONFIG Concurrency 


In a scenario where the MKTME_KEY_PROGRAM leaf of PCONFIG is executed concurrently on multiple logical 
processors, only one logical processor will succeed in updating the key table. PCONFIG execution will return with 
an error code (DEVICE_BUSY) on other logical processors and software must retry. In cases where the instruction 
execution fails with a DEVICE_BUSY error code, the key table is not updated, thereby ensuring that either the key 
table is updated in its entirety with the information for a KeyID, or it is not updated at all. In order to accomplish 
this, the MKTME_KEY_PROGRAM leaf of PCONFIG maintains a writer lock for updating the key table. This lock is 
referred to as the Key table lock and denoted in the instruction flows as KEY_TABLE_LOCK. The lock can either be 
unlocked, when no logical processor is holding the lock (also the initial state of the lock) or be in an exclusive state 
where a logical processor is trying to update the key table. There can be only one logical processor holding the lock 
in exclusive state. The lock, being exclusive, can only be acquired when the lock is in unlocked state. 


PCONFIG uses the following syntax to acquire KEY_TABLE_LOCK in exclusive mode and release the lock: 
e KEY_TABLE_LOCK.ACQUIRE(WRITE) 
e KEY_TABLE_LOCK.RELEASE() 


Operation 
Table 4-20. PCONFIG Operation Variables 
Variable Name Type Size Description 
(Bytes) 
TMP_KEY_PROGRAM_STRUCT | MKTME_KEY_PROGRAM_STRUCT | 192 Structure holding the key programming structure. 
TMP_RND_DATA_KEY UINT128 16 Random data key generated for random key 
programming option. 
TMP_RND_TWEAK_KEY UINT128 16 Random tweak key generated for random key 
programming option. 
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(* #UD if PCONFIG is not enumerated or CPL>O *) 
IF (CPUID.7.0:EDX[18] == 0 OR CPL > 0) #UD; 


IF (in VMX non-root mode) 


{ 
IF (VMCS.PCONFIG_ENABLE == 1) 


{ 
IF (EAX > 62 AND VMCS.PCONFIG_EXITING[63] ==1) OR 
(EAX < 63 AND VMCS.PCONFIG_EXITING[EAX] == 1)) 
{ 
Set VMCS.EXIT_REASON = PCONFIG; //No Exit qualification 
Deliver VMEXIT; 
} 
} 
ELSE 
{ 
#UD 
} 


(* #GP(0) for an unsupported leaf *) 
IF (EAX != 0) #GP(0) 


(* KEY_PROGRAM leaf flow *) 
IF (EAX == 0) 
{ 
(* #GP(O) if TME_ACTIVATE MSR is not locked or does not enable hardware encryption or multiple keys are not enabled *) 
IF (IA32_TME_ACTIVATE.LOCK != 1 OR IA32_TME_ACTIVATE.ENABLE != 1 OR IA32_TME_ACTIVATE.MK_TME_KEYID_BITS == 0) 
#GP(0) 


(* Check MKTME_KEY_PROGRAM_STRUCT is 256B aligned *) 
IF (DS:RBX is not 256B aligned) #GP(0); 


(* Check that MKTME_KEY_PROGRAM_STRUCT is read accessible *) 
<<DS: RBX should be read accessible>> 


(* Copy MKTME_KEY_PROGRAM_STRUCT to a temporary variable *) 
TMP_KEY_PROGRAM_STRUCT = DS:RBX.*; 


(* RSVD field check *) 
IF (TMP_KEY_PROGRAM_STRUCT.RSVD != 0) #GP(0); 


IF (TMP_KEY_PROGRAM_STRUCT.KEYID_CTRL.RSVD !=0) #GP(0); 

IF (TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_1.BYTES[63:16] != 0) #GP(0); 
IF (TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_2.BYTES[63:16] != 0) #GP(0); 
(* Check for a valid command *) 


IF (TMP_KEY_PROGRAM_STRUCT. KEYID_CTRL.COMMAND is not a valid command) 


i 
RFLAGS.ZF = 1; 
RAX = INVALID_PROG_CMD; 
goto EXIT; 
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} 
(* Check that the KEYID being operated upon is a valid KEYID *) 
IF (TMP_KEY_PROGRAM_STRUCT.KEYID > 
2°1A32_TME_ACTIVATEMK_TME_KEYID_BITS - 1 
OR TMP_KEY_PROGRAM_STRUCT.KEYID > 
IA32_TME_CAPABILITY.MK_TME_MAX_KEYS 
OR TMP_KEY_PROGRAM_STRUCT.KEYID == 0) 


RFLAGS.ZF = 1; 
RAX = INVALID_KEYID; 
goto EXIT; 

} 


(* Check that only one algorithm is requested for the KeylD and it is one of the activated algorithms *) 
IF (NUM_BITS(TMP_KEY_PROGRAM_STRUCT.KEYID_CTRL.ENC_ALG) != 1 || 
(TMP_KEY_PROGRAM_STRUCT.KEYID_CTRL.ENC_ALG & 
IA32_TME_ACTIVATE. MK_TME_CRYPTO_ALGS == 0)) 


RFLAGS.ZF = 1; 
RAX = INVALID_ENC_ALG; 
goto EXIT; 
} 
(* Try to acquire exclusive lock *) 
IF (NOT KEY_TABLE_LOCK.ACQUIRE(WRITE)) 
{ 
//PCONFIG failure 
RFLAGS.ZF = 1; 
RAX = DEVICE_BUSY; 
goto EXIT; 
} 


(* Lock is acquired and key table will be updated as per the command 
Before this point no changes to the key table are made *) 


switch(TMP_KEY_PROGRAM_STRUCT.KEYID_CTRL.COMMAND) 
{ 
case KEYID_SET_KEY_DIRECT: 
<<Write 
DATA_KEY=TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_1, 
TWEAK_KEY=TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_2, 
ENCRYPTION_MODE=ENCRYPT_WITH_KEYID_KEY, 
to MKTME Key table at index TMP_KEY_PROGRAM_STRUCT.KEYID 
>> 


break; 


case KEYID_SET_KEY_RANDOM: 
TMP_RND_DATA_KEY = <<Generate a random key using hardware RNG>> 
IF (NOT ENOUGH ENTROPY) 
{ 
RFLAGS.ZF = 1; 
RAX = ENTROPY_ERROR; 
goto EXIT; 
} 
TMP_RND_TWEAK_KEY = <<Generate a random key using hardware RNG>> 
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IF (NOT ENOUGH ENTROPY) 

{ 
RFLAGS.ZF = 1; 
RAX = ENTROPY_ERROR; 
goto EXIT; 

} 


(* Mix user supplied entropy to the data key and tweak key *) 

TMP_RND_DATA_KEY = TMP_RND_KEY XOR 
TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_1.BYTES[1 5:0]; 

TMP_RND_TWEAK_KEY = TMP_RND_TWEAK_KEY XOR 
TMP_KEY_PROGRAM_STRUCT.KEY_FIELD_2.BYTES[1 5:0]; 


<<Write 
DATA_KEY=TMP_RND_DATA_KEY, 
TWEAK_KEY=TMP_RND_TWEAK_KEY, 
ENCRYPTION_MODE=ENCRYPT_WITH_KEYID_KEY, 
to MKTME_KEY_TABLE at index TMP_KEY_PROGRAM_STRUCT.KEYID 
>> 


break; 


case KEYID_CLEAR_KEY: 
<<Write 
DATA_KEY='0, 
TWEAK_KEY='0, 
ENCRYPTION_MODE = ENCRYPT_WITH_TME_KEY_OR_BYPASS, 


to MKTME_KEY_TABLE at index TMP_KEY_PROGRAM_STRUCT.KEYID 
>»> 


break; 
case KD_NO_ENCRYPT: 
<<Write 
ENCRYPTION_MODE=NO_ENCRYPTION, 
to MKTME_KEY_TABLE at index TMP_KEY_PROGRAM_STRUCT.KEYID 
>> 
break; 


} 


RAX = 0; 
RFLAGS.ZF = 0; 


//Release Lock 
KEY_TABLE_LOCK(RELEASE); 


EXIT: 

RFLAGS.CF=0; 
RFLAGS.PF=0; 
RFLAGS.AF=0; 
RFLAGS.OF=0; 
RFLAGS.SF=0; 


} 


end_of_flow 
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Protected Mode Exceptions 
#GP(0) If input value in EAX encodes an unsupported leaf. 
If IA32_TME_ACTIVATE MSR is not locked. 
If hardware encryption and MKTME capability are not enabled in IA32_TME_ACTIVATE MSR. 
If the memory operand is not 256B aligned. 
If any of the reserved bits in MKTME_KEY_PROGRAM_STRUCT are set. 
If a memory operand effective address is outside the DS segment limit. 
#PF(fault-code) If a page fault occurs in accessing memory operands. 
#UD If any of the LOCK/REP/OSIZE/VEX prefixes are used. 
If current privilege level is not 0. 
If CPUID.7.0:EDX[bit 18] = 0 
If in VMX non-root mode and VMCS.PCONFIG_ENABLE = 0. 


Real-Address Mode Exceptions 
#GP If input value in EAX encodes an unsupported leaf. 
If IA32_TME_ACTIVATE MSR is not locked. 
If hardware encryption and MKTME capability are not enabled in IA32_TME_ACTIVATE MSR. 
If a memory operand is not 256B aligned. 
If any of the reserved bits in MKTME_KEY_PROGRAM_STRUCT are set. 
#UD If any of the LOCK/REP/OSIZE/VEX prefixes are used. 
If current privilege level is not 0. 
If CPUID.7.0:EDX.PCONFIG[bit 18] = 0 
If in VMX non-root mode and VMCS.PCONFIG_ENABLE = 0. 


Virtual-8086 Mode Exceptions 
#UD PCONFIG instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(0) If input value in EAX encodes an unsupported leaf. 
If IA32_TME_ACTIVATE MSR is not locked. 
If hardware encryption and MKTME capability are not enabled in IA32_TME_ACTIVATE MSR. 
If a memory operand is not 256B aligned. 
If any of the reserved bits in MKTME_KEY_PROGRAM_STRUCT are set. 
If a memory operand is non-canonical form. 
#PF(fault-code) If a page fault occurs in accessing memory operands. 
#UD If any of the LOCK/REP/OSIZE/VEX prefixes are used. 
If the current privilege level is not 0. 
If CPUID.7.0:EDX.PCONFIG[bit 18] = 0. 
If in VMX non-root mode and VMCS.PCONFIG_ENABLE = 0. 
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PDEP — Parallel Bits Deposit 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode Flag 
VEX.LZ.F2.0F38.W0 F5 /r RVM | V/V BMI2 Parallel deposit of bits from r32b using mask in r/m32, result is writ- 
PDEP r32a, r32b, r/m32 ten to 32a. 
VEX.LZ.F2.0F38.W1 F5 /r RVM | V/N.E. BMI2 Parallel deposit of bits from r64b using mask in r/m64, result is writ- 
PDEP r64a, r64b, r/m64 ten to r64a. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


PDEP uses a mask in the second source operand (the third operand) to transfer/scatter contiguous low order bits in 
the first source operand (the second operand) into the destination (the first operand). PDEP takes the low bits from 
the first source operand and deposit them in the destination operand at the corresponding bit locations that are set 
in the second source operand (mask). All other bits (bits not set in mask) in destination are set to zero. 


SRCH. || Ss1/S3q S2qS2a|S27 - ——- | §7| S6|Ss | S| S3 
SRC2 
1 
(mask) 0 0/0 0 0 
pest [ 0] 0/0 /s3| 0] -_—-J[s,] 0] S,)0] 0 
bit 31 ~~“ bit 0 


Figure 4-8. PDEP Example 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 


TEMP := SRC1; 

MASK := SRC2; 

DEST :=0; 

m:=0,k:=0; 

DO WHILE m < OperandSize 


IF MASK[ m] = 1 THEN 
DEST[ m] := TEMP[ kj; 
k:=k+ 1; 
Fl 
m:=m-+ 1; 
OD 
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Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
PDEP: unsigned __int32 _pdep_u32(unsigned __int32 src, unsigned __int32 mask); 
PDEP: unsigned __int64_pdep_u64(unsigned __int64 src, unsigned __int32 mask); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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PEXT — Parallel Bits Extract 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode | Flag 
VEX.LZ.F3.0F38.W0 F5 /r RVM | V/V BMI2 Parallel extract of bits from r32b using mask in r/m32, result is writ- 
PEXT r32a, r32b, r/m32 ten to r32a. 
VEX.LZ.F3.0F38.W1 F5 /r RVM | V/N.E. | BMI2 Parallel extract of bits from r64b using mask in r/m64, result is writ- 
PEXT r64a, r64b, r/m64 ten to r64a. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


PEXT uses a mask in the second source operand (the third operand) to transfer either contiguous or non-contig- 
uous bits in the first source operand (the second operand) to contiguous low order bit positions in the destination 
(the first operand). For each bit set in the MASK, PEXT extracts the corresponding bits from the first source operand 
and writes them into contiguous lower bits of destination operand. The remaining upper bits of destination are 


zeroed. 


SRCT | S31]S30] S2fS2e|S27] - — — - | $7] S6[Ss | Sa 


SRC2 

(mask) e Q 

DEST |0 0 
bit 31 ~# 


S3 


So 


Figure 4-9. PEXT Example 


0; 0 
Ss S2 
bit 0 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 
to execute this instruction with VEX.L not equal to 0 will cause #UD. 
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Operation 


TEMP := SRC1; 

MASK := SRC2; 

DEST := 0; 

m:=0,k:=0; 

DO WHILE m < OperandSize 


IF MASK[ m] = 1 THEN 
DEST[ k] := TEMP[ mj]; 
k:=k+ 1; 

Fl 

m:=m-+ 1; 


OD 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
PEXT: unsigned __int32 _pext_u32(unsigned __int32 src, unsigned __int32 mask); 
PEXT: unsigned __int64_pext_u64(unsigned __int64 src, unsigned __int32 mask); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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PEXTRB/PEXTRD/PEXTRQ — Extract Byte/Dword/Qword 


Opcode/ Op/En | 64/32 bit | CPUID Description 
Instruction Mode Feature 
Support | Flag 

66 OF 3A 14 A VIV SSE4_1 Extract a byte integer value from xmm2 at the 

/r ib source byte offset specified by imm8 into reg or 

PEXTRB reg/m8, xmm2, imm8 m8. The upper bits of r32 or r64 are zeroed. 

66 OF 3A 16 A VIV SSE4_1 Extract a dword integer value from xmm2 at the 

/r ib source dword offset specified by imm8 into r/m32. 

PEXTRD r/m32, xmm2, imm8 

66 REX.W OF 3A 16 A V/N.E. SSE4_1 Extract a qword integer value from xmm2 at the 

/r ib source qword offset specified by imm8 into r/m64. 

PEXTRQ r/m64, xmm2, imm8 

VEX.128.66.0F3A.WO 14 /r ib A VIN AVX Extract a byte integer value from xmmZ2 at the 

VPEXTRB reg/m8, xmm2, imm8 source byte offset specified by imm8 into reg or 
m8. The upper bits of r64/r32 is filled with zeros. 

VEX.128.66.0F3A.WO 16 /r ib A VV AVX Extract a dword integer value from xmm2 at the 

VPEXTRD r32/m32, xmm2, imm8 source dword offset specified by imm8 into 
r32/m32. 

VEX.128.66.0F3A.W1 16 /r ib A vile AVX Extract a qword integer value from xmm2 at the 

VPEXTRQ r64/m64, xmm2, imm8 source dword offset specified by immé8 into 
r64/m64. 

EVEX.128.66.0F3A.WIG 14 /r ib B VV AVX512BW | Extract a byte integer value from xmm2 at the 

VPEXTRB reg/m8, xmm2, imm8 source byte offset specified by imm8 into reg or 
m8. The upper bits of r64/r32 is filled with zeros. 

EVEX.128.66.0F3A.WO 16 /r ib B VV AVX512DQ | Extract a dword integer value from xmm_2 at the 

VPEXTRD r32/m32, xmm2, imm8 source dword offset specified by imm8 into 
r32/m32. 

EVEX.128.66.0F3A.W1 16 /r ib B VINE? AVX512DQ | Extract a qword integer value from xmm_2 at the 

VPEXTRQ r64/m64, xmm_2, imm8 source dword offset specified by imm8 into 
r64/m64. 


NOTES: 


1. In 64-bit mode, VEX.W11 is ignored for VPEXTRB (similar to legacy REX.W=1 prefix in PEXTRB). 
2. VEX.W/EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) imm8 NA 
B Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) imm8 NA 
Description 


Extract a byte/dword/qword integer value from the source XMM register at a byte/dword/qword offset determined 
from imm8[3:0]. The destination can be a register or byte/dword/qword memory location. If the destination is a 
register, the upper bits of the register are zero extended. 


In legacy non-VEX encoded version and if the destination operand is a register, the default operand size in 64-bit 
mode for PEXTRB/PEXTRD is 64 bits, the bits above the least significant byte/dword data are filled with zeros. 
PEXTRQ is not encodable in non-64-bit modes and requires REX.W in 64-bit mode. 


Note: In VEX.128 encoded versions, VEX.vvvv is reserved and must be 1111b, VEX.L must be 0, otherwise the 
instruction will #UD. In EVEX.128 encoded versions, EVEX.vvvv is reserved and must be 1111b, EVEX.L”L must be 
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0, otherwise the instruction will #UD. If the destination operand is a register, the default operand size in 64-bit 
mode for VPEXTRB/VPEXTRD is 64 bits, the bits above the least significant byte/word/dword data are filled with 
zeros. 


Operation 


CASE of 
PEXTRB: SEL := COUNT[3:0]; 
TEMP := (Src >> SEL*8) AND FFH; 
IF (DEST = Mem8) 
THEN 
Memé := TEMP[7:0]; 
ELSE IF (64-Bit Mode and 64-bit register selected) 
THEN 
R64[7:0] := TEMP[7:0]; 
r64[63:8] := ZERO_FILL; }; 
ELSE 
R32[7:0] := TEMP[7:0]; 
r32[31:8] := ZERO_FILL; }; 
Fl; 
PEXTRD:SEL := COUNT[1:0]; 
TEMP := (Src >> SEL*32) AND FFFF_FFFFH; 
DEST := TEMP; 
PEXTRQ: SEL := COUNT[O]; 
TEMP := (Src >> SEL*64); 
DEST := TEMP; 
EASC: 


VPEXTRTD/VPEXTRQ 
IF (64-Bit Mode and 64-bit dest operand) 
THEN 
Src_Offset := Imm8[0] 
164/m64 := (Src >> Src_Offset * 64) 
ELSE 
Src_Offset := Imm8[1:0] 
r32/m32 := ((Src >> Src_Offset *32) AND OFFFFFFFFh); 
Fl 


VPEXTRB ( dest=m8) 
SRC_Offset := Imm8[3:0] 
Mem® := (Src >> Src_Offset*8) 


VPEXTRB ( dest=reg) 

IF (64-Bit Mode ) 

THEN 
SRC_Offset := Imm8[3:0] 
DEST[7:0] := (Src >> Src_Offset*8) AND OFFh) 
DEST[63:8] := ZERO_FILL; 

ELSE 
SRC_Offset := Imm8[3:0]; 
DEST[7:0] := (Src >> Src_Offset*8) AND OFFh); 
DEST[31:8] := ZERO_FILL; 

Fl 
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Intel C/C++ Compiler Intrinsic Equivalent 


PEXTRB: int __mm_extract_epi8 (__m128i src, const int ndx); 
PEXTRD: int__mm_extract_epi32 (__m128i src, const int ndx); 
PEXTRQ: int64 __mm_extract_epi64 (__m128i src, const int ndx); 
Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-57, “Type EONF Class Exception Conditions”. 
Additionally: 
#UD If VEX.L = 1 or EVEX.L’L > O. 

If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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Opcode/ Op/ En | 64/32 bit | CPUID Description 
Instruction Mode Feature 
Support | Flag 

NP OF C5 /rib! A VIN SSE Extract the word specified by imm8 from mm 

PEXTRW reg, mm, imm8 and move it to reg, bits 15-0. The upper bits of 
r32 or r64 is zeroed. 

66 OF C5 /rib A VIV SSE2 Extract the word specified by imm8 from xmm 

PEXTRW reg, xmm, imm8 and move it to reg, bits 15-0. The upper bits of 
r32 or r64 is zeroed. 

66 OF 3A 15 B VIV SSE4_1 Extract the word specified by imm8 from xmm 

/r ib and copy it to lowest 16 bits of reg or m16. 

PEXTRW reg/m16, xmm, imm8 Zero-extend the result in the destination, r32 
or 164. 

VEX.128.66.0F.WO C5 /r ib A ve AVX Extract the word specified by imm8 from 

VPEXTRW reg, xmm1, imm8 xmm1 and move it to reg, bits 15:0. Zero- 
extend the result. The upper bits of r64/r32 is 
filled with zeros. 

VEX.128.66.0F3A.WO 15 /r ib B VIV AVX Extract a word integer value from xmm2 at the 

VPEXTRW reg/m16, xmm2, imm8 source word offset specified by imm8 into reg 
or m176. The upper bits of r64/r32 is filled with 
zeros. 

EVEX.128.66.0F.WIG C5 /r ib A VIV AVX512B | Extract the word specified by imm8 from xmm1 

VPEXTRW reg, xmm1, imm8 W and move it to reg, bits 15:0. Zero-extend the 
result. The upper bits of r64/r32 is filled with 
zeros. 

EVEX.128.66.0F3A.WIG 15 /r ib C VIV AVX512B | Extract a word integer value from xmm_z at the 

VPEXTRW reg/m16, xmm_z, imm8 W source word offset specified by immé8 into reg 
or m16. The upper bits of r64/r32 is filled with 
zeros. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


2. In 64-bit mode, VEX.W1 is ignored for VPEXTRW (similar to legacy REX.W=1 prefix in PEXTRW). 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B NA ModRM:r/m (w) ModRM:reg (r) imm8 NA 
C Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) imm8 NA 
Description 


Copies the word in the source operand (second operand) specified by the count operand (third operand) to the 
destination operand (first operand). The source operand can be an MMX technology register or an XMM register. 


The destination operand can be the low word of a general-purpose register or a 16-bit memory address. The count 
operand is an 8-bit immediate. When specifying a word location in an MMX technology register, the 2 least-signifi- 
cant bits of the count operand specify the location; for an XMM register, the 3 least-significant bits specify the loca- 
tion. The content of the destination register above bit 16 is cleared (set to all Os). 
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In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15, R8-15). If the destination operand is a general-purpose register, the default operand size is 64-bits 
in 64-bit mode. 


Note: In VEX.128 encoded versions, VEX.vvvv is reserved and must be 1111b, VEX.L must be 0, otherwise the 
instruction will #UD. In EVEX.128 encoded versions, EVEX.vvvv is reserved and must be 1111b, EVEX.L must be 0, 
otherwise the instruction will #UD. If the destination operand is a register, the default operand size in 64-bit mode 
for VPEXTRW is 64 bits, the bits above the least significant byte/word/dword data are filled with zeros. 


Operation 


IF (DEST = Mem16) 
THEN 


ELSE IF (64-Bit Mode and destination is a general-purpose register) 


Fl; 


SEL := COUNT[2:0]; 
TEMP := (Src >> SEL*16) AND FFFFH; 
Mem16 := TEMP[15:0]; 


THEN 
FOR (PEXTRW instruction with 64-bit source operand) 
{ SEL := COUNT[1:0]; 
TEMP := (SRC >> (SEL * 16)) AND FFFFH; 
r64[15:0] := TEMP[15:0]; 
r64[63:16] := ZERO_FILL,; }; 
FOR (PEXTRW instruction with 128-bit source operand) 
{ SEL := COUNT[2:0]; 
TEMP := (SRC >> (SEL * 16)) AND FFFFH; 
r64[15:0] := TEMP[15:0); 
r64[63:16] := ZERO_FILL; } 
ELSE 
FOR (PEXTRW instruction with 64-bit source operand) 
{ S€L:= COUNT[1:0]; 
TEMP := (SRC >> (SEL * 16)) AND FFFFH; 
r32[15:0] := TEMP[15:0]; 
r32[31:16] := ZERO_FILL; }; 
FOR (PEXTRW instruction with 128-bit source operand) 
{ SEL:= COUNT[2:0]; 
TEMP := (SRC >> (SEL * 16)) AND FFFFH; 
r32[15:0] := TEMP[15:0); 
r32[31:16] := ZERO_FILL; }; 
Fl; 


VPEXTRW ( dest=m16) 
SRC_Offset := Imm8[2:0] 
Mem16 := (Src >> Src_Offset*16) 
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VPEXTRW ( dest=reg) 

IF (64-Bit Mode ) 

THEN 
SRC_Offset := Imm8[2:0] 
DEST[15:0] := ((Src >> Src_Offset*16) AND OFFFFh) 
DEST[63:16] := ZERO_FILL; 

ELSE 
SRC_Offset := Imm8[2:0] 
DEST[15:0] := ((Src >> Src_Offset*16) AND OFFFFh) 
DEST[31:16] := ZERO_FILL; 

Fl 


Intel C/C++ Compiler Intrinsic Equivalent 
PEXTRW: int __mm_extract_pi16 (__m64 a, int n) 


PEXTRW: int__mm_extract_epi16 (__m128i a, int imm) 
Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
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Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
Additionally: 
#UD If VEX.L = 1 or EVEX.LL > O. 

If VEX.vvvv != 1111B or EVEX.vvwv != 1111B. 
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PHADDW/PHADDD — Packed Horizontal Add 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 01 /r! RM |V/V SSSE3 Add 16-bit integers horizontally, pack to mm7. 
PHADDW mm1, mm2/m64 
66 OF 38 01 /r RM |V/V SSSE3 Add 16-bit integers horizontally, pack to 
PHADDW xmm1, xmm2/m128 xmm1, 
NP OF 38 O2 /r RM |V/V SSSE3 Add 32-bit integers horizontally, pack to mm. 
PHADDD mm1, mm2/m64 
66 OF 38 O02 /r RM |V/V SSSE3 Add 32-bit integers horizontally, pack to 
PHADDD xmm1, xmm2/m128 xmm1. 
VEX.128.66.0F38.WIG 01 /r RVM | V/V AVX Add 16-bit integers horizontally, pack to 
VPHADDW xmm1, xmm2, xmm3/m128 xmm1. 
VEX.128.66.0F38.WIG O2 /r RVM | V/V AVX Add 32-bit integers horizontally, pack to 
VPHADDD xmm1, xmm2, xmm3/m128 xmm1. 
VEX.256.66.0F38.WIG 01 /r RVM | V/V AVX2 Add 16-bit signed integers horizontally, pack 
VPHADDW ymm1, ymm2, ymm3/m256 to ymm1. 

[VEX.256.66.0F38.WIGO2/F = =—Ssté<i«s=‘i=‘:;*«WC RM ST AVX2._~_—_=«S| Add 32-bit signed integers horizontally, pack | 
VPHADDD ymm1, ymm2, ymm3/m256 to ymm1. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


(V)PHADDW adds two adjacent 16-bit signed integers horizontally from the source and destination operands and 
packs the 16-bit signed results to the destination operand (first operand). (V)PHADDD adds two adjacent 32-bit 
signed integers horizontally from the source and destination operands and packs the 32-bit signed results to the 
destination operand (first operand). When the source operand is a 128-bit memory operand, the operand must be 
aligned on a 16-byte boundary or a general-protection exception (#GP) will be generated. 


Note that these instructions can operate on either unsigned or signed (two’s complement notation) integers; 
however, it does not set bits in the EFLAGS register to indicate overflow and/or a carry. To prevent undetected over- 
flow conditions, software must control the ranges of the values operated on. 


Legacy SSE instructions: Both operands can be MMX registers. The second source operand can be an MMxX register 
or a 64-bit memory location. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand can be an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM 
destination register remain unchanged. 


In 64-bit mode, use the REX prefix to access additional registers. 
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VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand can be an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM 
register are zeroed. 


VEX.256 encoded version: Horizontal addition of two adjacent data elements of the low 16-bytes of the first and 
second source operands are packed into the low 16-bytes of the destination operand. Horizontal addition of two 
adjacent data elements of the high 16-bytes of the first and second source operands are packed into the high 16- 
bytes of the destination operand. The first source and destination operands are YMM registers. The second source 
operand can be an YMM register or a 256-bit memory location. 


SRC2! Y7 | Y6 Y2 \ YO X7 | X6 | X5] X4] X3 X0 | SRC1 


VV V \ VV \ 
ARSED, Li 


Dest 


Figure 4-10. 256-bit VPHADDD Instruction Operation 


Operation 


PHADDW (with 64-bit operands) 
mm1[15-0] = mm1[31-16] + mm1[15-0]; 
mm1[31-16] = mm1[63-48] + mm1[47-32]; 
mm1[47-32] = mm2/m64[31-16] + mm2/m64[15-0]; 
mm1[63-48] = mm2/m64[63-48] + mm2/m64[47-32]; 


PHADDW (with 128-bit operands) 
xmm1[15-0] = xmm1[31-16] + xmm1[15-0]; 
xmm1[31-16] = xmm1[63-48] + xmm1[47-32]; 
xmm1[47-32] = xmm1[95-80] + xmm1[79-64]; 
xmm1[63-48] = xmm1[127-112] + xmm1[111-96]; 
xmm1[79-64] = xmm2/m1 28[31-16] + xmm2/m1 28[15-0); 
xmm1[95-80] = xmm2/m1 28[63-48] + xmm2/m1 28[47-32]; 
xmm1[111-96] = xmm2/m1 28[95-80] + xmm2/m1 28[79-64]; 
xmm1[127-112] = xmm2/m128[127-112] + xmm2/m128[11 1-96]; 


VPHADDW (VEX.128 encoded version) 
DEST[15:0] := SRC1[31:16] + SRC1[15:0] 
DEST[31:16] := SRC1[63:48] + SRC1[47:32] 
DEST[47:32] := SRC1[95:80] + SRC1[79:64] 
DEST[63:48] := SRC1[127:112] + SRC1[111:96] 
DEST[79:64] := SRC2[31:16] + SRC2[15:0) 
DEST[95:80] := SRC2[63:48] + SRC2[47:32] 
DEST[11 1:96] := SRC2[95:80] + SRC2[79:64] 
DEST[127:112] := SRC2[127:112] + SRC2[111:96] 
DEST[MAXVL-1:128] := 0 
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VPHADDW (VEX.256 encoded version) 
DEST[15:0] := SRC1[31:16] + SRC1[15:0] 
DEST[31:16] := SRC1[63:48] + SRC1[47:32] 
DEST[47:32] := SRC1[95:80] + SRC1[79:64] 
DEST[63:48] := SRC1[127:112] + SRC1[111:96] 
DEST[79:64] := SRC2[31:16] + SRC2[15:0] 
DEST[95:80] := SRC2[63:48] + SRC2[47:32] 

DEST[1 11:96] := SRC2[95:80] + SRC2[79:64] 
DEST[127:112] := SRC2[127:112] + SRC2[111:96] 
DEST[143:128] := SRC1[159:144] + SRC1[143:128] 
DEST[159:144] := SRC1[191:176] + SRC1[175:160] 
DEST[175:160] := SRC1[223:208] + SRC1[207:192] 
DEST[191:1 76] := SRC1[255:240] + SRC1[239:224] 
DEST[207:192] := SRC2[127:112] + SRC2[143:128] 
DEST[223:208] := SRC2[159:144] + SRC2[175:160] 
DEST[239:224] := SRC2[191:176] + SRC2[207:192] 
DEST[255:240] := SRC2[223:208] + SRC2[239:224] 


PHADDD (with 64-bit operands) 
mm1[31-0] = mm1[63-32] + mm1[31-0]; 
mm1[63-32] = mm2/m64[63-32] + mm2/m64[31-0]; 


PHADDD (with 128-bit operands) 
xmm1[31-0] = xmm1[63-32] + xmm1[31-0]; 
xmm1[63-32] = xmm1[127-96] + xmm1[95-64]; 
xmm1[95-64] = xmm2/m1 28[63-32] + xmm2/m1 28[3 1-0]; 
xmm1[127-96] = xmm2/m1 28[1 27-96] + xmm2/m128[95-64]; 


VPHADDD (VEX.128 encoded version) 
DEST[31-0] := SRC1[63-32] + SRC1[31-0] 
DEST[63-32] := SRC1[127-96] + SRC1[95-64] 
DEST[95-64] := SRC2[63-32] + SRC2[31-0] 
DEST[127-96] := SRC2[127-96] + SRC2[95-64] 
DEST[MAXVL-1:128] := 0 


VPHADDD (VEX.256 encoded version) 

DEST[31-0] := SRC1[63-32] + SRC1[31-0] 
DEST[63-32] := SRC1[127-96] + SRC1[95-64] 
DEST[95-64] := SRC2[63-32] + SRC2[31-0] 
DEST[127-96] := SRC2[127-96] + SRC2[95-64] 
DEST[159-128] := SRC1[191-160] + SRC1[159-128] 
DEST[191-160] := SRC1[255-224] + SRC1[223-192] 
DEST[223-192] := SRC2[191-160] + SRC2[159-128] 
DEST[255-224] := SRC2[255-224] + SRC2[223-192] 


Intel C/C++ Compiler Intrinsic Equivalents 


PHADDW: m64 _mm_hadd_pi16 (__m64 a,__m64 b) 

PHADDD: m64 _mm_hadd_pi32 (__m64 a,__m64 b) 
(V)PHADDW: m128i __mm_hadd_epi16 (__m128i a, ___m128i b) 
(V)PHADDD: m128i _mm_hadd_epi32 (__m128i a, __m128i b) 
VPHADDW: m256i__mm256_hadd_epi16 (__m256i a, 
VPHADDD: m256i _mm256_hadd_epi32 (__m256i a, __m256i b) 
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SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 
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PHADDSW — Packed Horizontal Add and Saturate 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF 38 03 /r! RM |V/V SSSE3 Add 16-bit signed integers horizontally, pack 
PHADDSW mm1, mm2/m64 saturated integers to mm/. 
66 OF 38 03 /r RM |V/V SSSE3 Add 16-bit signed integers horizontally, pack 
PHADDSW xmm1, xmm2/m128 saturated integers to xmm1. 
VEX.128.66.0F38.WIG 03 /r RVM | V/V AVX Add 16-bit signed integers horizontally, pack 
VPHADDSW xmm1, xmm2, xmm3/m128 saturated integers to xmm/. 
VEX.256.66.0F38.WIG 03 /r RVM | V/V AVX2 Add 16-bit signed integers horizontally, pack 
VPHADDSW ymm1, ymm2, ymm3/m256 saturated integers to ymm1. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


(V)PHADDSW adds two adjacent signed 16-bit integers horizontally from the source and destination operands and 
saturates the signed results; packs the signed, saturated 16-bit results to the destination operand (first operand) 
When the source operand is a 128-bit memory operand, the operand must be aligned on a 16-byte boundary ora 
general-protection exception (#GP) will be generated. 


Legacy SSE version: Both operands can be MMX registers. The second source operand can be an MMxX register or a 
64-bit memory location. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


In 64-bit mode, use the REX prefix to access additional registers. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 


VEX.256 encoded version: The first source and destination operands are YMM registers. The second source 
operand can be an YMM register or a 256-bit memory location. 


Operation 


PHADDSW (with 64-bit operands) 
mm1[15-0] = SaturateToSignedWord((mm1[31-16] + mm1[15-0)); 
mm1[31-16] = SaturateToSignedword(mm1 [63-48] + mm1[47-32]); 
mm1[47-32] = SaturateToSignedword(mm2/m64[3 1-16] + mm2/m64{[15-0}); 
mm1[63-48] = SaturateToSignedword(mm2/m64[63-48] + mm2/m64[47-32]); 
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PHADDSW (with 128-bit operands) 
xmm1[15-0]= SaturateToSignedWord(xmm1 [31-16] + xmm1[15-0)); 
xmm1[31-16] = SaturateToSignedWord(xmm1 [63-48] + xmm1[47-32]); 
xmm1[47-32] = SaturateToSignedWord(xmm1 [95-80] + xmm1[79-64)); 
xmm1 [63-48] = SaturateToSignedWord(xmm1[127-112] + xmm1[111-96]); 
xmm1[79-64] = SaturateToSignedWord(xmm2/m1 28[31-16] + xmm2/m128[15-0)); 
xmm1 [95-80] = SaturateToSignedWord(xmm2/m1 28[63-48] + xmm2/m1 28[47-32]); 
xmm1[1 11-96] = SaturateToSignedWord(xmm2/m1 28[95-80] + xmm2/m128[79-64)); 
xmm1[127-112] = SaturateToSignedWord(xmm2/m1 28[1 27-112] + xmm2/m128[111-96)); 


VPHADDSW (VEX.128 encoded version) 

DEST[15:0]= SaturateToSignedWord(SRC1[31:16] + SRC1[15:0]) 
DEST[31:16] = SaturateToSignedWord(SRC1 [63:48] + SRC1[47:32]) 
DEST[47:32] = SaturateToSignedWord(SRC1 [95:80] + SRC1[79:64]) 
DEST[63:48] = SaturateToSignedWord(SRC1[127:112] + SRC1[111:96]) 
DEST[79:64] = SaturateToSignedWord(SRC2[31:16] + SRC2[15:0]) 
DEST[95:80] = SaturateToSignedWord(SRC2[63:48] + SRC2[47:32]) 
DEST[1 11:96] = SaturateToSignedWord(SRC2[95:80] + SRC2[79:64]) 
DEST[127:112] = SaturateToSignedWord(SRC2[127:112] + SRC2[111:96]) 
DEST[MAXVL-1:128] := 0 


VPHADDSW (VEX.256 encoded version) 

DEST[15:0]= SaturateToSignedWord(SRC1[31:16] + SRC1[15:0]) 
DEST[31:16] = SaturateToSignedWord(SRC1 [63:48] + SRC1[47:32]) 
DEST[47:32] = SaturateToSignedWord(SRC1 [95:80] + SRC1[79:64]) 
DEST[63:48] = SaturateToSignedWord(SRC1[127:112] + SRC1[111:96]) 
DEST[79:64] = SaturateToSignedWord(SRC2[31:16] + SRC2[15:0]) 
DEST[95:80] = SaturateToSignedWord(SRC2[63:48] + SRC2[47:32]) 
DEST[111:96] = SaturateToSignedWord(SRC2[95:80] + SRC2[79:64]) 
DEST[127:112] = SaturateToSignedWord(SRC2[127:112] + SRC2[111:96]) 
DEST[143:128]= SaturateToSignedWord(SRC1[159:144] + SRC1[143:128]) 
DEST[159:144] = SaturateToSignedWord(SRC1[191:176] + SRC1[175:160]) 
DEST[175:160] = SaturateToSignedWord( SRC1[223:208] + SRC1[207:192]) 
DEST[191:1 76] = SaturateToSignedWord(SRC1[255:240] + SRC1[239:224]) 
DEST[207:192] = SaturateToSignedWord(SRC2[127:112] + SRC2[143:128]) 
DEST[223:208] = SaturateToSignedWword(SRC2[159:144] + SRC2[175:160]) 
DEST[239:224] = SaturateToSignedWord(SRC2[191-160] + SRC2[159-128]) 
DEST[255:240] = SaturateToSignedWord(SRC2[255:240] + SRC2[239:224]) 


phe — ap fle ht 


Intel C/C++ Compiler Intrinsic Equivalent 


PHADDSW: m64 __mm_hadds_pi16 (_m64 a,__m64 b) 
(V)PHADDSW: m128i __mm_hadds_epi16 (__m128i a, ___m128ib) 
VPHADDSW: m256i _mm256_hadds_epi16 (__m256i a, __m256i b) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 
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PHMINPOSUW — Packed Horizontal Word Minimum 


VPHMINPOSUW xmm1, xmm2/m128 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 38 41 /r RM |V/V SSE4_1 Find the minimum unsigned word in 
PHMINPOSUW xmm1, xmm2/m128 xmm2/m128 and place its value in the low 
word of xmm7 and its index in the second- 
lowest word of xmm17. 
VEX.128.66.0F38.WIG 41 /r RM |V/V AVX Find the minimum unsigned word in 


xmm2/m1 28 and place its value in the low 
word of xmm1 and its index in the second- 
lowest word of xmm17. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Determine the minimum unsigned word value in the source operand (second operand) and place the unsigned 
word in the low word (bits 0-15) of the destination operand (first operand). The word index of the minimum value 
is stored in bits 16-18 of the destination operand. The remaining upper bits of the destination are set to zero. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding XMM destination register remain 


unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination XMM register are zeroed. VEX.vvvv is reserved 


and must be 1111b, VEX.L must be 0, otherwise the instruction will #UD. 


Operation 


PHMINPOSUW (128-bit Legacy SSE version) 
INDEX := 0; 
MIN := SRC[15:0] 
IF (SRC[31:16] < MIN) 
THEN INDEX := 1; MIN := SRC[31:16]; FI; 
IF (SRC[47:32] < MIN) 
THEN INDEX := 2; MIN := SRC[47:32]; FI; 
* Repeat operation for words 3 through 6 
IF (SRC[127:112] < MIN) 
THEN INDEX := 7; MIN := SRC[127:11 2]; Fl; 
DEST[15:0] := MIN; 
DEST[18:16] := INDEX; 
DEST[1 27:19] := OOOOOOOODDDD0000000000000000H; 
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VPHMINPOSUW (VEX.128 encoded version) 

INDEX := 0 

MIN := SRC[15:0] 

IF (SRC[31:16] < MIN) THEN INDEX := 1; MIN := SRC[31:16] 
IF (SRC[47:32] < MIN) THEN INDEX := 2; MIN := SRC[47:32] 
* Repeat operation for words 3 through 6 

IF (SRC[127:112] < MIN) THEN INDEX := 7; MIN := SRC[127:112] 
DEST[15:0] := MIN 

DEST[18:16] := INDEX 

DEST[1 27:19] := OOOOOOOODDDD0000000000000000H 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
PHMINPOSUW: m128i_mm_minpos_epu16(__m128i packed_words); 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 

If VEX.vvvv # 1111B. 
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PHSUBW/PHSUBD — Packed Horizontal Subtract 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 05 /r' RM |V/V SSSE3 Subtract 16-bit signed integers horizontally, 

PHSUBW mm1, mm2/m64 pack to mm. 

66 OF 3805 /r RM |V/V SSSE3 Subtract 16-bit signed integers horizontally, 

PHSUBW xmm1, xmm2/m128 pack to xmm1. 

NP OF 38 06 /r RM |V/V SSSE3 Subtract 32-bit signed integers horizontally, 

PHSUBD mm1, mm2/m64 pack to mm. 

66 OF 38 06 /r RM |V/V SSSE3 Subtract 32-bit signed integers horizontally, 

PHSUBD xmm1, xmm2/m128 pack to xmm1. 

VEX.128.66.0F38.WIG 05 /r RVM | V/V AVX Subtract 16-bit signed integers horizontally, 

VPHSUBW xmm1, xmm2, xmm3/m128 pack to xmm/. 

VEX.128.66.0F38.WIG 06 /r RVM | V/V AVX Subtract 32-bit signed integers horizontally, 

VPHSUBD xmm1, xmm2, xmm3/m128 pack to xmm/. 

VEX.256.66.0F38.WIG 05 /r RVM | V/V AVX2 Subtract 16-bit signed integers horizontally, 

VPHSUBW ymm1, ymm2, ymm3/m256 pack to ymm1. 
[VEX.256.66.0F38WIGO6/r =—Sti<‘<‘;SOOC~C~*C«*RRVM'YWVNV~~—— «dJAVX2 ~~ ‘(Subtract 32-bit signed integers horizontally, _ | 

VPHSUBD ymm1, ymm2, ymm3/m256 pack to ymm1. 

NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


(V)PHSUBW performs horizontal subtraction on each adjacent pair of 16-bit signed integers by subtracting the 
most significant word from the least significant word of each pair in the source and destination operands, and packs 
the signed 16-bit results to the destination operand (first operand). (V)PHSUBD performs horizontal subtraction on 
each adjacent pair of 32-bit signed integers by subtracting the most significant doubleword from the least signifi- 
cant doubleword of each pair, and packs the signed 32-bit result to the destination operand. When the source 
operand is a 128-bit memory operand, the operand must be aligned on a 16-byte boundary or a general-protection 
exception (#GP) will be generated. 


Legacy SSE version: Both operands can be MMX registers. The second source operand can be an MMxX register or a 
64-bit memory location. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


In 64-bit mode, use the REX prefix to access additional registers. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 
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VEX.256 encoded version: The first source and destination operands are YMM registers. The second source 
operand can be an YMM register or a 256-bit memory location. 


Operation 


PHSUBW (with 64-bit operands) 
mm1[15-0] = mm1[15-0] - mm1[31-16]; 
mm1[31-16] = mm1[47-32] - mm1[63-48]; 
mm1[47-32] = mm2/m64[15-0] - mm2/m64[31-16]; 
mm1[63-48] = mm2/m64[47-32] - mm2/m64[63-48]; 


PHSUBW (with 128-bit operands) 
xmm1[15-0] = xmm1[15-0] - xmm1[31-16]; 
xmm1[31-16] = xmm1[47-32] - xmm1[63-48]; 
xmm1[47-32] = xmm1[79-64] - xmm1[95-80]; 
xmm1 [63-48] = xmm1[111-96] - xmm1[127-112]; 
xmm1[79-64] = xmm2/m1 28[15-0] - xmm2/m128[31-16]; 
xmm1[95-80] = xmm2/m1 28[47-32] - xmm2/m128[63-48]; 
xmm1[111-96] = xmm2/m1 28[79-64] - xmm2/m1 28[95-80]; 
xmm1[127-112] = xmm2/m1 28[1 11-96] - xmm2/m1 28[1 27-112]; 


VPHSUBW (VEX.128 encoded version) 
DEST[15:0] := SRC1[15:0] - SRC1[31:16] 
DEST[31:16] := SRC1[47:32] - SRC1[63:48] 
DEST[47:32] := SRC1[79:64] - SRC1[95:80] 
DEST[63:48] := SRC1[111:96] - SRC1[127:112] 
DEST[79:64] := SRC2[15:0] - SRC2[31:16] 
DEST[95:80] := SRC2[47:32] - SRC2[63:48] 
DEST[11 1:96] := SRC2[79:64] - SRC2[95:80] 
DEST[127:112] := SRC2[1 11:96] - SRC2[127:112] 
DEST[MAXVL-1:128] := 0 


VPHSUBW (VEX.256 encoded version) 
DEST[15:0] := SRC1[15:0] - SRC1[31:16] 
DEST[31:16] := SRC1[47:32] - SRC1[63:48] 
DEST[47:32] := SRC1[79:64] - SRC1[95:80] 
DEST[63:48] := SRC1[111:96] - SRC1[127:112] 
DEST[79:64] := SRC2[15:0] - SRC2[31:16] 
DEST[95:80] := SRC2[47:32] - SRC2[63:48] 
DEST[11 1:96] := SRC2[79:64] - SRC2[95:80] 
DEST[127:112] := SRC2[1 11:96] - SRC2[127:112] 
DEST[143:128] := SRC1[143:1 28] - SRC1[159:144] 
DEST[159:144] := SRC1[175:160] - SRC1[191:176] 
DEST[175:160] := SRC1[207:192] - SRC1[223:208] 
DEST[191:1 76] := SRC1[239:224] - SRC1[255:240] 
DEST[207:192] := SRC2[143:1 28] - SRC2[159:144] 
DEST[223:208] := SRC2[175:160] - SRC2[191:176] 
DEST[239:224] := SRC2[207:192] - SRC2[223:208] 
DEST[255:240] := SRC2[239:224] - SRC2[255:240] 


PHSUBD (with 64-bit operands) 


mm1[31-0] = mm1[31-0] - mm1[63-32]; 
mm1[63-32] = mm2/m64[31-0] - mm2/m64[63-32]; 
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PHSUBD (with 128-bit operands) 
xmm1[31-0] = xmm1[31-0] - xmm1[63-32]; 
xmm1[63-32] = xmm1[95-64] - xmm1[127-96]; 
xmm1[95-64] = xmm2/m1 28[31-0] - xmm2/m128[63-32]; 
xmm1[127-96] = xmm2/m128[95-64] - xmm2/m1 28[1 27-96]; 


VPHSUBD (VEX.128 encoded version) 
DEST[31-0] := SRC1[31-0] - SRC1[63-32] 
DEST[63-32] := SRC1[95-64] - SRC1[127-96] 
DEST[95-64] := SRC2[31-0] - SRC2[63-32] 
DEST[127-96] := SRC2[95-64] - SRC2[127-96] 
DEST[MAXVL-1:128] := 0 


VPHSUBD (VEX.256 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC1[63:32] 
DEST[63:32] := SRC1[95:64] - SRC1[127:96] 
DEST[95:64] := SRC2[31:0] - SRC2[63:32] 
DEST[127:96] := SRC2[95:64] - SRC2[127:96] 
DEST[159:128] := SRC1[159:1 28] - SRC1[191:160] 
DEST[191:160] := SRC1[223:192] - SRC1[255:224] 
DEST[223:192] := SRC2[159:1 28] - SRC2[191:160] 
DEST[255:224] := SRC2[223:192] - SRC2[255:224] 


Intel C/C++ Compiler Intrinsic Equivalents 


PHSUBW: m64 _mm_hsub_pi16 (__m64 a,__ m64 b) 

PHSUBD: m64 __mm_hsub_pi32 (__m64 a,__ m64 b) 
(V)PHSUBW: m128i __mm_hsub_epi16 (__m128i a, ___m128i b) 
(V)PHSUBD: m128i __mm_hsub_epi32 (__m128i a, __m128i b) 
VPHSUBW: m256i__mm256_hsub_epi16 (__m256i a, __m256i b) 
VPHSUBD: m256i __mm256_hsub_epi32 (__m256i a, ___m256i b) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 
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PHSUBSW — Packed Horizontal Subtract and Saturate 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF 38 07 /r’ RM |V/V SSSE3 Subtract 16-bit signed integer horizontally, 
PHSUBSW mm1, mm2/m64 pack saturated integers to mm1. 
66 OF 38 07 /r RM |V/V SSSE3 Subtract 16-bit signed integer horizontally, 
PHSUBSW xmm1, xmm2/m128 pack saturated integers to xmm17. 
VEX.128.66.0F38.WIG 07 /r RVM | V/V AVX Subtract 16-bit signed integer horizontally, 
VPHSUBSW xmm1, xmm2, xmm3/m128 pack saturated integers to xmm1. 
VEX.256.66.0F38.WIG 07 /r RVM | V/V AVX2 Subtract 16-bit signed integer horizontally, 
VPHSUBSW ymm1, ymm2, ymm3/m256 pack saturated integers to ymm7. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


(V)PHSUBSW performs horizontal subtraction on each adjacent pair of 16-bit signed integers by subtracting the 
most significant word from the least significant word of each pair in the source and destination operands. The 
signed, saturated 16-bit results are packed to the destination operand (first operand). When the source operand is 
a 128-bit memory operand, the operand must be aligned on a 16-byte boundary or a general-protection exception 
(#GP) will be generated. 


Legacy SSE version: Both operands can be MMxX registers. The second source operand can be an MMxX register or 
a 64-bit memory location. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


In 64-bit mode, use the REX prefix to access additional registers. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 

VEX.256 encoded version: The first source and destination operands are YMM registers. The second source 
operand can be an YMM register or a 256-bit memory location. 


Operation 


PHSUBSW (with 64-bit operands) 
mm1[15-0] = SaturateToSignedword(mm1 [15-0] - mm1[31-16)]); 
mm1[31-16] = SaturateToSignedword(mm1 [47-32] - mm1[63-48]); 
mm1[47-32] = SaturateToSignedword(mm2/m64[1 5-0] - mm2/m64[31-16]); 
mm1[63-48] = SaturateToSignedword(mm2/m64[47-32] - mm2/m64[63-48)); 
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PHSUBSW (with 128-bit operands) 
xmm1[15-0] = SaturateToSignedWord(xmm1[15-0] - xmm1[31-16]); 
xmm1[31-16] = SaturateToSignedWord(xmm1 [47-32] - xmm1[63-48)); 
xmm1 [47-32] = SaturateToSignedWord(xmm1 [79-64] - xmm1[95-80)); 
xmm1 [63-48] = SaturateToSignedWord(xmm1[1 11-96] - xmm1[127-112]); 
xmm1[79-64] = SaturateToSignedWord(xmm2/m1 28[15-0] - xmm2/m1 28[31-16)]); 
xmm1 [95-80] =SaturateToSignedword(xmm2/m1 28[47-32] - xmm2/m1 28[63-48)); 
xmm1[111-96] =SaturateToSignedword(xmm2/m1 28[79-64] - xmm2/m1 28[95-80)); 
xmm1[127-112]= SaturateToSignedWord(xmm2/m1 28[1 11-96] - xmm2/m128[127-112]); 


VPHSUBSW (VEX.128 encoded version) 

DEST[15:0]= SaturateToSignedWord(SRC1[15:0] - SRC1[31:16]) 
DEST[31:16] = SaturateToSignedWord(SRC1 [47:32] - SRC1[63:48]) 
DEST[47:32] = SaturateToSignedWord(SRC1[79:64] - SRC1[95:80]) 
DEST[63:48] = SaturateToSignedWord(SRC1[1 11:96] - SRC1[127:112]) 
DEST[79:64] = SaturateToSignedWord(SRC2[1 5:0] - SRC2[31:16]) 
DEST[95:80] = SaturateToSignedWord(SRC2[47:32] - SRC2[63:48]) 
DEST[1 11:96] = SaturateToSignedWord(SRC2[79:64] - SRC2[95:80]) 
DEST[127:112] = SaturateToSignedWord(SRC2[1 1 1:96] - SRC2[127:112]) 
DEST[MAXVL-1:128] := 0 


VPHSUBSW (VEX.256 encoded version) 

DEST[15:0]= SaturateToSignedWord(SRC1[15:0] - SRC1[31:16]) 
DEST[31:16] = SaturateToSignedWord(SRC1 [47:32] - SRC1[63:48]) 
DEST[47:32] = SaturateToSignedWord(SRC1[79:64] - SRC1[95:80]) 
DEST[63:48] = SaturateToSignedWord(SRC1[1 11:96] - SRC1[127:112]) 
DEST[79:64] = SaturateToSignedWord(SRC2[1 5:0] - SRC2[31:16]) 
DEST[95:80] = SaturateToSignedWord(SRC2[47:32] - SRC2[63:48]) 
DEST[111:96] = SaturateToSignedWord(SRC2[79:64] - SRC2[95:80]) 
DEST[127:112] = SaturateToSignedWord(SRC2[1 11:96] - SRC2[127:112]) 
DEST[143:128]= SaturateToSignedWord(SRC1[143:1 28] - SRC1[159:144]) 
DEST[159:144] = SaturateToSignedWord(SRC1[175:160] - SRC1[191:176]) 
DEST[175:160] = SaturateToSignedWord(SRC1[207:192] - SRC1[223:208}) 
DEST[191:176] = SaturateToSignedWord(SRC1[239:224] - SRC1[255:240]) 
DEST[207:192] = SaturateToSignedWord(SRC2[1 43:1 28] - SRC2[159:144]) 
DEST[223:208] = SaturateToSignedWord(SRC2[175:160] - SRC2[191:176]) 
DEST[239:224] = SaturateToSignedWord(SRC2[207:1 92] - SRC2[223:208}) 
DEST[255:240] = SaturateToSignedWord(SRC2[239:224] - SRC2[255:240}) 


pe — ap Ss 


Intel C/C++ Compiler Intrinsic Equivalent 


PHSUBSW: m64 __mm_hsubs_pi16 (__m64 a,__m64 b) 
(V)PHSUBSW: m128i_mm_hsubs_epi16 (__m128i a, ___m128i b) 
VPHSUBSW: m256i__mm256_hsubs_epi16 (__m256i a,__ m256i b) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 1. 
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Opcode/ Op/ En | 64/32 bit | CPUID Description 
Instruction Mode Feature 
Support | Flag 

66 OF 3A 20 /r ib A VIV SSE4_1 Insert a byte integer value from r32/m8 into 

PINSRB xmm1, r32/m8, imm8 xmm1 at the destination element in xmm1 
specified by immé. 

66 OF 3A 22 /r ib A VV SSE4_1 Insert a dword integer value from r/m32 into 

PINSRD xmm17, r/m32, imm8 the xmm/ at the destination element 
specified by imme. 

66 REX.W OF 3A 22 /r ib A VIN. E. SSE4_1 Insert a qword integer value from r/m64 into 

PINSRQ xmm1, r/m64, imm8 the xmm1 at the destination element 
specified by imme. 

VEX.128.66.0F3A.WO 20 /r ib B VIN AVX Merge a byte integer value from r32/m8 and 

VPINSRB xmm1, xmm2, r32/m8, imm8 rest from xmm2 into xmm7 at the byte offset 
in imme. 

VEX.128.66.0F3A.WO 22 /r ib B VV AVX Insert a dword integer value from r32/m32 

VPINSRD xmm1, xmm2, r/m32, imm8 and rest from xmm_2 into xmm1 at the dword 
offset in immé. 

VEX.128.66.0F3A.W1 22 /r ib B vile AVX Insert a qword integer value from r64/m64 

VPINSRQ xmm1, xmm2, r/m64, imm8 and rest from xmm_2 into xmm1 at the qword 
offset in immé. 

EVEX.128.66.0F3A.WIG 20 /r ib C VIV AVX512BW | Merge a byte integer value from r32/m8 and 

VPINSRB xmm1, xmm2, r32/m8, imm8 rest from xmm_z into xmm1 at the byte offset 
in imms. 

EVEX.128.66.0F3A.WO 22 /r ib C VN AVX512DQ | Insert a dword integer value from r32/m32 

VPINSRD xmm1, xmm2, r32/m32, imm8 and rest from xmmz into xmm1 at the dword 
offset in imm8. 

EVEX.128.66.0F3A.W1 22 /r ib C VINE? AVX512DQ | Insert a qword integer value from r64/m64 

VPINSRQ xmm1, xmm2, r64/m64, imm8 and rest from xmm2 into xmm1 at the qword 
offset in imms8. 


NOTES: 


1. In 64-bit mode, VEX.W1 is ignored for VPINSRB (similar to legacy REX.W=1 prefix with PINSRB). 
2. VEX.W/EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Copies a byte/dword/qword from the source operand (second operand) and inserts it in the destination operand 
(first operand) at the location specified with the count operand (third operand). (The other elements in the desti- 
nation register are left untouched.) The source operand can be a general-purpose register or a memory location. 
(When the source operand is a general-purpose register, PINSRB copies the low byte of the register.) The destina- 
tion operand is an XMM register. The count operand is an 8-bit immediate. When specifying a qword[dword, byte] 
location in an XMM register, the [2, 4] least-significant bit(s) of the count operand specify the location. 
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In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15, R8-15). Use of REX.W permits the use of 64 bit general purpose regis- 
ters. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. VEX.L must be 0, otherwise 
the instruction will #UD. Attempt to execute VPINSRQ in non-64-bit mode will cause #UD. 


EVEX.128 encoded version: Bits (MAXVL-1:128) of the destination register are zeroed. EVEX.L’L must be 0, other- 
wise the instruction will #UD. 


Operation 


CASE OF 
PINSRB: SEL := COUNT[3:0]; 
MASK := (OFFH << (SEL * 8)): 
TEMP := (((SRC[7:0] << (SEL *8)) AND MASK); 
PINSRD: SEL := COUNT[1:0]; 
MASK := (OFFFFFFFFH << (SEL * 32); 
TEMP := (((SRC << (SEL *32)) AND MASK); 
PINSRQ: SEL := COUNT[O] 
MASK := (OFFFFFFFFFFFFFFFFH << (SEL * 64)); 
TEMP := (((SRC << (SEL *64)) AND MASK); 
ESAC; 
DEST := ((DEST AND NOT MASK) OR TEMP); 


VPINSRB (VEX/EVEX encoded version) 

SEL := imm8[3:0] 

DEST[127:0] := write_b_element(SEL, SRC2, SRC1) 
DEST[MAXVL-1:128] := 0 


VPINSRD (VEX/EVEX encoded version) 

SEL := imm8[1:0] 

DEST[127:0] := write_d_element(SEL, SRC2, SRC1) 
DEST[MAXVL-1:128] := 0 


VPINSRQ (VEX/EVEX encoded version) 

SEL := imm8[0] 

DEST[1 27:0] := write_q_element(SEL, SRC2, SRC1) 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


PINSRB: m128i_mm_insert_epi8 (__m128i $1, int s2, const int ndx); 
PINSRD: m128i __mm_insert_epi32 (__m128i s2, int s, const int ndx); 
PINSRQ: m128i __mm_insert_epi64(__m128i s2, __int64 s, const int ndx); 
Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None. 
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Other Exceptions 

EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 
Additionally: 

#UD If VEX.L = 1 or EVEX.L’L > O. 


PINSRB/PINSRD/PINSRQ — Insert Byte/Dword/Qword Vol.2B 4-309 


INSTRUCTION SET REFERENCE, M-U 


PINSRW—Insert Word 


Opcode/ Op/ En | 64/32 bit | CPUID Description 
Instruction Mode Feature 
Support | Flag 
NP OF C4 /rib! A VIV SSE Insert the low word from r32 or from m16 
PINSRW mm, r32/m16, imm8 into mm at the word position specified by 
imms. 
66 OF C4 /rib A VN SSE2 Move the low word of r32 or from m16 into 
PINSRW xmm, r32/m16, imm8 xmm at the word position specified by imm8. 
VEX.128.66.0F.WO C4 /r ib B VAN AVX Insert the word from r32/m16 at the offset 
VPINSRW xmm1, xmm2, r32/m16, imm8 indicated by imm8 into the value from xmm2 
and store result in xmm1. 
EVEX.128.66.0F.WIG C4 /r ib C VN AVX512BW | Insert the word from r32/m16 at the offset 
VPINSRW xmm1, xmm2, r32/m16, imm8 indicated by imm8 into the value from xmm2 
and store result in xmm1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


2. In 64-bit mode, VEX.W'11 is ignored for VPINSRW (similar to legacy REX.W=1 prefix in PINSRW). 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Three operand MMX and SSE instructions: 


Copies a word from the source operand and inserts it in the destination operand at the location specified with the 
count operand. (The other words in the destination register are left untouched.) The source operand can bea 
general-purpose register or a 16-bit memory location. (When the source operand is a general-purpose register, the 
low word of the register is copied.) The destination operand can be an MMX technology register or an XMM register. 
The count operand is an 8-bit immediate. When specifying a word location in an MMX technology register, the 2 
least-significant bits of the count operand specify the location; for an XMM register, the 3 least-significant bits 
specify the location. 


Bits (MAXVL-1:128) of the corresponding YMM destination register remain unchanged. 
Four operand AVX and AVX-512 instructions: 


Combines a word from the first source operand with the second source operand, and inserts it in the destination 
operand at the location specified with the count operand. The second source operand can be a general-purpose 
register or a 16-bit memory location. (When the source operand is a general-purpose register, the low word of the 
register is copied.) The first source and destination operands are XMM registers. The count operand is an 8-bit 
immediate. When specifying a word location, the 3 least-significant bits specify the location. 


Bits (MAXVL-1:128) of the destination YMM register are zeroed. VEX.L/EVEX.L'L must be 0, otherwise the instruc- 
tion will #UD. 
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Operation 


PINSRW dest, src, imm8 (MMX) 
SEL := imm8[1:0] 
DEST.word[SEL] := src.word[0] 


PINSRW dest, src, imm8 (SSE) 
SEL := imm8[2:0] 
DEST.word[SEL] := src.word[0] 


VPINSRW dest, src1, src2, imm8 (AVX/AVX512) 
SEL := imm8[2:0] 
DEST := src 
DEST.word[SEL] := src2.word[0] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


PINSRW: m64 _mm_insert_pi16 (__m64 a, int d, int n) 
PINSRW: m128i __mm_insert_epi16 (__m128i a, int b, int imm) 
Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 


EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-57, “Type E9NF Class Exception Conditions”. 


Additionally: 
#UD If VEX.L = 1 or EVEX.L’L > O. 
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PMADDUBSW — Multiply and Add Packed Signed and Unsigned Bytes 


Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 04 /r! A VV SSSE3 Multiply signed and unsigned bytes, add 

PMADDUBSW mm1, mm2/m64 horizontal pair of signed words, pack 
saturated signed-words to mm]. 

66 OF 38 04 /r A VV SSSE3 Multiply signed and unsigned bytes, add 

PMADDUBSW xmm1, xmm2/m128 horizontal pair of signed words, pack 
saturated signed-words to xmm1. 

VEX.128.66.0F38.WIG 04 /r B VV AVX Multiply signed and unsigned bytes, add 

VPMADDUBSW xmm1, xmm2, xmm3/m128 horizontal pair of signed words, pack 
saturated signed-words to xmm1. 

VEX.256.66.0F38.WIG 04 /r B VN AVX2 Multiply signed and unsigned bytes, add 

VPMADDUBSW ymm1, ymm2, ymm3/m256 horizontal pair of signed words, pack 
saturated signed-words to ymm17. 

EVEX.128.66.0F38.WIG 04 /r C VV AVX512VL | Multiply signed and unsigned bytes, add 

VPMADDUBSW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | horizontal pair of signed words, pack 
saturated signed-words to xmm1 under 
writemask k1. 

EVEX.256.66.0F38.WIG 04 /r C VV AVX512VL | Multiply signed and unsigned bytes, add 

VPMADDUBSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | horizontal pair of signed words, pack 
saturated signed-words to ymm1 under 
writemask k1. 

EVEX.512.66.0F38.WIG 04 /r Cc VIV AVX512BW | Multiply signed and unsigned bytes, add 

VPMADDUBSW zmm1 {k1}{z}, zmm2, zmm3/m512 horizontal pair of signed words, pack 
saturated signed-words to zmm1 under 
writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 


Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 


in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


(V)PMADDUBSW multiplies vertically each unsigned byte of the destination operand (first operand) with the corre- 
sponding signed byte of the source operand (second operand), producing intermediate signed 16-bit integers. Each 
adjacent pair of signed words is added and the saturated result is packed to the destination operand. For example, 
the lowest-order bytes (bits 7-0) in the source and destination operands are multiplied and the intermediate signed 
word result is added with the corresponding intermediate result from the 2nd lowest-order bytes (bits 15-8) of the 
operands; the sign-saturated result is stored in the lowest word of the destination register (15-0). The same oper- 
ation is performed on the other pairs of adjacent bytes. Both operands can be MMX register or XMM registers. When 
the source operand is a 128-bit memory operand, the operand must be aligned on a 16-byte boundary ora 
general-protection exception (#GP) will be generated. 


In 64-bit mode and not encoded with VEX/EVEX, use the REX prefix to access XMM8-XMM15. 
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128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 


register remain unchanged. 


VEX.128 and EVEX.128 encoded versions: The first source and destination operands are XMM registers. The 
second source operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding 


destination register are zeroed. 


VEX.256 and EVEX.256 encoded versions: The second source operand can be an YMM register or a 256-bit memory 
location. The first source and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding 


ZMM register are zeroed. 


EVEX.512 encoded version: The second source operand can be an ZMM register or a 512-bit memory location. The 


first source and destination operands are ZMM registers. 


Operation 


PMADDUBSW (with 64 bit operands) 
DEST[15-0] = Saturate ToSignedWord(SRC[15-8]*DEST[1 5-8]+SRC[7-0]*DEST[7-0)); 
DEST[31-16] = SaturateToSignedWord(SRC[31 -24]*DEST[31-24]+SRC[23-16]*DEST[23-16)]); 
DEST[47-32] = SaturateToSignedWord(SRC[47-40]*DEST[47-40]+SRC[39-32]*DEST[39-32]); 
DEST[63-48] = SaturateToSignedWord(SRC[63-56]*DEST[63-56]+SRC[55-48]*DEST[55-48)]); 
PMADDUBSW (with 128 bit operands) 
DEST[15-0] = SaturateToSignedWword(SRC[15-8]* DEST[15-8]+SRC[7-0]*DEST[7-0)); 
// Repeat operation for 2nd through 7th word 
SRC1/DEST[1 27-112] = SaturateToSignedWord(SRC[1 27-120]*DEST[127-120]+ SRC[119-112]* DEST[119-112]); 


VPMADDUBSW (VEX.128 encoded version) 

DEST[15:0] := SaturateToSignedWord(SRC2[1 5:8]* SRC1[1 5:8]+SRC2[7:0]*SRC1[7:0]) 

// Repeat operation for 2nd through 7th word 

DEST[127:112] := SaturateToSignedWord(SRC2[127:120]*SRC1[127:120]+ SRC2[119:112]* SRC1[119:112]) 
DEST[MAXVL-1:128] := 0 


VPMADDUBSW (VEX.256 encoded version) 

DEST[15:0] := SaturateToSignedWord(SRC2[1 5:8]* SRC1[1 5:8]+SRC2[7:0]*SRC1[7:0]) 

// Repeat operation for 2nd through 15th word 

DEST[255:240] := SaturateToSignedWord(SRC2[255:248]*SRC1[255:248]+ SRC2[247:240]* SRC1[247:240)) 
DEST[MAXVL-1:256] := 0 


VPMADDUBSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] := SaturateToSignedWord(SRC2[i+ 1 5:i+8]* SRC1 [i+ 15:i+8] + SRC2[i+7:i]*SRC1 [i+7:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 
VPMADDUBSW __m512i_mm512_maddubs_epi16(__m512i a,__m512i b); 


VPMADDUBSW __m512i_mm512_mask_maddubs_epi16(__m512is, __ mmask32 k,__m512i a, ___m512i b); 
VPMADDUBSW __m512i_mm512_maskz_maddubs_epi16(__mmask32 k,__m512i a,__m512i b); 
VPMADDUBSW __m256i __mm256_mask_maddubs_epi16(__m256is,___ mmask16 k,__ m256i a, __ m256i b); 
VPMADDUBSW __m256i __mm256_maskz_maddubs_epi16(__mmask16 k,__ m256i a,__ m256i b); 
VPMADDUBSW __m128i __mm_mask_maddubs_epi16(__m128i s,__ mmask8 k,___m128i a, ___m128ib); 
VPMADDUBSW __m128i__mm_maskz_maddubs_epi16(__mmask8 k,___m128i a,__m128i b); 

PMADDUBSW: __m64 _mm_maddubs_pi16 (__m64 a,__m64 b) 

(V)PMADDUBSW: __m128i __mm_maddubs_epi16 (__m128i a,__m128ib) 

VPMADDUBSW: m256i __mm256_maddubs_epi16 (__m256i a, __m256i b) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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PMADDWD—Multiply and Add Packed Integers 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF F5 /r' A VIV MMX Multiply the packed words in mm by the packed 

PMADDWD mm, mm/m64 words in mm/m64, add adjacent doubleword 
results, and store in mm. 

66 OF F5 /r A VN SSE2 Multiply the packed word integers in xmm7 by 

PMADDWD xmm1, xmm2/m128 the packed word integers in xmm2/m128, add 
adjacent doubleword results, and store in 
xmm1. 

VEX.128.66.0F.WIG F5 /r B VIV AVX Multiply the packed word integers in xmm2 by 

VPMADDWD xmm1, xmm2, xmm3/m128 the packed word integers in xmm3/m128, add 
adjacent doubleword results, and store in 
xmm1. 

VEX.256.66.0F.WIG F5 /r B VIV AVX2 Multiply the packed word integers in ymm2 by 

VPMADDWD ymm1, ymm2, ymm3/m256 the packed word integers in ynm3/m256, add 
adjacent doubleword results, and store in 
ymm1. 

EVEX.128.66.0F.WIG F5 /r C VV AVX512VL | Multiply the packed word integers in xmm2 by 

VPMADDWD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | the packed word integers in xmm3/m128, add 
adjacent doubleword results, and store in 
xmm1 under writemask k1. 

EVEX.256.66.0F.WIG F5 /r C VIV AVX512VL_ | Multiply the packed word integers in ymm2 by 

VPMADDWD ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | the packed word integers in ymm3/m256, add 
adjacent doubleword results, and store in 
ymm1 under writemask k1. 

EVEX.512.66.0F.WIG F5 /r C VV AVX512BW | Multiply the packed word integers in zmm2 by 

VPMADDWD zmm1 {k1}{z}, zmm2, zmm3/m512 the packed word integers in zmm3/m512, add 
adjacent doubleword results, and store in 
zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the individual signed words of the destination operand (first operand) by the corresponding signed words 
of the source operand (second operand), producing temporary signed, doubleword results. The adjacent double- 
word results are then summed and stored in the destination operand. For example, the corresponding low-order 
words (15-0) and (31-16) in the source and destination operands are multiplied by one another and the double- 
word results are added together and stored in the low doubleword of the destination register (31-0). The same 
operation is performed on the other pairs of adjacent words. (Figure 4-11 shows this operation when using 64-bit 
operands). 
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The (V)PMADDWD instruction wraps around only in one situation: when the 2 pairs of words being operated on in 
a group are all 8000H. In this case, the result wraps around to 80000000H. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version: The first source and destination operands are MMX registers. The second source operand is an 
MMX register or a 64-bit memory location. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 


VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 


EVEX.512 encoded version: The second source operand can be an ZMM register or a 512-bit memory location. The 
first source and destination operands are ZMM registers. 


SRC x3 x2 x1 xo 
DEST Y3 Y2 Y1 Yo 

TEMP X3 « Y3 X2 « Y2 x1 «1 X0 * YO 
DEST (X3#Y3) + (X2*Y2)] (X1#¥1) + (X0#Y0) 


Figure 4-11. PMADDWD Execution Model Using 64-bit Operands 


Operation 


PMADDWD (with 64-bit operands) 
DEST[31:0] := (DEST[15:0] * SRC[15:0]) + (DEST[31:16] * SRC[31:16)); 
DEST[63:32] := (DEST[47:32] * SRC[47:32]) + (DEST[63:48] * SRC[63:48}); 


PMADDWD (with 128-bit operands) 
DEST[31:0] := (DEST[15:0] * SRC[15:0]) + (DEST[31:16] * SRC[31:16)); 
DEST[63:32] := (DEST[47:32] * SRC[47:32]) + (DEST[63:48] * SRC[63:48}); 
DEST[95:64] := (DEST[79:64] * SRC[79:64]) + (DEST[95:80] * SRC[95:80)); 
DEST[127:96] := (DEST[1 11:96] * SRC[111:96]) + (DEST[127:112] * SRC[127:112]); 


VPMADDWD (VEX.128 encoded version) 

DEST[31:0] := (SRC1[15:0] * SRC2[15:0]) + (SRC1[31:16] * SRC2[31:16]) 

DEST[63:32] := (SRC1[47:32] * SRC2[47:32]) + (SRC1[63:48] * SRC2[63:48]) 
DEST[95:64] := (SRC1[79:64] * SRC2[79:64]) + (SRC1[95:80] * SRC2[95:80]) 
DEST[127:96] := (SRC1[11 1:96] * SRC2[111:96]) + (SRC1[127:112] * SRC2[127:112]) 
DEST[MAXVL-1:128] := 0 


4-316 Vol. 2B PMADDWD—Multiply and Add Packed Integers 


INSTRUCTION SET REFERENCE, M-U 


VPMADDWD (VEX.256 encoded version) 

DEST[31:0] := (SRC1[15:0] * SRC2[15:0]) + (SRC1[31:16] * SRC2[31:16]) 

DEST[63:32] := (SRC1[47:32] * SRC2[47:32]) + (SRC1[63:48] * SRC2[63:48]) 
DEST[95:64] := (SRC1[79:64] * SRC2[79:64]) + (SRC1[95:80] * SRC2[95:80]) 
DEST[127:96] := (SRC1[1 11:96] * SRC2[111:96]) + (SRC1[127:112] * SRC2[127:112]) 
DEST[159:1 28] := (SRC1[143:1 28] * SRC2[143:128]) + (SRC1[159:144] * SRC2[159:144] 
DEST[191:160] := (SRC1[175:160] * SRC2[175:160]) + (SRC1[191:176] * SRC2[191:176] 
DEST[223:192] := (SRC1[207:192] * SRC2[207:192]) + (SRC1[223:208] * SRC2[223:208] 
DEST[255:224] := (SRC1[239:224] * SRC2[239:224]) + (SRC1[255:240] * SRC2[255:240] 
DEST[MAXVL-1:256] := 0 


a) 


VPMADDWD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := (SRC2[i+31:i+16]* SRC1[i+31:i+16]) + (SRC2[i+1 5:i]*SRC1 [i+1 5:i]) 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPMADDWD __m512i__mm512_madd_epi16(__m512i a, ___m512i b); 

VPMADDWD __m512i_mm512_mask_madd_epi16(__m512is,__ mmask32 k,__m512ia,___m512i b); 
VPMADDWD __m512i__mm512_maskz_madd_epi16(__mmask32 k,__m512i a,__m512i b); 
VPMADDWD __m256i __mm256_mask_madd_epi16(__m256i s,__ mmask16 k,___ m256i a, __ m256i b); 
VPMADDWD __m256i _mm256_maskz_madd_epi16(__mmask16 k,__ m256i a, ___m256i b); 
VPMADDWD __m128i_mm_mask_madd_epi16(__m128is, _ mmask8 k,__m128i a, ___m128i b); 
VPMADDWD __m128i __mm_maskz_madd_epi16(__mmask8 k, __m128i a,__m128i b); 
PMADDWD:__m64 _mm_madd_pi16(__m64 m1,__ m64 m2) 

(V)PMADDWD:__m128i __mm_madd_epi16 (__m128i a, __m128i b) 

VPMADDWD:__m256i _mm256_madd_epi16 (__m256i a, __m256i b) 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 


PMADDWD—Multiply and Add Packed Integers 


Vol.2B 4-317 


INSTRUCTION SET REFERENCE, M-U 


PMAXSB/PMAXSW/PMAXSD/PMAXSQ—Maximum of Packed Signed Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

NP OF EE /r' A VIV SSE Compare signed word integers in mm2/m64 and 

PMAXSW mm1, mm2/m64 mm 1 and return maximum values. 

66 OF 38 3C /r A VIV SSE4_1 Compare packed signed byte integers in xmm1 and 

PMAXSB xmm1, xmm2/m128 xmm2/m128 and store packed maximum values in 
xmm1. 

66 OF EE /r A VIV SSE2 Compare packed signed word integers in 

PMAXSW xmm1, xmm2/m128 xmm2/m128 and xmm1 and stores maximum 
packed values in xmm1. 

66 OF 38 3D /r A VIV SSE4_1 Compare packed signed dword integers in xmm1 

PMAXSD xmm1, xmm2/m128 and xmm2/m1 28 and store packed maximum values 
in xmm1. 

VEX.128.66.0F38.WIG 3C /r B VIV AVX Compare packed signed byte integers in xmme2 and 

VPMAXSB xmm1, xmm2, xmm3/m128 xmm3/m128 and store packed maximum values in 
xmm1. 

VEX.128.66.0F.WIG EE /r B VIV AVX Compare packed signed word integers in 

VPMAXSW xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2 and store packed maximum 
values in xmm1. 

VEX.128.66.0F38.WIG 3D /r B VIV AVX Compare packed signed dword integers in xmm2 

VPMAXSD xmm1, xmm2, xmm3/m128 and xmm3/m1 28 and store packed maximum values 
in xmm1. 

VEX.256.66.0F38.WIG 3C /r B VIV AVX2 Compare packed signed byte integers in ymm2 and 

VPMAXSB ymm1, ymm2, ymm3/m256 ymm3/m256 and store packed maximum values in 
ymm1. 

VEX.256.66.0F.WIG EE /r B VIV AVX2 Compare packed signed word integers in 

VPMAXSW ymm1, ymm2, ymm3/m256 ymm3/m256 and ymm2 and store packed maximum 
values in ymm1. 

VEX.256.66.0F38.WIG 3D /r B VIV AVX2 Compare packed signed dword integers in ymm2 

VPMAXSD ymm1, ymm2, ymm3/m256 and ymm3/m256 and store packed maximum values 
in ymm1. 

EVEX.1 28.66.0F38.WIG 3C /r C VIV AVX512VL_ | Compare packed signed byte integers in xmme and 

VPMAXSB xmm1{k1}{z}, xmm2, AVX512BW | xmm3/m128 and store packed maximum values in 

xmm3/m128 xmm1 under writemask k1. 

EVEX.256.66.0F38.WIG 3C /r C VIN AVX512VL_ | Compare packed signed byte integers in ymm2 and 

VPMAXSB ymm1{k1}{z}, ymm2, AVX512BW | ymm3/m256 and store packed maximum values in 

ymm3/m256 ymm1 under writemask k1. 

EVEX.512.66.0F38.WIG 3C /r C VIV AVX512BW | Compare packed signed byte integers in zmm2 and 

VPMAXSB zmm1{k1}{z}, zmm2, zmm3/m512 and store packed maximum values in 

zmm3/m512 zmm1 under writemask k1. 

EVEX.128.66.0F.WIG EE /r C VIV AVX512VL_ | Compare packed signed word integers in xmm2 and 

VPMAXSW xmm1{k1}{z}, xmm2, AVX512BW | xmm3/m128 and store packed maximum values in 

xmm3/m128 xmm1 under writemask k1. 

EVEX.256.66.0F.WIG EE /r C VIV AVX512VL_ | Compare packed signed word integers in ymme and 

VPMAXSW ymm1{k1}{z}, ymm2, AVX512BW | ymm3/m256 and store packed maximum values in 

ymm3/m256 ymm1 under writemask k1. 

EVEX.512.66.0F.WIG EE /r C VIV AVX512BW | Compare packed signed word integers in zmm2 and 

VPMAXSW zmm1{k1}{z}, zmm2, zmm3/m512 and store packed maximum values in 

zmm3/m512 zmm1 under writemask k1. 

EVEX.128.66.0F38.W0 3D /r D VIV AVX512VL_ | Compare packed signed dword integers in xmm2 

VPMAXSD xmm1 {k1}{z}, xmm2, AVX512F and xmm3/m128/m32bcst and store packed 

xmm3/m1 28/m32bcst maximum values in xmm1 using writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.256.66.0F38.W0 3D /r D VIV AVX512VL_ | Compare packed signed dword integers in ymm2 
VPMAXSD ymm1 {k1}{z}, ymm2, AVX512F and ymm3/m256/m32bcst and store packed 
ymm3/m256/m32bcst maximum values in ymm1 using writemask k1. 
EVEX.512.66.0F38.W0 3D /r D VV AVX512F Compare packed signed dword integers in zmm2 and 
VPMAXSD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and store packed maximum 
zmm3/m512/m32bcst values in zmm1 using writemask k1. 
EVEX.128.66.0F38.W1 3D /r D VIV AVX512VL_ | Compare packed signed qword integers in xmm2 
VPMAXSQ xmm1 {k1}{z}, xmm2, AVX512F and xmm3/m128/m64bcst and store packed 
xmm3/m128/m64bcst maximum values in xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 3D /r D VIV AVX512VL_ | Compare packed signed qword integers in ymm2 
VPMAXSQ ymm1 {k1}{z}, ymm2, AVX512F and ymm3/m256/m64bcst and store packed 
ymm3/m256/m64bcst maximum values in ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 3D /r D VV AVX512F Compare packed signed qword integers in zmm2 and 
VPMAXSQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and store packed maximum 
zmm3/m512/m64bcst values in zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed signed byte, word, dword or qword integers in the second source operand 
and the first source operand and returns the maximum value for each pair of integers to the destination operand. 


Legacy SSE version PMAXSW: The source operand can be an MMX technology register or a 64-bit memory location. 
The destination operand can be an MMX technology register. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 

VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding destination 
register are zeroed. 

EVEX encoded VPMAXSD/Q: The first source operand is a ZMM/YMM/XMM register; The second source operand is 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is conditionally updated based on writemask k1. 

EVEX encoded VPMAXSB/W: The first source operand is a ZMM/YMM/XMM register; The second source operand is 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is conditionally updated 
based on writemask k1. 
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Operation 


PMAXSW (64-bit operands) 
IF DEST[15:0] > SRC[15:0]) THEN 
DEST[15:0] := DEST[15:0]; 
ELSE 
DEST[15:0] := SRC[15:0); Fl; 
(* Repeat operation for 2nd and 3rd words in source and destination operands *) 
IF DEST[63:48] > SRC[63:48]) THEN 
DEST[63:48] := DEST[63:48]; 
ELSE 
DEST[63:48] := SRC[63:48); FI; 


PMAXSB (128-bit Legacy SSE version) 
IF DEST[7:0] > SRC[7:0] THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[7:0] := SRC[7:0); Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF DEST[127:120] >SRC[127:120] THEN 
DEST[127:120] := DEST[127:1 20]; 
ELSE 
DEST[127:120] := SRC[127:1 20]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXSB (VEX.128 encoded version) 
IF SRC1[7:0] > SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[7:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF SRC1[127:120] >SRC2[127:120] THEN 
DEST[127:120] := SRC1[127:120]; 
ELSE 
DEST[127:120] := SRC2[127:1 20]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXSB (VEX.256 encoded version) 
IF SRC1[7:0] > SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[7:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 31st bytes in source and destination operands *) 
IF SRC1[255:248] >SRC2[255:248] THEN 
DEST[255:248] := SRC1[255:248]; 
ELSE 
DEST[255:248] := SRC2[255:248]; Fl; 
DEST[MAXVL-1:256] := 0 
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VPMAXSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+7:i] > SRC2[i+7:i] 
THEN DEST[i+7:i] = SRC1[i+7:i]; 
ELSE DEST[i+7:i] := SRC2[i+7:i]; 


Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PMAXSW (128-bit Legacy SSE version) 
IF DEST[15:0] >SRC[15:0] THEN 
DEST[15:0] := DEST[1 5:0]; 
ELSE 
DEST[15:0] := SRC[1 5:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:112] >SRC[127:112] THEN 
DEST[127:112] := DEST[127:112]; 
ELSE 
DEST[127:112] := SRC[127:112]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXSW (VEX.128 encoded version) 
IF SRC1[15:0] > SRC2[15:0] THEN 
DEST[15:0] := SRC1[1 5:0]; 
ELSE 
DEST[15:0] := SRC2[1 5:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF SRC1[127:112] >SRC2[127:112] THEN 
DEST[127:112] := SRC1[127:112]; 
ELSE 
DEST[127:112] := SRC2[127:112]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXSW (VEX.256 encoded version) 
IF SRC1[15:0] > SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); Fl; 
(* Repeat operation for 2nd through 15th words in source and destination operands *) 
IF SRC1[255:240] >SRC2[255:240] THEN 
DEST[255:240] := SRC1[255:240); 
ELSE 
DEST[255:240] := SRC2[255:240); Fl; 
DEST[MAXVL-1:256] := 0 
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VPMAXSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+15:i] > SRC2[i+15:i] 
THEN DEST{i+1 5:i] := SRC1[i+15:i]; 
ELSE DEST[i+15:i] := SRC2[i+1 5:1]; 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PMAXSD (128-bit Legacy SSE version) 
IF DEST[31:0] >SRC[31:0] THEN 
DEST[31:0] := DEST[3 1:0]; 
ELSE 
DEST[31:0] := SRC[3 1:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:96] >SRC[127:96] THEN 
DEST[1 27:96] := DEST[127:96]; 
ELSE 
DEST[1 27:96] := SRC[127:96]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXSD (VEX.128 encoded version) 
IF SRC1[31:0] > SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[3 1:0]; FI; 
(* Repeat operation for 2nd through 3rd dwords in source and destination operands *) 
IF SRC1[127:96] > SRC2[127:96] THEN 
DEST[1 27:96] := SRC1[127:96]; 
ELSE 
DEST[1 27:96] := SRC2[1 27:96]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXSD (VEX.256 encoded version) 
IF SRC1[31:0] > SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[31:0]; Fl; 
(* Repeat operation for 2nd through 7th dwords in source and destination operands *) 
IF SRC1[255:224] > SRC2[255:224] THEN 
DEST[255:224] := SRC1[255:224]; 
ELSE 
DEST[255:224] := SRC2[255:224); Fl; 
DEST[MAXVL-1:256] := 0 
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VPMAXSD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
IF SRC1[i+31:i] > SRC2[31:0] 
THEN DEST[i+31:i] = SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[3 1:0]; 
Fl; 
ELSE 
IF SRC1[i+31:i] > SRC2[i+31:i] 
THEN DEST[i+31:i] = SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[i+31:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPMAXSQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory”) 
THEN 
IF SRC1[i+63:i] > SRC2[63:0] 
THEN DEST[i+63:i] = SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[63:0]; 
Fl; 
ELSE 
IF SRC1[i+63:i] > SRC2[i+63:i] 
THEN DEST[i+63:i] = SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[i+63:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPMAXSB __m512i_mm512_max_epi8(__m512i a,__m512ib); 

VPMAXSB __m512i_mm512_mask_max_epi8(__m512is,__ mmask64 k,__m512ia,__m512i b); 
VPMAXSB __m512i_mm512_maskz_max_epi8(__mmask64 k,__m512ia,__m512i b); 
VPMAXSW __m512i_mm512_max_epi16(__m512i a,__m512ib); 

VPMAXSW __m512i_mm512_mask_max_epi16(__m512is,__ mmask32 k,__m512ia,__m512i b); 
VPMAXSW __m512i_mm512_maskz_max_epi16(__mmask32 k,__m512i a,__m512i b); 
VPMAXSB __m256i __mm256_mask_max_epi8(__m256i s,__ mmask32 k,___ m256i a, __ m256i b); 
VPMAXSB __m256i __mm256_maskz_max_epi8(__mmask32 k,__ m256i a, __ m256i b); 
VPMAXSW __m256i__mm256_mask_max_epi16(__m256is,__ mmask16 k,___ m256i a, __ m256i b); 
VPMAXSW __m256i __mm256_maskz_max_epi16(__mmask16 k,___ m256i a, __m256i b); 
VPMAXSB __m128i __mm_mask_max_epi8(__m128is,__ mmask16 k,___m128i a, __m128i b); 
VPMAXSB __m128i _mm_maskz_max_epi8(__mmask16 k,___m128i a, ___m128i b); 

VPMAXSW __m128i _mm_mask_max_epi16(__m128is,__ mmask8 k,___m128i a, ___m128i b); 
VPMAXSW __m128i __mm_maskz_max_epi16(__mmask8 k, __m128i a,__m128i b); 

VPMAXSD __m256i _mm256_mask_max_epi32(__m256i s,__ mmask16 k,__ m256i a, __m256i b); 
VPMAXSD __m256i __mm256_maskz_max_epi32(__mmask16 k,__ m256i a, ___m256i b); 
VPMAXSQ __m256i __mm256_mask_max_epi64(__m256i s,___mmask8 k, __m256i a, __m256i b); 
VPMAXSQ __m256i _mm256_maskz_max_epi64(__mmask8 k, __m256i a, __m256i b); 
VPMAXSD __m128i __mm_mask_max_epi32(__m128is,__ mmask8 k,___m128i a, ___m128i b); 
VPMAXSD __m128i __mm_maskz_max_epi32(__mmask8 k, __m128i a,__m128i b); 

VPMAXSQ __m128i _mm_mask_max_epi64(__m128i s,___mmask8 k, __m128i a, __m128i b); 
VPMAXSQ __m128i __mm_maskz_max_epu64(__mmask8 k, __m128i a, __m128i b); 

VPMAXSD __m512i__mm512_max_epi32(__m512i a,__m512i b); 

VPMAXSD __m512i__mm512_mask_max_epi32(__m512is,__ mmask16 k,__ m512i.a,__m512i b); 
VPMAXSD __m512i__mm512_maskz_max_epi32(__mmask16 k,__m512ia,__m512i b); 
VPMAXSQ __m512i __mm512_max_epi64(_m512i a, ___m512i b); 

VPMAXSQ __m512i __mm512_mask_max_epi64(__m512is, __ mmask8 k,__m512i a, ___m512i b); 
VPMAXSQ __m512i__mm512_maskz_max_epi64(_mmask8 k,__m512i a, __m512i b); 
(V)PMAXSB __m128i__mm_max_epi8 (__m128i a,__m128i b); 

(V)PMAXSW __m128i __mm_max_epi16 (__m128i a,__m128i b) 

(V)PMAXSD __m128i __mm_max_epi32 (__m128i a,__m128i b); 

VPMAXSB __m256i__mm256_max_epi8 (__m256i a, __ m256i b); 

VPMAXSW __m256i _mm256_max_epi16 (__m256i a, ___m256i b) 


VPMAXSD __m256i _mm256_max_epi32 (__m256i a, ___ m256i b); 


PMAXSW:__m64 __mm_max_pi16(__m64 a, __ m64 b) 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPMAXSD/Q, see Table 2-49, “Type E4 Class Exception Conditions”. 
EVEX-encoded VPMAXSB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PMAXUB/PMAXUW—Maximum of Packed Unsigned Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF DE /r A VIV SSE Compare unsigned byte integers in mm2/m64 and 
PMAXUB mm1, mm2/m64 mm 1 and returns maximum values. 
66 OF DE /r A VIV SSE2 Compare packed unsigned byte integers in xmm1 
PMAXUB xmm1, xmm2/m128 and xmm2/m128 and store packed maximum 
values in xmm1. 
66 OF 38 3E/r A VIV SSE4_1 Compare packed unsigned word integers in 
PMAXUW xmm1, xmm2/m128 xmm2/m128 and xmm1 and stores maximum 
packed values in xmm1. 
VEX.128.66.0F DE /r B VIV AVX Compare packed unsigned byte integers in xmm2 
VPMAXUB xmm1, xmm2, xmm3/m128 and xmm3/m128 and store packed maximum 
values in xmm1. 
VEX.128.66.0F38 3E/r B VIV AVX Compare packed unsigned word integers in 
VPMAXUW xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2 and store maximum 
packed values in xmm1. 
VEX.256.66.0F DE /r B VIV AVX2 Compare packed unsigned byte integers in ymm2 
VPMAXUB ymm1, ymm2, ymm3/m256 and ymm3/m256 and store packed maximum 
values in ymm1. 
VEX.256.66.0F38 3€/r B VIV AVX2 Compare packed unsigned word integers in 
VPMAXUW ymm1, ymm2, ymm3/m256 ymm3/m256 and ymme2 and store maximum 
packed values in ymm1. 
EVEX.128.66.0F.WIG DE /r C VIV AVX512VL_ | Compare packed unsigned byte integers in xmm2 
VPMAXUB xmm1{k1}{z}, xmm2, AVX512BW | and xmm3/m128 and store packed maximum 
xmm3/m128 values in xmm1 under writemask k1. 
EVEX.256.66.0F.WIG DE /r C VIN AVX512VL_ | Compare packed unsigned byte integers in ymm2 
VPMAXUB ymm1{k1}{z}, ymm2, AVX512BW | and ymm3/m256 and store packed maximum 
ymm3/m256 values in ymm1 under writemask k1. 
EVEX.512.66.0F.WIG DE /r C VIV AVX512BW | Compare packed unsigned byte integers in zmm2 
VPMAXUB zmm1{k1}{z}, zmm2, and zmm3/m512 and store packed maximum 
zmm3/m512 values in zmm1 under writemask k1. 
EVEX.128.66.0F38.WIG 3E /r C VIV AVX512VL_ | Compare packed unsigned word integers in xmm2 
VPMAXUW xmm1{k1}{z}, xmm2, AVX512BW | and xmm3/m128 and store packed maximum 
xmm3/m128 values in xmm1 under writemask k1. 
EVEX.256.66.0F38.WIG 3E /r C VIV AVX512VL_ | Compare packed unsigned word integers in ymm2 
VPMAXUW ymm1{k1}{z}, ymm2, AVX512BW | and ymm3/m256 and store packed maximum 
ymm3/m256 values in ymm1 under writemask k1. 
EVEX.512.66.0F38.WIG 3E /r C VIV AVX512BW | Compare packed unsigned word integers in zmm2 
VPMAXUW zmm1{k1}{z}, zmm2, and zmm3/m512 and store packed maximum 
zmm3/m512 values in zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX 
Registers” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Performs a SIMD compare of the packed unsigned byte, word integers in the second source operand and the first 
source operand and returns the maximum value for each pair of integers to the destination operand. 

Legacy SSE version PMAXUB: The source operand can be an MMX technology register or a 64-bit memory location. 
The destination operand can be an MMX technology register. 

128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 

VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand is conditionally updated 
based on writemask k1. 


Operation 


PMAXUB (64-bit operands) 
IF DEST[7:0] > SRC[17:0]) THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[7:0] := SRC[7:0]; Fl; 
(* Repeat operation for 2nd through 7th bytes in source and destination operands *) 
IF DEST[63:56] > SRC[63:56]) THEN 
DEST[63:56] := DEST[63:56]; 
ELSE 
DEST[63:56] := SRC[63:56); FI; 


PMAXUB (128-bit Legacy SSE version) 
IF DEST[7:0] >SRC[7:0] THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[15:0] := SRC[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF DEST[127:120] >SRC[127:120] THEN 
DEST[127:120] := DEST[127:1 20]; 
ELSE 
DEST[127:120] := SRC[127:1 20]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXUB (VEX.128 encoded version) 
IF SRC1[7:0] >SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[7:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF SRC1[127:120] >SRC2[127:120] THEN 
DEST[127:120] := SRC1[127:120]; 
ELSE 
DEST[127:120] := SRC2[127:1 20]; Fl; 
DEST[MAXVL-1:128] := 0 
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VPMAXUB (VEX.256 encoded version) 
IF SRC1[7:0] >SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[15:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 31st bytes in source and destination operands *) 
IF SRC1[255:248] >SRC2[255:248] THEN 
DEST[255:248] := SRC1[255:248]; 
ELSE 
DEST[255:248] := SRC2[255:248]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXUB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+7:i] > SRC2[i+7:i] 
THEN DEST[i+7:i] = SRC1[i+7:i]; 
ELSE DEST[i+7:i] := SRC2[i+7:i]; 


Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PMAXUW (128-bit Legacy SSE version) 
IF DEST[15:0] >SRC[15:0] THEN 
DEST[15:0] := DEST[1 5:0]; 
ELSE 
DEST[15:0] := SRC[1 5:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:112] >SRC[127:112] THEN 
DEST[127:112] := DEST[127:112]; 
ELSE 
DEST[127:112] := SRC[127:112]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXUW (VEX.128 encoded version) 
IF SRC1[15:0] > SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF SRC1[127:112] >SRC2[127:112] THEN 
DEST[127:112] := SRC1[127:112]; 
ELSE 
DEST[127:112] := SRC2[127:112]; Fl; 
DEST[MAXVL-1:128] := 0 


PMAXUB/PMAXUW—Maximum of Packed Unsigned Integers 


INSTRUCTION SET REFERENCE, M-U 


Vol.2B 4-327 


INSTRUCTION SET REFERENCE, M-U 


VPMAXUW (VEX.256 encoded version) 
IF SRC1[15:0] > SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); FI; 
(* Repeat operation for 2nd through 15th words in source and destination operands *) 
IF SRC1[255:240] >SRC2[255:240] THEN 
DEST[255:240] := SRC1[255:240]; 
ELSE 
DEST[255:240] := SRC2[255:240]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXUW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+15:i] > SRC2[i+15:i] 
THEN DEST{i+1 5:i] := SRC1[i+15:i]; 
ELSE DEST[i+15:i] := SRC2[i+1 5:1]; 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMAXUB __m512i_mm512_max_epu8(__m512i a,__m512i b); 

VPMAXUB __m512i_mm512_mask_max_epu8(__m512is,__ mmask64 k,___m512i a, __m512i b); 
VPMAXUB __m512i_mm512_maskz_max_epu8(__mmask64 k,__m512i a,__m512i b); 
VPMAXUW __m512i__mm512_max_epu16(__m512i a,__m512i b); 

VPMAXUW __m512i__mm512_mask_max_epu16(__m512is,__ mmask32 k,__m512i a,__m512ib); 
VPMAXUW __m512i__mm512_maskz_max_epu16(__mmask32 k,__m512i a,__m512i b); 


VPMAXUB __m256i __mm256_mask_max_epu8(__m256i s,___ mmask32 k,___ m256i a, __m256i b); 


VPMAXUB __m256i __mm256_maskz_max_epu8(__mmask32 k,__ m256i a, __m256i b); 
VPMAXUW __m256i _mm256_mask_max_epu16(__m256i s,__ mmask16 k,__ m256i a, ___ m256i b); 
VPMAXUW __m256i _mm256_maskz_max_epu16(__mmask16 k, _ m256i a, ___m256i b); 


VPMAXUB __m128i __mm_mask_max_epu8(__m128i s,__ mmask16 k,__m128i a,__m128ib); 
VPMAXUB __m128i __mm_maskz_max_epu8(__mmask16 k,__m128i a,__m128i b); 
VPMAXUW __m128i _mm_mask_max_epu16(__m128i s,___ mmask8 k, __m128i a,__m128i b); 
VPMAXUW __m128i __mm_maskz_max_epu16(__mmask8 k, __m128i a,__m128i b); 
(V)PMAXUB __m128i__mm_max_epu8 (__m128i a,__m128i b); 

(V)JPMAXUW __m128i __mm_max_epu16 (__m128i a,__m128i b) 

VPMAXUB __m256i__mm256_max_epu8 (__m256i a, __ m256i b); 

VPMAXUW __m256i _mm256_max_epu16 (__m256i a, ___m256i b); 

PMAXUB: __m64 _mm_max_pu8(__m64 a, ___m64 b); 
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SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PMAXUD/PMAXUQ—Maximum of Packed Unsigned Integers 


Opcode/ Op/ 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 38 3F /r A VIV SSE4_1 Compare packed unsigned dword integers in xmm1 
PMAXUD xmm1, xmm2/m128 and xmm2/m1 28 and store packed maximum values in 
xmm1. 
VEX.128.66.0F38.WIG 3F /r B VIV AVX Compare packed unsigned dword integers in xmm2 
VPMAXUD xmm1, xmm2, xmm3/m128 and xmm3/m1 28 and store packed maximum values in 
xmm1. 
VEX.256.66.0F38.WIG 3F /r B VIV AVX2 Compare packed unsigned dword integers in ymm2 
VPMAXUD ymm1, ymm2, ymm3/m256 and ymm3/m256 and store packed maximum values in 
ymm1. 
EVEX.128.66.0F38.W0O 3F /r C VIV AVX512VL | Compare packed unsigned dword integers in xmm2 
VPMAXUD xmm1 {k1}{z}, xmm2, AVX512F and xmm3/m128/m32bcst and store packed 
xmm3/m128/m32bcst maximum values in xmm1 under writemask k1. 
EVEX.256.66.0F38.W0 3F /r C VIN AVX512VL | Compare packed unsigned dword integers in ymm2 
VPMAXUD ymm1 {k1}{z}, ymm2, AVX512F and ymm3/m256/m32bcst and store packed 
ymm3/m256/m32bcst maximum values in ymm1 under writemask k1. 
EVEX.512.66.0F38.W0O 3F /r C VIV AVX512F Compare packed unsigned dword integers in zmm2 
VPMAXUD zmm1 {k1}{z}, zmm2, and zmm3/m512/m32bcst and store packed maximum 
zmm3/m512/m32bcst values in zmm1 under writemask k1. 
EVEX.128.66.0F38.W1 3F /r C VIV AVX512VL | Compare packed unsigned qword integers in xmm2 
VPMAXUQ xmm1 {k1}{z}, xmm2, AVX512F and xmm3/m128/m64bcst and store packed 
xmm3/m128/m64bcst maximum values in xmm1 under writemask k1. 
EVEX.256.66.0F38.W1 3F /r C VIV AVX512VL | Compare packed unsigned qword integers in ymm2 
VPMAXUQ ymm1 {k1}{z}, ymm2, AVX512F and ymm3/m256/m64bcst and store packed 
ymm3/m256/m64bcst maximum values in ymm1 under writemask k1. 
EVEX.512.66.0F38.W1 3F /r C VIV AVX512F Compare packed unsigned qword integers in zmm2 
VPMAXUQ zmm1 {k1}{z}, zmm2, and zmm3/m512/m64bcst and store packed maximum 
zmm3/m512/m64bcst values in zmm1 under writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed unsigned dword or qword integers in the second source operand and the 
first source operand and returns the maximum value for each pair of integers to the destination operand. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 

VEX.256 encoded version: The first source operand is a YMM register; The second source operand is a YMM register 
or 256-bit memory location. Bits (MAXVL-1:256) of the corresponding destination register are zeroed. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is conditionally updated based on writemask k1. 
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Operation 


PMAXUD (128-bit Legacy SSE version) 
IF DEST[31:0] >SRC[31:0] THEN 
DEST[31:0] := DEST[31:0]; 
ELSE 
DEST[31:0] := SRC[31:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:96] >SRC[127:96] THEN 
DEST[1 27:96] := DEST[127:96]; 
ELSE 
DEST[127:96] := SRC[127:96]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMAXUD (VEX.128 encoded version) 
IF SRC1[31:0] > SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[31:0]; Fl; 
(* Repeat operation for 2nd through 3rd dwords in source and destination operands *) 
IF SRC1[127:96] > SRC2[127:96] THEN 
DEST[1 27:96] := SRC1[127:96]; 
ELSE 
DEST[1 27:96] := SRC2[127:96]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMAXUD (VEX.256 encoded version) 
IF SRC1[31:0] > SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[31:0]; Fl; 
(* Repeat operation for 2nd through 7th dwords in source and destination operands *) 
IF SRC1[255:224] > SRC2[255:224] THEN 
DEST[255:224] := SRC1[255:224]; 
ELSE 
DEST[255:224] := SRC2[255:224]; Fl; 
DEST[MAXVL-1:256] := 0 
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VPMAXUD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
IF SRC1[i+31:i] > SRC2[31:0] 
THEN DEST[i+31:i] := SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[31:0]; 
Fl; 
ELSE 
IF SRC1[i+31:i] > SRC2[i+31:i] 
THEN DEST[i+31:i] := SRC1[i+31:i]; 
ELSE DEST[i+31:i] = SRC2[i+31:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPMAXUQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
IF SRC1[i+63:i] > SRC2[63:0] 
THEN DEST[i+63:i] := SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[63:0]; 
Fl; 
ELSE 
IF SRC1[i+31:i] > SRC2[i+31:i] 
THEN DEST[i+63:i] := SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[i+63:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPMAXUD __m512i__mm512_max_epu32(__m512i a,__m512ib); 
VPMAXUD __m512i__mm512_mask_max_epu32(__m512is,___ mmask16 k, 
VPMAXUD __m512i__mm512_maskz_max_epu32(__mmask16 k,__m512i a,__m512i b); 
VPMAXUQ __m512i__mm512_max_epu64(__m512i a, __m512i b); 

VPMAXUQ __m512i __mm512_mask_max_epu64(__m512i s,___mmask8 k,__m512ia, 
VPMAXUQ __m512i __mm512_maskz_max_epu64(__mmask8 k,___m512i a, ___m512i b); 


VPMAXUD __m256i __mm256_mask_max_epu32(__m256i s,__ mmask16 k,__ m256i a, ___m256i b); 


VPMAXUD __m256i __mm256_maskz_max_epu32(__mmask16 k,__ m256i a, ___m256i b); 
VPMAXUQ __m256i __mm256_mask_max_epu64(__m256i s,___mmask8 k, __m256i a, 
VPMAXUQ __m256i _mm256_maskz_max_epu64(__mmask8 k, __m256i a, __m256i b); 
VPMAXUD __m128i __mm_mask_max_epu32(__m128is,___mmask8 k,__m128i a,__m128i b); 
VPMAXUD __m128i _mm_maskz_max_epu32(__mmask8 k, __m128i a, ___m128i b); 
VPMAXUQ __m128i _mm_mask_max_epu64(__m128i s, __ mmask8 k, __m128i a,__m128i b); 
VPMAXUQ __m128i __mm_maskz_max_epu64(__mmask8 k, __m128i a, __m128i b); 
(V)PMAXUD __m128i__mm_max_epu32 (__m128i a, __m128i b); 

VPMAXUD __m256i __mm256_max_epu32 (__m256i a,___ m256i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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m512ia,__m512ib); 


m512i b); 


m256i b); 
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PMINSB/PMINSW—Minimum of Packed Signed Integers 


VPMINSW zmm1{k1}{z}, zmm2, 
zmm3/m512 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF EA /r! A VV SSE Compare signed word integers in mm2/m64 and mm1 
PMINSW mm1, mm2/m64 and return minimum values. 
66 OF 38 38 /r A VIV SSE4_1 Compare packed signed byte integers in xmm1 and 
PMINSB xmm1, xmm2/m128 xmm_2/m128 and store packed minimum values in 
xmm1. 
66 OF EA /r A VIV SSE2 Compare packed signed word integers in xmm2/m128 
PMINSW xmm1, xmm2/m128 and xmm1 and store packed minimum values in xmm1. 
VEX.128.66.0F38 38 /r B VIV AVX Compare packed signed byte integers in xmme2 and 
VPMINSB xmm1, xmm2, xmm3/m128 xmm3/m128 and store packed minimum values in 
xmm1. 
VEX.128.66.0F EA /r B VV AVX Compare packed signed word integers in xmm3/m128 
VPMINSW xmm1, xmm2, xmm3/m128 and xmm2 and return packed minimum values in 
xmm1. 
VEX.256.66.0F38 38 /r B VIV AVX2 Compare packed signed byte integers in ymm2 and 
VPMINSB ymm1, ymm2, ymm3/m256 ymm3/m256 and store packed minimum values in 
ymm1. 
VEX.256.66.0F EA /r B VIV AVX2 Compare packed signed word integers in ynm3/m256 
VPMINSW ymm1, ymm2, ymm3/m256 and ymm2 and return packed minimum values in 
ymm1. 
EVEX.1 28.66.0F38.WIG 38 /r C VIV AVX512VL | Compare packed signed byte integers in xmm2 and 
VPMINSB xmm1{k1}{z}, xmm_2, AVX512BW | xmm3/m128 and store packed minimum values in 
xmm3/m128 xmm1 under writemask k1. 
EVEX.256.66.0F38.WIG 38 /r C VIN AVX512VL_ | Compare packed signed byte integers in ymm2 and 
VPMINSB ymm1{k1}{z}, ymm2, AVX512BW | ymm3/m256 and store packed minimum values in 
ymm3/m256 ymm1 under writemask k1. 
EVEX.512.66.0F38.WIG 38 /r C VIV AVX512BW | Compare packed signed byte integers in zmm2 and 
VPMINSB zmm1{k1}{z}, zmm2, zmm3/m512 and store packed minimum values in 
zmm3/m512 zmm1 under writemask k1. 
EVEX.128.66.0F.WIG EA /r C VIV AVX512VL | Compare packed signed word integers in xmm2 and 
VPMINSW xmm1{k1}{z}, xmm2, AVX512BW | xmm3/m128 and store packed minimum values in 
xmm3/m128 xmm1 under writemask k1. 
EVEX.256.66.0F.WIG EA /r C VIV AVX512VL_ | Compare packed signed word integers in ymm2 and 
VPMINSW ymm1{k1}{z}, ymm2, AVX512BW | ymm3/m256 and store packed minimum values in 
ymm3/m256 ymm1 under writemask k1. 
EVEX.512.66.0F.WIG EA /r C VIV AVX512BW | Compare packed signed word integers in zmm2 and 


zmm3/m512 and store packed minimum values in 
zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX 


Registers” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Performs a SIMD compare of the packed signed byte, word, or dword integers in the second source operand and 
the first source operand and returns the minimum value for each pair of integers to the destination operand. 
Legacy SSE version PMINSW: The source operand can be an MMxX technology register or a 64-bit memory location. 
The destination operand can be an MMX technology register. 

128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 

VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand is conditionally updated 
based on writemask k1. 


Operation 


PMINSW (64-bit operands) 
IF DEST[15:0] < SRC[15:0] THEN 
DEST[15:0] := DEST[1 5:0]; 
ELSE 
DEST[15:0] := SRC[1 5:0]; Fl; 
(* Repeat operation for 2nd and 3rd words in source and destination operands *) 
IF DEST[63:48] < SRC[63:48] THEN 
DEST[63:48] := DEST[63:48]; 
ELSE 
DEST[63:48] := SRC[63:48]; Fl; 


PMINSB (128-bit Legacy SSE version) 
IF DEST[7:0] < SRC[7:0] THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[1 5:0] := SRC[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF DEST[127:120] < SRC[127:120] THEN 
DEST[127:1 20] := DEST[127:120]; 
ELSE 
DEST[127:120] := SRC[127:1 20); Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINSB (VEX.128 encoded version) 
IF SRC1[7:0] < SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[7:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF SRC1[127:120] < SRC2[127:120] THEN 
DEST[127:1 20] := SRC1[127:120]; 
ELSE 
DEST[127:120] := SRC2[127:120]; Fl; 
DEST[MAXVL-1:128] := 0 
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VPMINSB (VEX.256 encoded version) 
IF SRC1[7:0] < SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[15:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 31st bytes in source and destination operands *) 
IF SRC1[255:248] < SRC2[255:248] THEN 
DEST[255:248] := SRC1[255:248]; 
ELSE 
DEST[255:248] := SRC2[255:248]; Fl; 
DEST[MAXVL-1:256] := 0 


VPMINSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+7:i] < SRC2[i+7:i] 
THEN DEST[i+7:i] := SRC1[i+7:i]; 
ELSE DEST[i+7:i] := SRC2[i+7:i]; 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+7:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PMINSW (128-bit Legacy SSE version) 
IF DEST[15:0] < SRC[15:0] THEN 
DEST[15:0] := DEST[15:0]; 
ELSE 
DEST[15:0] := SRC[1 5:0; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:112] < SRC[127:112] THEN 
DEST[127:112] := DEST[127:112]; 
ELSE 
DEST[127:112] := SRC[127:112]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINSW (VEX.128 encoded version) 
IF SRC1[15:0] < SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); FI; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF SRC1[127:112] < SRC2[127:112] THEN 
DEST[127:112] := SRC1[127:112]; 
ELSE 
DEST[127:112] := SRC2[127:112]; Fl; 
DEST[MAXVL-1:128] := 0 
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VPMINSW (VEX.256 encoded version) 
IF SRC1[15:0] < SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); Fl; 


(* Repeat operation for 2nd through 15th words in source and destination operands *) 


IF SRC1[255:240] < SRC2[255:240] THEN 
DEST[255:240] := SRC1[255:240]; 
ELSE 
DEST[255:240] := SRC2[255:240]; Fl; 
DEST[MAXVL-1:256] := 0 


VPMINSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+15:i] < SRC2[i+15:i] 
THEN DEST[i+1 5:i] = SRC1[i+15:i]; 
ELSE DEST{i+15:i] := SRC2[i+1 5:i]; 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMINSB __m512i_mm512_min_epi8(__m512i a, ___m512i b); 
VPMINSB __m512i_mm512_mask_min_epi8(__m512i s,___mmask64 k, 
VPMINSB __m512i_mm512_maskz_min_epi8(__mmask64 k,__m512ia, 
VPMINSW __m512i_mm512_min_epi16(__m512i a, __m512i b); 

VPMINSW __m512i_mm512_mask_min_epi16(__m512i s, 
VPMINSW __m512i_mm512_maskz_min_epi16(__mmask32 k, 


m512ia, 


VPMINSB __m256i __mm256_mask_min_epi8(__m256i s,__ mmask32 k,___ m256i a, __m256i b); 


VPMINSB __m256i __mm256_maskz_min_epi8(__mmask32 k, 
VPMINSW __m256i _mm256_mask_min_epi16(__m256i s, 
VPMINSW __m256i__mm256_maskz_min_epi16(__mmask16 k, 
VPMINSB __m128i __mm_mask_min_epi8(__m128i s, 


m256i a, 


m256i a, 


VPMINSB __m128i _mm_maskz_min_epi8(__mmask16 k,___m128i a, 
VPMINSW __m128i __mm_mask_min_epi16(__m128i s, 
VPMINSW __m128i __mm_maskz_min_epi16(__mmask8 k, __m128i a, 


(V)PMINSB __m128i__mm_min_epi8 (__m128i a,__m128i b); 
(V)PMINSW __m128i _mm_min_epi16 (__m128i a, ___m128i b) 
VPMINSB __m256i __mm256_min_epi8 (__m256i a, __m256i b); 
VPMINSW __m256i__mm256_min_epi16 (__m256i a, __m256i b) 
PMINSW:__m64__mm_min_pi16 (__m64 a,___ m64 b) 


PMINSB/PMINSW—Minimum of Packed Signed Integers 


m512i a,__m512ib); 


mmask32 k,__m512i a,__m512i b); 


mmask16 k,__m256i a, __m256i b); 


mmask16 k,___m128i a,__m128i b); 
m1 28i b); 
mmask8 k,___m128i a,__m128i b); 
m1 28i b); 
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SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
Additionally: 

#MF (64-bit operations only) If there is a pending x87 FPU exception. 
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PMINSD/PMINSQ—Minimum of Packed Signed Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 38 39 /r A VIV SSE4_1 Compare packed signed dword integers in xmm1 and 
PMINSD xmm1, xmm2/m128 xmm_2/m128 and store packed minimum values in 
xmm1. 
VEX.128.66.0F38.WIG 39 /r B VV AVX Compare packed signed dword integers in xmm2 and 
VPMINSD xmm1, xmm2, xmm3/m128 xmm3/m128 and store packed minimum values in 
xmm1. 
VEX.256.66.0F38.WIG 39 /r B VV AVX2 Compare packed signed dword integers in ymm2 and 
VPMINSD ymm1, ymm2, ymm3/m256 ymm3/m128 and store packed minimum values in 
ymm1. 
EVEX.128.66.0F38.W0 39 /r C VV AVX512VL_ | Compare packed signed dword integers in xmm2 and 
VPMINSD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128 and store packed minimum values in 
xmm3/m128/m32bcst xmm1 under writemask k1. 
EVEX.256.66.0F38.W0 39 /r C VIN AVX512VL | Compare packed signed dword integers in ymm2 and 
VPMINSD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256 and store packed minimum values in 
ymm3/m256/m32bcst ymm1 under writemask k1. 
EVEX.512.66.0F38.W0 39 /r C VV AVX512F Compare packed signed dword integers in zmm2 and 
VPMINSD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and store packed minimum 
zmm3/m512/m32bcst values in zmm1 under writemask k1. 
EVEX.128.66.0F38.W1 39 /r C VV AVX512VL_ | Compare packed signed qword integers in xmm2 and 
VPMINSQ xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128 and store packed minimum values in 
xmm3/m128/m64bcst xmm1 under writemask k1. 
EVEX.256.66.0F38.W1 39 /r C VV AVX512VL_ | Compare packed signed qword integers in ymm2 and 
VPMINSQ ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256 and store packed minimum values in 
ymm3/m256/m64bcst ymm1 under writemask k1. 
EVEX.512.66.0F38.W1 39 /r C VIV AVX512F Compare packed signed qword integers in zmm2 and 
VPMINSQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and store packed minimum 
zmm3/m512/m64bcst values in zmm1 under writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed signed dword or qword integers in the second source operand and the first 
source operand and returns the minimum value for each pair of integers to the destination operand. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 


VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding destination 
register are zeroed. 
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EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is conditionally updated based on writemask k1. 


Operation 


PMINSD (128-bit Legacy SSE version) 
IF DEST[31:0] < SRC[31:0] THEN 
DEST[31:0] := DEST[3 1:0]; 
ELSE 
DEST[31:0] := SRC[3 1:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:96] < SRC[127:96] THEN 
DEST[1 27:96] := DEST[127:96]; 
ELSE 
DEST[1 27:96] := SRC[127:96]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINSD (VEX.128 encoded version) 
IF SRC1[31:0] < SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[3 1:0]; FI; 
(* Repeat operation for 2nd through 3rd dwords in source and destination operands *) 
IF SRC1[127:96] < SRC2[127:96] THEN 
DEST[1 27:96] := SRC1[127:96]; 
ELSE 
DEST[1 27:96] := SRC2[127:96]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMINSD (VEX.256 encoded version) 
IF SRC1[31:0] < SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[3 1:0]; FI; 
(* Repeat operation for 2nd through 7th dwords in source and destination operands *) 
IF SRC1[255:224] < SRC2[255:224] THEN 
DEST[255:224] := SRC1[255:224]; 
ELSE 
DEST[255:224] := SRC2[255:224]; Fl; 
DEST[MAXVL-1:256] := 0 
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VPMINSD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
IF SRC1[i+31:i] < SRC2[31:0] 
THEN DEST[i+31:i] = SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[3 1:0]; 
Fl; 
ELSE 
IF SRC1[i+31:i] < SRC2[i+31:i] 
THEN DEST[i+31:i] = SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[i+31:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPMINSQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory”) 
THEN 
IF SRC1[i+63:i] < SRC2[63:0] 
THEN DEST[i+63:i] = SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[63:0]; 
Fl; 
ELSE 
IF SRC1[i+63:i] < SRC2[i+63:i] 
THEN DEST[i+63:i] = SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[i+63:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


mmask16 k,__m512ia,__m512ib); 
mm512_maskz_min_epi32(__mmask16 k,__m512i a,__m512i b); 


m512i b); 


mm512_mask_min_epi64(__m512is,__ mmask8 k,__m512i a, _m512ib); 


m512ia,__m512ib); 


mmask16 k,__m256i a, __m256i b); 


mm256_maskz_min_epi32(__mmask16 k,__ m256i a, __m256i b); 


mm256_mask_min_epi64(__m256is,___ mmask8 k,__ m256i a, __m256i b); 
m256i a,__m256i b); 


mmask8 k,___m128i a,___m128i b); 


m128i a,__m128i b); 


mm_mask_min_epi64(__m128is,___mmask8 k,__m128i a,__m128i b); 


m128i a,__m128i b); 


VPMINSD __m512i_mm512_min_epi32(__m512i a, ___m512i b); 
VPMINSD __m512i_mm512_mask_min_epi32(__m512is, 
VPMINSD __m512i 

VPMINSQ __m512i_mm512_min_epi64(__m512ia, 
VPMINSQ __m512i 

VPMINSQ __m512i__mm512_maskz_min_epi64(__mmask8 k, 
VPMINSD __m256i __mm256_mask_min_epi32(__m256i s, 
VPMINSD __m256i 

VPMINSQ __m256i 

VPMINSQ __m256i _mm256_maskz_min_epi64(__mmask8 k, 
VPMINSD __m128i __mm_mask_min_epi32(__m128i s, 
VPMINSD __m128i __mm_maskz_min_epi32(__mmask8 k, 
VPMINSQ __m128i 

VPMINSQ __m128i _mm_maskz_min_epu64(__mmask8 k, 
(V)PMINSD __m128i __mm_min_epi32 (__m128i a,___m128i b); 
VPMINSD __m256i__mm256_min_epi32 (__m256i a, 


m256i b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

NP OF DA/r' A VIV SSE Compare unsigned byte integers in mm2/m64 and 

PMINUB mm1, mm2/m64 mm 1 and returns minimum values. 

66 OF DA /r A VIV SSE2 Compare packed unsigned byte integers in xmm1 

PMINUB xmm1, xmm2/m128 and xmm2/m1 28 and store packed minimum values 
in xmm1. 

66 OF 38 3A/r A VIV SSE4_1 Compare packed unsigned word integers in 

PMINUW xmm1, xmm2/m128 xmm2/m128 and xmm1 and store packed minimum 
values in xmm1. 

VEX.128.66.0F DA /r B VIV AVX Compare packed unsigned byte integers in xmm2 

VPMINUB xmm1, xmm2, xmm3/m128 and xmm3/m1 28 and store packed minimum values 
in xmm1. 

VEX.128.66.0F38 3A/r B VIV AVX Compare packed unsigned word integers in 

VPMINUW xmm1, xmm2, xmm3/m128 xmm3/m128 and xmm2 and return packed 
minimum values in xmm1. 

VEX.256.66.0F DA /r B VIV AVX2 Compare packed unsigned byte integers in ymm2 

VPMINUB ymm1, ymm2, ymm3/m256 and ymm3/m256 and store packed minimum values 
in ymm1. 

VEX.256.66.0F38 3A/r B VIV AVX2 Compare packed unsigned word integers in 

VPMINUW ymm1, ymm2, ymm3/m256 ymm3/m256 and ymm2 and return packed 
minimum values in ymm1. 

EVEX.128.66.0F DA /r C VIV AVX512VL Compare packed unsigned byte integers in xmm2 

VPMINUB xmm1 {k1}{z}, xmm2, AVX512BW | and xmm3/m128 and store packed minimum values 

xmm3/m128 in xmm1 under writemask k1. 

EVEX.256.66.0F DA /r C VIN AVX512VL Compare packed unsigned byte integers in ymm2 

VPMINUB ymm1 {k1}{z}, ymm2, AVX512BW | and ymm3/m256 and store packed minimum values 

ymm3/m256 in ymm1 under writemask k1. 

EVEX.512.66.0F DA /r C VIV AVX512BW | Compare packed unsigned byte integers in zmm2 

VPMINUB zmm1 {k1}{z}, zmm2, and zmm3/m512 and store packed minimum values 

zmm3/m512 in zmm1 under writemask k1. 

EVEX.128.66.0F38 3A/r C VIV AVX512VL Compare packed unsigned word integers in 

VPMINUW xmm1{k1}{z}, xmm2, AVX512BW | xmm3/m128 and xmm2 and return packed 

xmm3/m128 minimum values in xmm1 under writemask k1. 

EVEX.256.66.0F38 3A/r C VIV AVX512VL Compare packed unsigned word integers in 

VPMINUW ymm1{k1}{z}, ymm2, AVX512BW | ymm3/m256 and ymm2 and return packed 

ymm3/m256 minimum values in ymm1 under writemask k1. 

EVEX.512.66.0F38 3A/r C VIV AVX512BW | Compare packed unsigned word integers in 

VPMINUW zmm1{k1}{z}, zmm2, zmm3/m512 and zmm2 and return packed 

zmm3/m512 minimum values in zmm1 under writemask k1. 

NOTES: 

1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 

Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX 

Registers” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Performs a SIMD compare of the packed unsigned byte or word integers in the second source operand and the first 
source operand and returns the minimum value for each pair of integers to the destination operand. 

Legacy SSE version PMINUB: The source operand can be an MMX technology register or a 64-bit memory location. 
The destination operand can be an MMX technology register. 

128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 

VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand is conditionally updated 
based on writemask k1. 


Operation 


PMINUB (for 64-bit operands) 
IF DEST[7:0] < SRC[17:0] THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[7:0] := SRC[7:0); FA; 
(* Repeat operation for 2nd through 7th bytes in source and destination operands *) 
IF DEST[63:56] < SRC[63:56] THEN 
DEST[63:56] := DEST[63:56]; 
ELSE 
DEST[63:56] := SRC[63:56); FI; 


PMINUB instruction for 128-bit operands: 
IF DEST[7:0] < SRC[7:0] THEN 
DEST[7:0] := DEST[7:0]; 
ELSE 
DEST[1 5:0] := SRC[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF DEST[127:120] < SRC[127:120] THEN 
DEST[127:120] := DEST[127:1 20]; 
ELSE 
DEST[127:120] := SRC[127:1 20]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINUB (VEX.128 encoded version) 
IF SRC1[7:0] < SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[7:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 15th bytes in source and destination operands *) 
IF SRC1[127:120] < SRC2[127:120] THEN 
DEST[127:120] := SRC1[127:120]; 
ELSE 
DEST[127:120] := SRC2[127:1 20]; Fl; 
DEST[MAXVL-1:128] := 0 
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VPMINUB (VEX.256 encoded version) 
IF SRC1[7:0] < SRC2[7:0] THEN 
DEST[7:0] := SRC1[7:0]; 
ELSE 
DEST[15:0] := SRC2[7:0]; Fl; 
(* Repeat operation for 2nd through 31st bytes in source and destination operands *) 
IF SRC1[255:248] < SRC2[255:248] THEN 
DEST[255:248] := SRC1[255:248]; 
ELSE 
DEST[255:248] := SRC2[255:248]; Fl; 
DEST[MAXVL-1:256] := 0 


VPMINUB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+7:i] < SRC2[i+7:i] 
THEN DEST[i+7:i] = SRC1[i+7:i]; 
ELSE DEST[i+7:i] := SRC2[i+7:i]; 


Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


PMINUW instruction for 128-bit operands: 
IF DEST[15:0] < SRC[15:0] THEN 
DEST[15:0] := DEST[1 5:0]; 
ELSE 
DEST[15:0] := SRC[1 5:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:112] < SRC[127:112] THEN 
DEST[127:112] := DEST[127:112]; 
ELSE 
DEST[127:112] := SRC[127:112]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINUW (VEX.128 encoded version) 
IF SRC1[15:0] < SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF SRC1[127:112] < SRC2[127:112] THEN 
DEST[127:112] := SRC1[127:112]; 
ELSE 
DEST[127:112] := SRC2[127:112]; Fl; 
DEST[MAXVL-1:128] := 0 
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INSTRUCTION SET REFERENCE, M-U 


VPMINUW (VEX.256 encoded version) 
IF SRC1[15:0] < SRC2[15:0] THEN 
DEST[15:0] := SRC1[15:0]; 
ELSE 
DEST[15:0] := SRC2[15:0); FI; 
(* Repeat operation for 2nd through 15th words in source and destination operands *) 
IF SRC1[255:240] < SRC2[255:240] THEN 
DEST[255:240] := SRC1[255:240]; 
ELSE 
DEST[255:240] := SRC2[255:240]; Fl; 
DEST[MAXVL-1:256] := 0 


VPMINUW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* THEN 
IF SRC1[i+15:i] < SRC2[i+15:i] 
THEN DEST[i+1 5:i] := SRC1[i+15:i]; 
ELSE DEST[i+15:i] := SRC2[i+1 5:1]; 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMINUB __m512i_mm512_min_epu8(__m512i a,__m512i b); 
VPMINUB __m512i_mm512_mask_min_epu8(__m512is,__ mmask64 k,__m512i a,__m512ib); 


VPMINUB __m512i_mm512_maskz_min_epu8(__mmask64 k,___m512i a,__m512i b); 

VPMINUW __m512i_mm512_min_epu16(__m512ia,__m512i b); 

VPMINUW __m512i_mm512_mask_min_epu16(__m512is,__ mmask32 k,__m512i a,__m512i b); 
VPMINUW __m512i__mm512_maskz_min_epu16(__mmask32 k,___m512i a,__m512i b); 


VPMINUB __m256i __mm256_mask_min_epu8(__m256i s,___ mmask32 k,__ m256i a, __m256i b); 


VPMINUB __m256i __mm256_maskz_min_epu8(__mmask32 k,___m256i a, ___ m256i b); 
VPMINUW __m256i__mm256_mask_min_epu16(__m256is,__ mmask16 k,___ m256i a,___ m256i b); 
VPMINUW __m256i__mm256_maskz_min_epu16(__mmask16 k,___ m256i a, __ m256i b); 


VPMINUB __m128i _mm_mask_min_epu8(__m128i s,__ mmask16 k, __m128i a,___m128i b); 


VPMINUB __m128i __mm_maskz_min_epu8(__mmask16 k,___m128i a,__m128i b); 
VPMINUW __m128i__mm_mask_min_epu16(__m128is,__ mmask8 k,__m128i a,__m128i b); 
VPMINUW __m128i __mm_maskz_min_epu16(__mmask8 k,__m128i a,__m128i b); 


(V)PMINUB __m128i __mm_min_epu8 (__m128i a,__m128i b) 
(V)PMINUW __m128i _mm_min_epu16 (__m128i a, __m128i b); 
VPMINUB __m256i__mm256_min_epu8 (__m256i a,___m256i b) 
VPMINUW __m256i__mm256_min_epu16 (__m256i a, ___m256i b); 
PMINUB: __m64 _m_min_pu8 (__m64 a,__m64 b) 
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SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PMINUD/PMINUQ—Minimum of Packed Unsigned Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
66 OF 38 3B /r A VIV SSE4_1 Compare packed unsigned dword integers in xmm1 and 
PMINUD xmm1, xmm2/m128 xmm2/m128 and store packed minimum values in xmm1. 
VEX.128.66.0F38.WIG 3B /r B VIV AVX Compare packed unsigned dword integers in xmm2 and 
VPMINUD xmm1, xmm2z, xmm3/m128 and store packed minimum values in xmm1. 
xmm3/m128 
VEX.256.66.0F38.WIG 3B /r B VIV AVX2 Compare packed unsigned dword integers in ymm2 and 
VPMINUD ymm1, ymm2, ymm3/m256 and store packed minimum values in ymm1. 
ymm3/m256 
EVEX.128.66.0F38.W0 3B /r C VIV AVX512VL | Compare packed unsigned dword integers in xmm2 and 
VPMINUD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m1 28/m32bcst and store packed minimum values 
xmm3/m128/m32bcst in xmm1 under writemask k1. 
EVEX.256.66.0F38.W0 3B /r C VIV AVX512VL | Compare packed unsigned dword integers in ymm2 and 
VPMINUD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and store packed minimum values 
ymm3/m256/m32bcst in ymm1 under writemask k1. 
EVEX.512.66.0F38.W0 3B /r C VIV AVX512F Compare packed unsigned dword integers in zmme and 
VPMINUD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and store packed minimum values 
zmm3/m512/m32bcst in zmm1 under writemask k1. 
EVEX.128.66.0F38.W1 3B /r C VIV AVX512VL | Compare packed unsigned qword integers in xmm2 and 
VPMINUQ xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst and store packed minimum values 
xmm3/m128/m64bcst in xmm1 under writemask k1. 
EVEX.256.66.0F38.W1 3B /r C VIV AVX512VL | Compare packed unsigned qword integers in ymm2 and 
VPMINUQ ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst and store packed minimum values 
ymm3/m256/m64bcst in ymm1 under writemask k1. 
EVEX.512.66.0F38.W1 3B /r C VIV AVX512F Compare packed unsigned qword integers in zmme and 
VPMINUQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and store packed minimum values 
zmm3/m512/m64bcst in zmm1 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed unsigned dword/qword integers in the second source operand and the first 
source operand and returns the minimum value for each pair of integers to the destination operand. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination 
register are zeroed. 


VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding destination 
register are zeroed. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register; The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is conditionally updated based on writemask k1. 
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Operation 


PMINUD (128-bit Legacy SSE version) 
PMINUD instruction for 128-bit operands: 
IF DEST[31:0] < SRC[31:0] THEN 
DEST[31:0] := DEST[31:0]; 
ELSE 
DEST[31:0] := SRC[31:0]; Fl; 
(* Repeat operation for 2nd through 7th words in source and destination operands *) 
IF DEST[127:96] < SRC[127:96] THEN 
DEST[1 27:96] := DEST[127:96]; 
ELSE 
DEST[1 27:96] := SRC[127:96]; Fl; 
DEST[MAXVL-1:128] (Unmodified) 


VPMINUD (VEX.128 encoded version) 
VPMINUD instruction for 128-bit operands: 
IF SRC1[31:0] < SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[31:0]; Fl; 
(* Repeat operation for 2nd through 3rd dwords in source and destination operands *) 
IF SRC1[127:96] < SRC2[127:96] THEN 
DEST[1 27:96] := SRC1[127:96]; 
ELSE 
DEST[127:96] := SRC2[127:96]; Fl; 
DEST[MAXVL-1:128] := 0 


VPMINUD (VEX.256 encoded version) 
VPMINUD instruction for 128-bit operands: 
IF SRC1[31:0] < SRC2[31:0] THEN 
DEST[31:0] := SRC1[31:0]; 
ELSE 
DEST[31:0] := SRC2[31:0]; Fl; 
(* Repeat operation for 2nd through 7th dwords in source and destination operands *) 
IF SRC1[255:224] < SRC2[255:224] THEN 
DEST[255:224] := SRC1[255:224]; 
ELSE 
DEST[255:224] := SRC2[255:224]; Fl; 
DEST[MAXVL-1:256] := 0 
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VPMINUD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
IF SRC1[i+31:i] < SRC2[31:0] 
THEN DEST[i+31:i] := SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[31:0]; 
Fl; 
ELSE 
IF SRC1[i+31:i] < SRC2[i+31:i] 
THEN DEST[i+31:i] := SRC1[i+31:i]; 
ELSE DEST[i+31:i] := SRC2[i+31:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPMINUQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
IF SRC1[i+63:i] < SRC2[63:0] 
THEN DEST[i+63:i] := SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[63:0]; 
Fl; 
ELSE 
IF SRC1[i+63:i] < SRC2[i+63:i] 
THEN DEST[i+63:i] := SRC1[i+63:i]; 
ELSE DEST[i+63:i] := SRC2[i+63:i]; 


Fl; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPMINUD __m512i_mm512_min_epu32(__m512ia,__m512ib); 
VPMINUD __m512i_mm512_mask_min_epu32(__m512is,__mmask16 k, 
VPMINUD __m512i__mm512_maskz_min_epu32(__mmask16 k,___m512i a, 
VPMINUQ __m512i__mm512_min_epu64(__m512i a,__m512ib); 


m512ia, 
m512i b); 


VPMINUQ __m512i__mm512_mask_min_epu64(__m512i s, __mmask8 k,___m512i a,_m512i b); 


VPMINUQ __m512i_mm512_maskz_min_epu64(__mmask8 k, 
VPMINUD __m256i __mm256_mask_min_epu32(__m256i s, 
VPMINUD __m256i __mm256_maskz_min_epu32(__mmask16 k, 


m512ia,__m512ib); 


m256i a, _m256i b); 


VPMINUQ __m256i _mm256_mask_min_epu64(__m256i s, __mmask8 k, __m256i a, __m256i b); 


VPMINUQ __m256i __mm256_maskz_min_epu64(___mmask8 k, __m256i a, __m256i b); 
VPMINUD __m128i__mm_mask_min_epu32(__m128is,___mmask8 k,___m128i a,__m128i b); 
VPMINUD __m128i__mm_maskz_min_epu32(__mmask8 k,___m128i a, ___m128i b); 
VPMINUQ __m128i __mm_mask_min_epu64(__m128i s,___mmask8 k, __m128i a, ___m128i b); 
VPMINUQ __m128i__mm_maskz_min_epu64(__mmask8 k, __m128i a, __m128i b); 
(V)PMINUD __m128i__mm_min_epu32 (__m128i a,__m128i b); 

VPMINUD __m256i__mm256_min_epu32 (__m256i a,__m256i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


m512i b); 


mmask16 k,__m256i a, __m256i b); 
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Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PMOVMSKB—Move Byte Mask 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF D7 /r RM |V/V SSE Move a byte mask of mm to reg. The upper 
PMOVMSKB reg, mm bits of r32 or r64 are zeroed 
66 OF D7 /r RM |V/V SSE2 Move a byte mask of xmm to reg. The upper 
PMOVMSKB reg, xmm bits of r32 or r64 are zeroed 
VEX.128.66.0F.WIG D7 /r RM | V/V AVX Move a byte mask of xmm17 to reg. The upper 
VPMOVMSKB reg, xmm1 bits of r32 or r64 are filled with zeros. 
VEX.256.66.0F.WIG D7 /r RM |V/V AVX2 Move a 32-bit mask of ymm7 to reg. The 
VPMOVMSKB reg, ymm1 upper bits of r64 are filled with zeros. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Creates a mask made up of the most significant bit of each byte of the source operand (second operand) and stores 
the result in the low byte or word of the destination operand (first operand). 


The byte mask is 8 bits for 64-bit source operand, 16 bits for 128-bit source operand and 32 bits for 256-bit source 


operand. The destination operand is a general-purpose register. 


In 64-bit mode, the instruction can access additional registers (XMM8-XMM15, R8-R15) when used with a REX.R 
prefix. The default operand size is 64-bit in 64-bit mode. 


Legacy SSE version: The source operand is an MMX technology register. 


128-bit Legacy SSE version: The source operand is an XMM register. 


VEX.128 encoded version: The source operand is an XMM register. 


VEX.256 encoded version: The source operand is a YMM register. 


Note: VEX.vvvv is reserved and must be 1111b. 


Operation 


PMOVMSKB (with 64-bit source operand and r32) 
r32[0] := SRC[7]; 
r32[1] := SRC[15]; 
(* Repeat operation for bytes 2 through 6 *) 
r32[7] := SRC[63]; 
r32[31:8] := ZERO_FILL; 


(V)PMOVMSKB (with 128-bit source operand and r32) 
r32[0] := SRC[7]; 
r32[1] := SRC[15]; 
(* Repeat operation for bytes 2 through 14 *) 
r32[15] := SRC[127]; 
r32[31:16] := ZERO_FILL; 
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VPMOVMSKB (with 256-bit source operand and r32) 
r32[0] := SRC[7]; 

r32[1] := SRC[15]; 

(* Repeat operation for bytes 3rd through 31*) 
r32[31] := SRC[255]; 


PMOVMSKB (with 64-bit source operand and r64) 
r64[0] := SRC[7]; 
r64[1] := SRC[15]; 
(* Repeat operation for bytes 2 through 6 *) 
r64[7] := SRC[63]; 
r64[63:8] := ZERO_FILL; 


(V)PMOVMSKB (with 128-bit source operand and r64) 
r64[0] := SRC[7]; 
r64[1] := SRC[15]; 
(* Repeat operation for bytes 2 through 14 *) 
r64[15] := SRC[127]; 
r64[63:16] := ZERO_FILL; 


VPMOVMSKB (with 256-bit source operand and r64) 
r64[0] := SRC[7]; 

r64[1] := SRC[15]; 

(* Repeat operation for bytes 2 through 31*) 

r64[31] := SRC[255]; 

r64[63:32] := ZERO_FILL; 


Intel C/C++ Compiler Intrinsic Equivalent 


PMOVMSKB: int __mm_movemask_pi8(__m64 a) 
(V)PMOVMSKB: int __mm_movemask_epi8 (__m128i a) 
VPMOVMSKB: int __mm256_movemask_epi8 (__m256i a) 
Flags Affected 

None. 


Numeric Exceptions 
None. 


Other Exceptions 


See Table 2-24, “Type 7 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv # 1111B. 
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PMOVSX—Packed Move with Sign Extend 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support Flag 
66 Of 38 20 /r A VIV SSE4_1 Sign extend 8 packed 8-bit integers in the low 8 bytes 
PMOVSXBW xmm1, xmm2/m64 of xmm2/m64 to 8 packed 16-bit integers in xmm1. 
66 Of 38 21 /r A VIV SSE4_1 Sign extend 4 packed 8-bit integers in the low 4 bytes 
PMOVSXBD xmm1, xmm2/m32 of xmm2/m32 to 4 packed 32-bit integers in xmm1. 
66 Of 38 22 /r A VIV SSE4_1 Sign extend 2 packed 8-bit integers in the low 2 bytes 
PMOVSXBQ xmm1, xmm2/m16 of xmm2/m16 to 2 packed 64-bit integers in xmm1. 
66 Of 38 23/r A VIV SSE4_1 Sign extend 4 packed 16-bit integers in the low 8 bytes 
PMOVSXWD xmm1, xmm2/m64 of xmm2/m64 to 4 packed 32-bit integers in xmm1. 
66 Of 38 24 /r A VIV SSE4_1 Sign extend 2 packed 16-bit integers in the low 4 bytes 
PMOVSXWQ xmm1, xmm2/m32 of xmm2/m32 to 2 packed 64-bit integers in xmm1. 
66 Of 38 25 /r A VIV SSE4_1 Sign extend 2 packed 32-bit integers in the low 8 bytes 
PMOVSXDQ xmm1, xmm2/m64 of xmm2/m64 to 2 packed 64-bit integers in xmm1. 
VEX.128.66.0F38.WIG 20 /r A VIV AVX Sign extend 8 packed 8-bit integers in the low 8 bytes 
VPMOVSXBW xmm1, xmm2/m64 of xmm2/m64 to 8 packed 16-bit integers in xmm1. 
VEX.128.66.0F38.WIG 21 /r A VIV AVX Sign extend 4 packed 8-bit integers in the low 4 bytes 
VPMOVSXBD xmm1, xmm2/m32 of xmm2/m32 to 4 packed 32-bit integers in xmm1. 
VEX.128.66.0F38.WIG 22 /r A VIV AVX Sign extend 2 packed 8-bit integers in the low 2 bytes 
VPMOVSXBQ xmm1, xmm2/m16 of xmm2/m16 to 2 packed 64-bit integers in xmm1. 
VEX.128.66.0F38.WIG 23 /r A VIV AVX Sign extend 4 packed 16-bit integers in the low 8 bytes 
VPMOVSXWD xmm1, xmm2/m64 of xmm2/m64 to 4 packed 32-bit integers in xmm1. 
VEX.128.66.0F38.WIG 24 /r A VIV AVX Sign extend 2 packed 16-bit integers in the low 4 bytes 
VPMOVSXWQ xmm1, xmm2/m32 of xmm2/m32 to 2 packed 64-bit integers in xmm1. 
VEX.128.66.0F38.WIG 25 /r A VIV AVX Sign extend 2 packed 32-bit integers in the low 8 bytes 
VPMOVSXDQ xmm1, xmm2/m64 of xmm2/m64 to 2 packed 64-bit integers in xmm1. 
VEX.256.66.0F38.WIG 20 /r A VIV AVX2 Sign extend 16 packed 8-bit integers in xmm2/m128 to 
VPMOVSXBW ymm1, xmm2/m128 16 packed 16-bit integers in ymm1. 
VEX.256.66.0F38.WIG 21 /r A VV AVX2 Sign extend 8 packed 8-bit integers in the low 8 bytes 
VPMOVSXBD ymm1, xmm2/m64 of xmm2/m64 to 8 packed 32-bit integers in ymm1. 
VEX.256.66.0F38.WIG 22 /r A VIV AVX2 Sign extend 4 packed 8-bit integers in the low 4 bytes 
VPMOVSXBQ ymm1, xmm2/m32 of xmm2/m32 to 4 packed 64-bit integers in ymm1. 
VEX.256.66.0F38.WIG 23 /r A VV AVX2 Sign extend 8 packed 16-bit integers in the low 16 
VPMOVSXWD ymm1, xmm2/m128 bytes of xmm2/m1 28 to 8 packed 32-bit integers in 
ymm1. 
VEX.256.66.0F38.WIG 24 /r A VIV AVX2 Sign extend 4 packed 16-bit integers in the low 8 bytes 
VPMOVSXWQ ymm1, xmm2/m64 of xmm2/m64 to 4 packed 64-bit integers in ymm1. 
VEX.256.66.0F38.WIG 25 /r A VIN AVX2 Sign extend 4 packed 32-bit integers in the low 16 
VPMOVSXDQ ymm1, xmm2/m128 bytes of xmm2/m128 to 4 packed 64-bit integers in 
ymm1. 
EVEX.128.66.0F38.WIG 20 /r B VIV AVX512VL_ | Sign extend 8 packed 8-bit integers in xmm2/m64 to 8 
VPMOVSXBW xmm1 {k1}{Z}, AVX512BW | packed 16-bit integers in zmm1. 
xmm2/m64 
EVEX.256.66.0F38.WIG 20 /r B VIV AVX512VL_ | Sign extend 16 packed 8-bit integers in xmm2/m128 to 
VPMOVSXBW ymm1 {k1}{z}, AVX512BW | 16 packed 16-bit integers in ymm1. 
xmm2/m128 
EVEX.512.66.0F38.WIG 20 /r B VIV AVX512BW | Sign extend 32 packed 8-bit integers in ymm2/m256 to 
VPMOVSXBW zmm1 {k1}{Z}, 32 packed 16-bit integers in zmm1. 
ymm2/m256 
EVEX.128.66.0F38.WIG 21 /r C VIV AVX512VL | Sign extend 4 packed 8-bit integers in the low 4 bytes 
VPMOVSXBD xmm1 {k1}{z}, AVX512F of xmm2/m32 to 4 packed 32-bit integers in xmm1 
xmm2/m32 subject to writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support Flag 
EVEX.256.66.0F38.WIG 21 /r C VIV AVX512VL_ | Sign extend 8 packed 8-bit integers in the low 8 bytes 
VPMOVSXBD ymm1 {k1}{Z}, AVX512F of xmm2/m64 to 8 packed 32-bit integers in ymm1 
xmm2/m64 subject to writemask k1. 
EVEX.512.66.0F38.WIG 21 /r C VIV AVX512F Sign extend 16 packed 8-bit integers in the low 16 
VPMOVSXBD zmm1 {k1}{Z}, bytes of xmm2/m128 to 16 packed 32-bit integers in 
xmm2/m128 zmm1 subject to writemask k1. 
EVEX.128.66.0F38.WIG 22 /r D VIV AVX512VL_ | Sign extend 2 packed 8-bit integers in the low 2 bytes 
VPMOVSXBQ xmm1 {k1}{Z}, AVX512F of xmm2/m16 to 2 packed 64-bit integers in xmm1 
xmm2/m16 subject to writemask k1. 
EVEX.256.66.0F38.WIG 22 /r D VIV AVX512VL_ | Sign extend 4 packed 8-bit integers in the low 4 bytes 
VPMOVSXBQ ymm1 {k1}{z}, AVX512F of xmm2/m32 to 4 packed 64-bit integers in ymm1 
xmm2/m32 subject to writemask k1. 
EVEX.512.66.0F38.WIG 22 /r D VIV AVX512F Sign extend 8 packed 8-bit integers in the low 8 bytes 
VPMOVSXBQ zmm1 {k1}{Z}, of xmm2/m64 to 8 packed 64-bit integers in zmm1 
xmm2/m64 subject to writemask k1. 
EVEX.128.66.0F38.WIG 23 /r B VIV AVX512VL_ | Sign extend 4 packed 16-bit integers in the low 8 bytes 
VPMOVSXWD xmm1 {k1}{z}, AVX512F of ymm2/mem to 4 packed 32-bit integers in xmm1 
xmm2/m64 subject to writemask k1. 
EVEX.256.66.0F38.WIG 23 /r B VIV AVX512VL_ | Sign extend 8 packed 16-bit integers in the low 16 
VPMOVSXWD ymm1 {k1}{Z}, AVX512F bytes of ynm2/m128 to 8 packed 32-bit integers in 
xmm2/m128 ymm1 subject to writemask k1. 
EVEX.512.66.0F38.WIG 23 /r B VIV AVX512F Sign extend 16 packed 16-bit integers in the low 32 
VPMOVSXWD zmm1 {k1}{Z}, bytes of ynm2/m256 to 16 packed 32-bit integers in 
ymm2/m256 zmm1 subject to writemask k1. 
EVEX.128.66.0F38.WIG 24 /r C VIV AVX512VL_ | Sign extend 2 packed 16-bit integers in the low 4 bytes 
VPMOVSXWQ xmm1 {k1}{Z}, AVX512F of xmm2/m32 to 2 packed 64-bit integers in xmm1 
xmm2/m32 subject to writemask k1. 
EVEX.256.66.0F38.WIG 24 /r C VIV AVX512VL_ | Sign extend 4 packed 16-bit integers in the low 8 bytes 
VPMOVSXWQ ymm1 {k1}{z}, AVX512F of xmm2/m64 to 4 packed 64-bit integers in ymm1 
xmm2/m64 subject to writemask k1. 
EVEX.512.66.0F38.WIG 24 /r C VIV AVX512F Sign extend 8 packed 16-bit integers in the low 16 
VPMOVSXWQ zmm1 {k1}{Z}, bytes of xmm2/m128 to 8 packed 64-bit integers in 
xmm2/m128 zmm1 subject to writemask k1. 
EVEX.128.66.0F38.W0 25 /r B VIV AVX512VL_ | Sign extend 2 packed 32-bit integers in the low 8 bytes 
VPMOVSXDQ xmm1 {k1}{Z}, AVX512F of xmm2/m64 to 2 packed 64-bit integers in zmm1 
xmm2/m64 using writemask k1. 
EVEX.256.66.0F38.W0 25 /r B VIV AVX512VL_ | Sign extend 4 packed 32-bit integers in the low 16 
VPMOVSXDQ ymm1 {k1}{Z}, AVX512F bytes of xmm2/m128 to 4 packed 64-bit integers in 
xmm2/m128 zmm1 using writemask k1. 
EVEX.512.66.0F38.W0 25 /r B VIV AVX512F Sign extend 8 packed 32-bit integers in the low 32 


VPMOVSXDQ zmm1 {k1}{z}, 
ymm2/m256 


bytes of ynm2/m256 to 8 packed 64-bit integers in 
zmm1 using writemask k1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Half Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
C Quarter Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Eighth Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Legacy and VEX encoded versions: Packed byte, word, or dword integers in the low bytes of the source operand 
(second operand) are sign extended to word, dword, or quadword integers and stored in packed signed bytes the 
destination operand. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 


VEX.128 and EVEX.128 encoded versions: Bits (MAXVL-1:128) of the corresponding destination register are 
zeroed. 

VEX.256 and EVEX.256 encoded versions: Bits (MAXVL-1:256) of the corresponding destination register are 
zeroed. 

EVEX encoded versions: Packed byte, word or dword integers starting from the low bytes of the source operand 
(second operand) are sign extended to word, dword or quadword integers and stored to the destination operand 
under the writemask. The destination register is XMM, YMM or ZMM Register. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


Operation 


Packed_Sign_Extend_BYTE_to_WORD(DEST, SRC) 
DEST[15:0] := SignExtend(SRC[7:0)); 

DEST[31:16] := SignExtend(SRC[15:8)); 

DEST[47:32] := SignExtend(SRC[23:16)]); 
DEST[63:48] := SignExtend(SRC[31:24)); 
DEST[79:64] := SignExtend(SRC[39:32)); 
DEST[95:80] := SignExtend(SRC[47:40)); 

DEST[11 1:96] := SignExtend(SRC[55:48)); 
DEST[127:112] := SignExtend(SRC[63:56)); 


Packed_Sign_Extend_BYTE_to_DWORD(DEST, SRC) 
DEST[31:0] := SignExtend(SRC[7:0]); 

DEST[63:32] := SignExtend(SRC[15:8)); 

DEST[95:64] := SignExtend(SRC[23:16)]); 

DEST[1 27:96] := SignExtend(SRC[3 1:24); 


Packed_Sign_Extend_BYTE_to_QWORD(DEST, SRC) 
DEST[63:0] := SignExtend(SRC[7:0)); 
DEST[127:64] := SignExtend(SRC[15:8)); 


Packed_Sign_Extend_WORD_to_DWORD(DEST, SRC) 
DEST[31:0] := SignExtend(SRC[15:0)); 

DEST[63:32] := SignExtend(SRC[31:16)); 

DEST[95:64] := SignExtend(SRC[47:32]); 

DEST[127:96] := SignExtend(SRC[63:48)); 


Packed_Sign_Extend_WORD_to_QWORD(DEST, SRC) 
DEST[63:0] := SignExtend(SRC[1 5:0)); 
DEST[127:64] := SignExtend(SRC[31:16]); 
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Packed_Sign_Extend_DWORD_to_QWORD(DEST, SRC) 
DEST[63:0] := SignExtend(SRC[31:0)); 
DEST[127:64] := SignExtend(SRC[63:32)); 


VPMOVSXBW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
Packed_Sign_Extend_BYTE_to_WORD(TMP_DEST[127:0], SRC[63:0]) 
IF VL >= 256 
Packed_Sign_Extend_BYTE_to_WORD(TMP_DEST[255:128], SRC[127:64]) 


Fl; 

IFVL>=512 
Packed_Sign_Extend_BYTE_to_WORD(TMP_DEST[383:256], SRC[191:128]) 
Packed_Sign_Extend_BYTE_to_WORD(TMP_DEST[51 1:384], SRC[255:192]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TEMP_DEST[i+1 5:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVSXBD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
Packed_Sign_Extend_BYTE_to_DWORD(TMP_DEST[1 27:0], SRC[31:0]) 
IF VL >= 256 
Packed_Sign_Extend_BYTE_to_DWORD(TMP_DEST[255:128], SRC[63:32]) 


Fl; 
IF VL >= 512 
Packed_Sign_Extend_BYTE_to_DWORD(TMP_DEST[383:256], SRC[95:64]) 
Packed_Sign_Extend_BYTE_to_DWORD(TMP_DEST[51 1:384], SRC[127:96]) 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TEMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPMOVSXBQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Sign_Extend_BYTE_to_QWORD(TMP_DEST[1 27:0], SRC[15:0]) 
IF VL >= 256 
Packed_Sign_Extend_BYTE_to_QWORD(TMP_DEST[255:1 28], SRC[31:16]) 


Fl; 
IF VL >=512 
Packed_Sign_Extend_BYTE_to_QWORD(TMP_DEST[383:256], SRC[47:32]) 
Packed_Sign_Extend_BYTE_to_QWORD(TMP_DEST[51 1:384], SRC[63:48]) 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPMOVSXWD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
Packed_Sign_Extend_WORD_to_DWORD(TMP_DEST[1 27:0], SRC[63:0]) 
IF VL >= 256 
Packed_Sign_Extend_WORD_to_DWORD(TMP_DEST[255:1 28], SRC[127:64]) 


Fl; 

IF VL>=512 
Packed_Sign_Extend_WORD_to_DWORD(TMP_DEST[383:256], SRC[191:128]) 
Packed_Sign_Extend_WORD_to_DWORD(TMP_DEST[51 1:384], SRC[256:192]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TEMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VPMOVSXWQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Sign_Extend_WORD_to_QWORD(TMP_DEST[1 27:0], SRC[31:0]) 
IF VL >= 256 
Packed_Sign_Extend_WORD_to_QWORD(TMP_DEST[255:1 28], SRC[63:32]) 


Fl; 

IFVL>=512 
Packed_Sign_Extend_WORD_to_QWORD(TMP_DEST[383:256], SRC[95:64]) 
Packed_Sign_Extend_WORD_to_QWORD(TMP_DEST[51 1:384], SRC[127:96]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVSXDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Sign_Extend_DWORD_to_QWORD(TEMP_DEST[1 27:0], SRC[63:0]) 
IF VL >= 256 
Packed_Sign_Extend_DWORD_to_QWORD(TEMP_DEST[255:1 28], SRC[127:64]) 


Fl; 
IF VL >= 512 
Packed_Sign_Extend_DWORD_to_QWORD(TEMP_DEST[383:256], SRC[191:128]) 
Packed_Sign_Extend_DWORD_to_QWORD(TEMP_DEST[51 1:384], SRC[255:192]) 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPMOVSXBW (VEX.256 encoded version) 
Packed_Sign_Extend_BYTE_to_WORD(DEST[127:0], SRC[63:0]) 
Packed_Sign_Extend_BYTE_to_WORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 
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VPMOVSXBD (VEX.256 encoded version) 
Packed_Sign_Extend_BYTE_to_DWORD(DEST[1 27:0], SRC[31:0]) 
Packed_Sign_Extend_BYTE_to_DWORD(DEST[255:1 28], SRC[63:32]) 
DEST[MAXVL-1:256] := 0 


VPMOVSXBQ (VEX.256 encoded version) 
Packed_Sign_Extend_BYTE_to_QWORD(DEST[1 27:0], SRC[15:0]) 
Packed_Sign_Extend_BYTE_to_QWORD(DEST[255:1 28], SRC[31:16]) 
DEST[MAXVL-1:256] := 0 


VPMOVSXWD (VEX.256 encoded version) 
Packed_Sign_Extend_WORD_to_DWORD(DEST[1 27:0], SRC[63:0]) 
Packed_Sign_Extend_WORD_to_DWORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 


VPMOVSXWQ (VEX.256 encoded version) 
Packed_Sign_Extend_WORD_to_QWORD(DEST[1 27:0], SRC[31:0]) 
Packed_Sign_Extend_WORD_to_QWORD(DEST[255:1 28], SRC[63:32]) 
DEST[MAXVL-1:256] := 0 


VPMOVSXDQ (VEX.256 encoded version) 
Packed_Sign_Extend_DWORD_to_QWORD(DEST[1 27:0], SRC[63:0]) 
Packed_Sign_Extend_DWORD_to_QWORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 


VPMOVSXBW (VEX.128 encoded version) 
Packed_Sign_Extend_BYTE_to_WORDDEST[1 27:0], SRC[127:0]() 
DEST[MAXVL-1:128] := 0 


VPMOVSXBD (VEX.128 encoded version) 
Packed_Sign_Extend_BYTE_to_DWORD(DEST[1 27:0], SRC[127:0]) 
DEST[MAXVL-1:128] := 0 


VPMOVSXBQ (VEX.128 encoded version) 
Packed_Sign_Extend_BYTE_to_QWORD(DEST[1 27:0], SRC[127:0]) 
DEST[MAXVL-1:128] := 0 


VPMOVSXWD (VEX.128 encoded version) 
Packed_Sign_Extend_WORD_to_DWORD(DEST[1 27:0], SRC[127:0]) 
DEST[MAXVL-1:128] := 0 


VPMOVSXWQ (VEX.128 encoded version) 
Packed_Sign_Extend_WORD_to_QWORD(DEST[127:0], SRC[127:0]) 
DEST[MAXVL-1:128] := 0 


VPMOVSXDQ (VEX.128 encoded version) 
Packed_Sign_Extend_DWORD_to_QWORD(DEST[1 27:0], SRC[127:0]) 
DEST[MAXVL-1:128] := 0 


PMOVSXBW 
Packed_Sign_Extend_BYTE_to_WORD(DEST[1 27:0], SRC[127:0]) 
DEST[MAXVL-1:128] (Unmodified) 
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PMOVSXBD 


Packed_Sign_Extend_BYTE_to_DWORD(DEST[127:0], SRC[127:0]) 


DEST[MAXVL-1:1 28] (Unmodified) 


PMOVSXBQ 


Packed_Sign_Extend_BYTE_to_QWORD(DEST[127:0], SRC[127:0)) 
DEST[MAXVL-1:1 28] (Unmodified) 


PMOVSXWD 


Packed_Sign_€xtend_WORD_to_DWORD(DEST[127:0], SRC[127:0]) 


DEST[MAXVL-1:1 28] (Unmodified) 


PMOVSXWQ 


Packed_Sign_Extend_WORD_to_QWORD(DEST[127:0], SRC[127:0)) 


DEST[MAXVL-1:1 28] (Unmodified) 


PMOVSXDQ 


Packed_Sign_Extend_DWORD_to_QWORD(DEST[1 27:0], SRC[127:0]) 


DEST[MAXVL-1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMOVSXBW __m512i_mm512_cvtepi8_epi16(__m512i a); 

VPMOVSXBW __m512i_mm512_mask_cvtepi8_epi16(__m512i a,__ mmask32 k,___m512i b); 
VPMOVSXBW __m512i_mm512_maskz_cvtepi8_epi16(__ mmask32 k, __m512i b); 
VPMOVSXBD __m512i_mm512_cvtepi8_epi32(__m512i a); 

VPMOVSXBD __m512i_mm512_mask_cvtepi8_epi32(__m512i a,__ mmask16 k,___m512i b); 
VPMOVSXBD __m512i_mm512_maskz_cvtepi8_epi32(__ mmask16 k, __m512i b); 
VPMOVSXBQ __m512i__mm512_cvtepi8_epi64(__m512i a); 

VPMOVSXBQ __m512i_mm512_mask_cvtepi8_epi64(__m512i a,__mmask8 k, __m512i b); 
VPMOVSXBQ __m512i_mm512_maskz_cvtepi8_epi64(_mmask8 k, __m512i a); 
VPMOVSXDQ __m512i_mm512_cvtepi32_epi64(__m512i a); 

VPMOVSXDQ __m512i__mm512_mask_cvtepi32_epi64(__m512i a, __ mmask8 k, __m512i b); 
VPMOVSXDQ __m512i__mm512_maskz_cvtepi32_epi64(__mmask8 k, __m512i a); 
VPMOVSXWD __m512i_mm512_cvtepi16_epi32(__m512i a); 

VPMOVSXWD __m512i_mm512_mask_cvtepi16_epi32(__m512i a,__mmask16 k,__m512i b); 
VPMOVSXWD __m512i_mm512_maskz_cvtepi16_epi32(__mmask16 k, __m512i a); 
VPMOVSXWQ __m512i__mm512_cvtepi16_epi64(__m512i a); 

VPMOVSXWQ __m512i__mm512_mask_cvtepi16_epi64(__m512i a,___ mmask8 k, __m512i b); 
VPMOVSXWQ __m512i _mm512_maskz_cvtepi16_epi64(__mmask8 k, __m512i a); 
VPMOVSXBW __m256i__mm256_cvtepi8_epi16(__m256i a); 

VPMOVSXBW __m256i _mm256_mask_cvtepi8_epi16(__m256i a,__ mmask16 k, __m256i b); 
VPMOVSXBW __m256i __mm256_maskz_cvtepi8_epi16(__ mmask16 k, __m256i b); 
VPMOVSXBD __m256i_mm256_cvtepi8_epi32(__m256i a); 

VPMOVSXBD __m256i__mm256_mask_cvtepi8_epi32(__m256i a,__ mmask8 k, __m256i b); 
VPMOVSXBD __m256i__mm256_maskz_cvtepi8_epi32(__mmask8 k, __m256i b); 
VPMOVSXBQ __m256i __mm256_cvtepi8_epi64(__m256i a); 

VPMOVSXBQ __m256i __mm256_mask_cvtepi8_epi64(__m256i a,__mmask8 k, __m256i b); 
VPMOVSXBQ __m256i __mm256_maskz_cvtepi8_epi64(_mmask8 k, __m256i a); 
VPMOVSXDQ __m256i __mm256_cvtepi32_epi64(__m256i a); 

VPMOVSXDQ __m256i _mm256_mask_cvtepi32_epi64(__m256i a, __mmask8 k, __m256i b); 
VPMOVSXDQ __m256i __mm256_maskz_cvtepi32_epi64(__mmask8 k, __m256i a); 
VPMOVSXWD __m256i_mm256_cvtepi16_epi32(__m256i a); 

VPMOVSXWD __m256i__mm256_mask_cvtepi16_epi32(__m256i a,__ mmask16 k, __m256i b); 
VPMOVSXWD __m256i__mm256_maskz_cvtepi16_epi32(__mmask16 k, __m256i a); 
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VPMOVSXWQ __m256i _mm256_cvtepi16_epi64(__m256i a); 

VPMOVSXWQ __m256i _mm256_mask_cvtepi16_epi64(__m256i a, __ mmask8 k, __m256i b); 
VPMOVSXWQ __m256i _mm256_maskz_cvtepi16_epi64(__mmask8 k, __m256i a); 
VPMOVSXBW __m128i _mm_mask_cvtepi8_epi16(__m128i a,__ mmask8 k, __m128i b); 
VPMOVSXBW __m128i __mm_maskz_cvtepi8_epi16(__ mmask8 k, __m128i b); 

VPMOVSXBD __m128i_mm_mask_cvtepi8_epi32(__m128i a,__ mmask8 k,___m128i b); 


VPMOVSXBD __m128i_mm_maskz_cvtepi8_epi32(__mmask8 k, __m128i b); 
VPMOVSXBQ __m128i __mm_mask_cvtepi8_epi64(__m128i a, __mmask8 k, __m128i b); 
VPMOVSXBQ __m128i _mm_maskz_cvtepi8_epi64(__mmask8 k, __m128i a); 
VPMOVSXDQ __m128i __mm_mask_cvtepi32_epi64(__m128i a, __mmask8 k, __m128i b); 
VPMOVSXDQ __m128i __mm_maskz_cvtepi32_epi64(__mmask8 k, __m128i a); 
VPMOVSXWD __m128i__mm_mask_cvtepi16_epi32(__m128i a,__ mmask16 k, __m128i b); 


VPMOVSXWD __m128i _mm_maskz_cvtepi16_epi32(__mmask16 k, __m128i a); 
VPMOVSXWQ __m128i _mm_mask_cvtepi16_epi64(__m128i a, __mmask8 k, __m128i b); 
VPMOVSXWQ __m128i _mm_maskz_cvtepi16_epi64(__mmask8 k, __m128i a); 
PMOVSXBW __m128i _mm_ cvtepi8_epi16 (__m128i a); 

PMOVSXBD __m128i __mm_ cvtepi8_epi32 (__m128i a); 

PMOVSXBQ __m128i __mm_cvtepi8_epi64 (__m128i a); 

PMOVSXWD __m128i __mm_ cvtepi16_epi32 (__m128i a); 

PMOVSXWQ __m128i __mm_ cvtepi16_epi64 (__m128i a); 

PMOVSXDQ __m128i__mm_ cvtepi32_epi64 (__m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-51, “Type E5 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B, or EVEX.vvvv != 1111B. 
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VPMOVZXDQ ymm1, xmm2/m128 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

66 Of 38 30 /r A VIV SSE4_1 Zero extend 8 packed 8-bit integers in the low 8 

PMOVZXBW xmm1, xmm2/m64 bytes of xmm2/m64 to 8 packed 16-bit integers in 
xmm1. 

66 Of 38 31 /r A VIV SSE4_1 Zero extend 4 packed 8-bit integers in the low 4 

PMOVZXBD xmm1, xmm2/m32 bytes of xmm2/m32 to 4 packed 32-bit integers in 
xmm1. 

66 Of 38 32 /r A VIV SSE4_1 Zero extend 2 packed 8-bit integers in the low 2 

PMOVZXBQ xmm1, xmm2/m16 bytes of xmm2/m16 to 2 packed 64-bit integers in 
xmm1. 

66 Of 38 33 /r A VIV SSE4_1 Zero extend 4 packed 16-bit integers in the low 8 

PMOVZXWD xmm1, xmm2/m64 bytes of xmm2/m64 to 4 packed 32-bit integers in 
xmm1. 

66 Of 38 34 /r A VIV SSE4_1 Zero extend 2 packed 16-bit integers in the low 4 

PMOVZXWQ xmm1, xmm2/m32 bytes of xmm2/m32 to 2 packed 64-bit integers in 
xmm1. 

66 Of 38 35 /r A VIV SSE4_1 Zero extend 2 packed 32-bit integers in the low 8 

PMOVZXDQ xmm1, xmm2/m64 bytes of xmm2/m64 to 2 packed 64-bit integers in 
xmm1. 

VEX.128.66.0F38.WIG 30 /r A VIV AVX Zero extend 8 packed 8-bit integers in the low 8 

VPMOVZXBW xmm1, xmm2/m64 bytes of xmm2/m64 to 8 packed 16-bit integers in 
xmm1. 

VEX.128.66.0F38.WIG 31 /r A VIV AVX Zero extend 4 packed 8-bit integers in the low 4 

VPMOVZXBD xmm1, xmm2/m32 bytes of xmm2/m32 to 4 packed 32-bit integers in 
xmm1. 

VEX.128.66.0F38.WIG 32 /r A VIV AVX Zero extend 2 packed 8-bit integers in the low 2 

VPMOVZXBQ xmm1, xmm2/m16 bytes of xmm2/m16 to 2 packed 64-bit integers in 
xmm1. 

VEX.128.66.0F38.WIG 33 /r A VIV AVX Zero extend 4 packed 16-bit integers in the low 8 

VPMOVZXWD xmm1, xmm2/m64 bytes of xmm2/m64 to 4 packed 32-bit integers in 
xmm1. 

VEX.128.66.0F38.WIG 34 /r A VIV AVX Zero extend 2 packed 16-bit integers in the low 4 

VPMOVZXWQ xmm1, xmm2/m32 bytes of xmm2/m32 to 2 packed 64-bit integers in 
xmm1. 

VEX.128.66.0F 38.WIG 35 /r A VIV AVX Zero extend 2 packed 32-bit integers in the low 8 

VPMOVZXDQ xmm1, xmm2/m64 bytes of xmm2/m64 to 2 packed 64-bit integers in 
xmm1. 

VEX.256.66.0F38.WIG 30 /r A VIV AVX2 Zero extend 16 packed 8-bit integers in 

VPMOVZXBW ymm1, xmm2/m128 xmm2/m128 to 16 packed 16-bit integers in ymm1. 

VEX.256.66.0F38.WIG 31 /r A VIV AVX2 Zero extend 8 packed 8-bit integers in the low 8 

VPMOVZXBD ymm1, xmm2/m64 bytes of xmm2/m64 to 8 packed 32-bit integers in 
ymm1. 

VEX.256.66.0F38.WIG 32 /r A VIV AVX2 Zero extend 4 packed 8-bit integers in the low 4 

VPMOVZXBQ ymm1, xmm2/m32 bytes of xmm2/m32 to 4 packed 64-bit integers in 
ymm1. 

VEX.256.66.0F38.WIG 33 /r A VIV AVX2 Zero extend 8 packed 16-bit integers xmm2/m128 

VPMOVZXWD ymm1, xmm2/m128 to 8 packed 32-bit integers in ymm1. 

VEX.256.66.0F38.WIG 34 /r A VIV AVX2 Zero extend 4 packed 16-bit integers in the low 8 

VPMOVZXWQ ymm1, xmm2/m64 bytes of xmm2/m64 to 4 packed 64-bit integers in 
xmm1. 

VEX.256.66.0F38.WIG 35 /r A VIV AVX2 Zero extend 4 packed 32-bit integers in 


xmm2/m128 to 4 packed 64-bit integers in ymm1. 
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VPMOVZXWQ zmm1 {k1}{Z}, 
xmm2/m128 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38 30.WIG /r B VIV AVX512VL_ | Zero extend 8 packed 8-bit integers in the low 8 
VPMOVZXBW xmm1 {k1}{z}, xmm2/m64 AVX512BW | bytes of xmm2/m64 to 8 packed 16-bit integers in 
xmm1. 
EVEX.256.66.0F38.WIG 30 /r B VV AVX512VL_ | Zero extend 16 packed 8-bit integers in 
VPMOVZXBW ymm1 {k1}{z}, AVX512BW | xmm2/m128 to 16 packed 16-bit integers in ymm1. 
xmm2/m128 
EVEX.512.66.0F38.WIG 30 /r B VV AVX512BW | Zero extend 32 packed 8-bit integers in 
VPMOVZXBW zmm1 {k1}{Z}, ymm2/m256 to 32 packed 16-bit integers in zmm1. 
ymm2/m256 
EVEX.128.66.0F38.WIG 31 /r C VIV AVX512VL_ | Zero extend 4 packed 8-bit integers in the low 4 
VPMOVZXBD xmm1 {k1}{z}, xmm2/m32 AVX512F bytes of xmm2/m32 to 4 packed 32-bit integers in 
xmm1 subject to writemask k1. 
EVEX.256.66.0F38.WIG 31 /r C VV AVX512VL | Zero extend 8 packed 8-bit integers in the low 8 
VPMOVZXBD ymm1 {k1}{z}, xmm2/m64 AVX512F bytes of xmm2/m64 to 8 packed 32-bit integers in 
ymm1 subject to writemask k1. 
EVEX.512.66.0F38.WIG 31 /r C VIV AVX512F Zero extend 16 packed 8-bit integers in 
VPMOVZXBD zmm1 {k1}{z}, xmm2/m128 to 16 packed 32-bit integers in zmm1 
xmm2/m128 subject to writemask k1. 
EVEX.128.66.0F38.WIG 32 /r D VIV AVX512VL_ | Zero extend 2 packed 8-bit integers in the low 2 
VPMOVZXBQ xmm1 {k1}{z}, xmm2/m16 AVX512F bytes of xmm2/m16 to 2 packed 64-bit integers in 
xmm1 subject to writemask k1. 
EVEX.256.66.0F38.WIG 32 /r D VIV AVX512VL | Zero extend 4 packed 8-bit integers in the low 4 
VPMOVZXBQ ymm1 {k1}{z}, xmm2/m32 AVX512F bytes of xmm2/m32 to 4 packed 64-bit integers in 
ymm1 subject to writemask k1. 
EVEX.512.66.0F38.WIG 32 /r D VIV AVX512F Zero extend 8 packed 8-bit integers in the low 8 
VPMOVZXBQ zmm1 {k1}{z}, xmm2/m64 bytes of xmm2/m64 to 8 packed 64-bit integers in 
zmm1 subject to writemask k1. 
EVEX.1 28.66.0F38.WIG 33 /r B VIV AVX512VL | Zero extend 4 packed 16-bit integers in the low 8 
VPMOVZXWD xmm1 {k1}{z}, xmm2/m64 AVX512F bytes of xmm2/m64 to 4 packed 32-bit integers in 
xmm1 subject to writemask k1. 
EVEX.256.66.0F38.WIG 33 /r B VIV AVX512VL | Zero extend 8 packed 16-bit integers in 
VPMOVZXWD ymm1 {k1}{Z}, AVX512F xmm2/m1 28 to 8 packed 32-bit integers in zmm1 
xmm2/m128 subject to writemask k1. 
EVEX.512.66.0F38.WIG 33 /r B VIV AVX512F Zero extend 16 packed 16-bit integers in 
VPMOVZXWD zmm1 {k1}{z}, ymm2/m256 to 16 packed 32-bit integers in zmm1 
ymm2/m256 subject to writemask k1. 
EVEX.1 28.66.0F38.WIG 34 /r C VIV AVX512VL_ | Zero extend 2 packed 16-bit integers in the low 4 
VPMOVZXWQ xmm1 {k1}{z}, xmm2/m32 AVX512F bytes of xmm2/m32 to 2 packed 64-bit integers in 
xmm1 subject to writemask k1. 
EVEX.256.66.0F38.WIG 34 /r C VV AVX512VL_ | Zero extend 4 packed 16-bit integers in the low 8 
VPMOVZXWQ ymm1 {k1}{z}, xmm2/m64 AVX512F bytes of xmm2/m64 to 4 packed 64-bit integers in 
ymm1 subject to writemask k1. 
EVEX.512.66.0F38.WIG 34 /r € VIN AVX512F Zero extend 8 packed 16-bit integers in 


xmm2/m1 28 to 8 packed 64-bit integers in zmm1 
subject to writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 35 /r B VIV AVX512VL_ | Zero extend 2 packed 32-bit integers in the low 8 
VPMOVZXDQ xmm1 {k1}{z}, xmm2/m64 AVX512F bytes of xmm2/m64 to 2 packed 64-bit integers in 

zmm1 using writemask k1. 

EVEX.256.66.0F38.W0 35 /r B VIV AVX512VL | Zero extend 4 packed 32-bit integers in 
VPMOVZXDQ ymm1 {k1}{z}, AVX512F xmm2/m128 to 4 packed 64-bit integers in zmm1 
xmm2/m128 using writemask k1. 
EVEX.512.66.0F38.W0 35 /r B VV AVX512F Zero extend 8 packed 32-bit integers in 
VPMOVZXDQ zmm1 {k1}{Z}, ymm2/m256 to 8 packed 64-bit integers in zmm1 
ymm2/m256 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Half Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
C Quarter Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
D Eighth Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Legacy, VEX and EVEX encoded versions: Packed byte, word, or dword integers starting from the low bytes of the 
source operand (second operand) are zero extended to word, dword, or quadword integers and stored in packed 
signed bytes the destination operand. 

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 
VEX.128 encoded version: Bits (MAXVL-1:128) of the corresponding destination register are zeroed. 

VEX.256 encoded version: Bits (MAXVL-1:256) of the corresponding destination register are zeroed. 


EVEX encoded versions: Packed dword integers starting from the low bytes of the source operand (second 
operand) are zero extended to quadword integers and stored to the destination operand under the writemask.The 
destination register is XMM, YMM or ZMM Register. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


Operation 


Packed_Zero_Extend_BYTE_to_WORD(DEST, SRC) 
DEST[15:0] := ZeroExtend(SRC[7:0)); 

DEST[31:16] := ZeroExtend(SRC[1 5:8); 

DEST[47:32] := ZeroExtend(SRC[23:16)); 
DEST[63:48] := ZeroExtend(SRC[31:24)); 
DEST[79:64] := ZeroExtend(SRC[39:32]) 
DEST[95:80] := ZeroExtend(SRC[47:40)); 
DEST[1 11:96] := ZeroExtend(SRC[55:48)); 
DEST[127:112] := ZeroExtend(SRC[63:56]); 


fi 


Packed_Zero_Extend_BYTE_to_DWORD(DEST, SRC) 
DEST[31:0] := ZeroExtend(SRC[7:0)); 

DEST[63:32] := ZeroExtend(SRC[1 5:8); 

DEST[95:64] := ZeroExtend(SRC[23:16)); 

DEST[1 27:96] := ZeroExtend(SRC[31:24)); 
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Packed_Zero_Extend_BYTE_to_QWORD(DEST, SRC) 
DEST[63:0] := ZeroExtend(SRC[7:0)); 
DEST[1 27:64] := ZeroExtend(SRC[1 5:8); 


Packed_Zero_Extend_WORD_to_DWORD(DEST, SRC) 
DEST[31:0] := ZeroExtend(SRC[1 5:0); 

DEST[63:32] := ZeroExtend(SRC[31:16)]); 

DEST[95:64] := ZeroExtend(SRC[47:32]); 

DEST[1 27:96] := ZeroExtend(SRC[63:48)); 


Packed_Zero_Extend_WORD_to_QWORD(DEST, SRC) 
DEST[63:0] := ZeroExtend(SRC[1 5:0); 
DEST[1 27:64] := ZeroExtend(SRC[31:16)]); 


Packed_Zero_Extend_DWORD_to_QWORD(DEST, SRC) 
DEST[63:0] := ZeroExtend(SRC[31:0)); 
DEST[1 27:64] := ZeroExtend(SRC[63:32)); 


VPMOVZXBW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
Packed_Zero_Extend_BYTE_to_WORD(TMP_DEST[1 27:0], SRC[63:0]) 
IF VL >= 256 
Packed_Zero_Extend_BYTE_to_WORD(TMP_DEST[255:1 28], SRC[127:64]) 


Fl; 

IF VL >=512 
Packed_Zero_Extend_BYTE_to_WORD(TMP_DEST[383:256], SRC[191:128]) 
Packed_Zero_Extend_BYTE_to_WORD(TMP_DEST[51 1:384], SRC[255:192]) 


Fl; 
FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TEMP_DEST[i+15:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+1 5:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVZXBD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
Packed_Zero_Extend_BYTE_to_DWORD(TMP_DEST[1 27:0], SRC[31:0]) 
IF VL >= 256 
Packed_Zero_Extend_BYTE_to_DWORD(TMP_DEST[255:128], SRC[63:32]) 


Fl; 

IF VL >=512 
Packed_Zero_Extend_BYTE_to_DWORD(TMP_DEST[383:256], SRC[95:64]) 
Packed_Zero_Extend_BYTE_to_DWORD(TMP_DEST[51 1:384], SRC[127:96]) 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
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IF k1[j] OR *no writemask* 
THEN DEST{i+31:i] = TEMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPMOVZXBQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Zero_Extend_BYTE_to_QWORD(TMP_DEST[1 27:0], SRC[15:0]) 
IF VL >= 256 
Packed_Zero_Extend_BYTE_to_QWORD(TMP_DEST[255:1 28], SRC[31:16]) 


Fl; 

IF VL>=512 
Packed_Zero_Extend_BYTE_to_QWORD(TMP_DEST[383:256], SRC[47:32]) 
Packed_Zero_Extend_BYTE_to_QWORD(TMP_DEST[51 1:384], SRC[63:48}) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVZXWD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
Packed_Zero_Extend_WORD_to_DWORD(TMP_DEST[1 27:0], SRC[63:0]) 
IF VL >= 256 
Packed_Zero_Extend_WORD_to_DWORD(TMP_DEST[255:1 28], SRC[127:64]) 


Fl; 

IFVL>=512 
Packed_Zero_Extend_WORD_to_DWORD(TMP_DEST[383:256], SRC[191:128]) 
Packed_Zero_Extend_WORD_to_DWORD(TMP_DEST[51 1:384], SRC[256:192]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TEMP_DEST[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
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DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVZXWQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Zero_Extend_WORD_to_QWORD(TMP_DEST[1 27:0], SRC[31:0]) 
IF VL >= 256 
Packed_Zero_Extend_WORD_to_QWORD(TMP_DEST[255:128], SRC[63:32]) 


Fl; 

IF VL >=512 
Packed_Zero_Extend_WORD_to_QWORD(TMP_DEST[383:256], SRC[95:64]) 
Packed_Zero_Extend_WORD_to_QWORD(TMP_DEST[51 1:384], SRC[127:96]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVZXDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
Packed_Zero_Extend_DWORD_to_QWORD(TEMP_DEST[1 27:0], SRC[63:0]) 
IF VL >= 256 
Packed_Zero_Extend_DWORD_to_QWORD(TEMP_DEST[255:1 28], SRC[127:64]) 


Fl; 

IF VL >=512 
Packed_Zero_Extend_DWORD_to_QWORD(TEMP_DEST[383:256], SRC[191:128]) 
Packed_Zero_Extend_DWORD_to_QWORD(TEMP_DEST[51 1:384], SRC[255:192]) 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TEMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VPMOVZXBW (VEX.256 encoded version) 
Packed_Zero_Extend_BYTE_to_WORD(DEST[127:0], SRC[63:0]) 
Packed_Zero_Extend_BYTE_to_WORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXBD (VEX.256 encoded version) 
Packed_Zero_Extend_BYTE_to_DWORD(DEST[1 27:0], SRC[31:0]) 
Packed_Zero_Extend_BYTE_to_DWORD(DEST[255:1 28], SRC[63:32]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXBQ (VEX.256 encoded version) 
Packed_Zero_Extend_BYTE_to_QWORD(DEST[1 27:0], SRC[15:0]) 
Packed_Zero_Extend_BYTE_to_QWORD(DEST[255:1 28], SRC[31:16]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXWD (VEX.256 encoded version) 
Packed_Zero_Extend_WORD_to_DWORD(DEST[1 27:0], SRC[63:0]) 
Packed_Zero_Extend_WORD_to_DWORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXWQ (VEX.256 encoded version) 
Packed_Zero_Extend_WORD_to_QWORD(DEST[1 27:0], SRC[31:0]) 
Packed_Zero_Extend_WORD_to_QWORD(DEST[255:128], SRC[63:32]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXDQ (VEX.256 encoded version) 
Packed_Zero_Extend_DWORD_to_QWORD(DEST[1 27:0], SRC[63:0]) 
Packed_Zero_Extend_DWORD_to_QWORD(DEST[255:1 28], SRC[127:64]) 
DEST[MAXVL-1:256] := 0 


VPMOVZXBW (VEX.128 encoded version) 
Packed_Zero_Extend_BYTE_to_WORD() 
DEST[MAXVL-1:128] := 0 


VPMOVZXBD (VEX.128 encoded version) 
Packed_Zero_Extend_BYTE_to_DWORD() 
DEST[MAXVL-1:128] := 0 


VPMOVZXBQ (VEX.128 encoded version) 
Packed_Zero_Extend_BYTE_to_QWORD() 
DEST[MAXVL-1:128] := 0 


VPMOVZXWD (VEX.128 encoded version) 
Packed_Zero_Extend_WORD_to_DWORD() 
DEST[MAXVL-1:128] := 0 


VPMOVZXWQ (VEX.128 encoded version) 
Packed_Zero_Extend_WORD_to_QWORD() 
DEST[MAXVL-1:128] := 0 


VPMOVZXDQ (VEX.128 encoded version) 
Packed_Zero_Extend_DWORD_to_QWORD() 
DEST[MAXVL-1:1 28] := 0 
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PMOVZXBW 


Packed_Zero_Extend_BYTE_to_WORD() 


DEST[MAXVL-1:128] (Unmodified) 


PMOVZXBD 


Packed_Zero_Extend_BYTE_to_DWORD() 
DEST[MAXVL-1:128] (Unmodified) 


PMOVZXBQ 


Packed_Zero_Extend_BYTE_to_QWORD() 


DEST[MAXVL-1:128] (Unmodified) 


PMOVZXWD 


Packed_Zero_Extend_WORD_to_DWORD() 


DEST[MAXVL-1:128] (Unmodified) 


PMOVZXWQ 


Packed_Zero_Extend_WORD_to_QWORD() 


DEST[MAXVL-1:128] (Unmodified) 


PMOVZXDQ 


Packed_Zero_Extend_DWORD_to_QWORD() 


DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMOVZXBW __m512i_mm512_cvtepu8_epi16(__m256i a); 

VPMOVZXBW __m512i_mm512_mask_cvtepu8_epi16(__m512i a,__ mmask32 k, __m256i b); 
VPMOVZXBW __m512i_mm512_maskz_cvtepu8_epi16(__mmask32 k, __m256i b); 
VPMOVZXBD __m512i_mm512_cvtepu8_epi32(__m128i a); 

VPMOVZXBD __m512i_mm512_mask_cvtepu8_epi32(__m512i a,__ mmask16 k,___m128i b); 
VPMOVZXBD __m512i__mm512_maskz_cvtepu8_epi32(__mmask16 k, __m128i b); 
VPMOVZXBQ __m512i__mm512_cvtepu8_epi64(__m128i a); 

VPMOVZXBQ __m512i __mm512_mask_cvtepu8_epi64(__m512i a,___mmask8 k, __m128i b); 
VPMOVZXBQ __m512i __mm512_maskz_cvtepu8_epi64(__mmask8 k, __m128i a); 
VPMOVZXDQ ___m512i_mm512_cvtepu32_epi64(__m256i a); 

VPMOVZXDQ __m512i_mm512_mask_cvtepu32_epi64(__m512i a,__mmask8 k, __m256i b); 
VPMOVZXDQ __m512i__mm512_maskz_cvtepu32_epi64(__mmask8 k, __m256i a); 
VPMOVZXWD __m512i_mm512_cvtepu16_epi32(__m128i a); 

VPMOVZXWD __m512i_mm512_mask_cvtepu16_epi32(__m512i a,__ mmask16 k,___m128i b); 
VPMOVZXWD __m512i_mm512_maskz_cvtepu16_epi32(__mmask16 k, __m128i a); 
VPMOVZXWQ __m512i__mm512_cvtepu16_epi64(__m256i a); 

VPMOVZXWQ __m512i__mm512_mask_cvtepu16_epi64(__m512i a, ___mmask8 k, __m256i b); 
VPMOVZXWQ __m512i__mm512_maskz_cvtepu16_epi64(__mmask8 k, __m256i a); 
VPMOVZXBW __m256i __mm256_cvtepu8_epi16(__m256i a); 

VPMOVZXBW __m256i _mm256_mask_cvtepu8_epi16(__m256i a,__ mmask16 k, __m128i b); 
VPMOVZXBW __m256i __mm256_maskz_cvtepu8_epi16(__mmask16 k, __m128i b); 
VPMOVZXBD __m256i__mm256_cvtepu8_epi32(__m128i a); 

VPMOVZXBD __m256i __mm256_mask_cvtepu8_epi32(__m256i a,__ mmask8 k, __m128i b); 
VPMOVZXBD __m256i__mm256_maskz_cvtepu8_epi32(__mmask8 k, __m128i b); 
VPMOVZXBQ __m256i __mm256_cvtepu8_epi64(__m128i a); 

VPMOVZXBQ __m256i __mm256_mask_cvtepu8_epi64(__m256i a, ___mmask8 k, __m128i b); 
VPMOVZXBQ __m256i __mm256_maskz_cvtepu8_epi64(__mmask8 k, __m128i a); 
VPMOVZXDQ __m256i__mm256_cvtepu32_epi64(__m128i a); 

VPMOVZXDQ __m256i __mm256_mask_cvtepu32_epi64(__m256i a, ___mmask8 k, __m128i b); 
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VPMOVZXDQ __m256i__mm256_maskz_cvtepu32_epi64(__ mmask8 k, 
VPMOVZXWD __m256i__mm256_cvtepu16_epi32(__m128i a); 
VPMOVZXWD __m256i __mm256_mask_cvtepu16_epi32(__m256i a,__ mmask16 k, __m128i b); 
VPMOVZXWD __m256i __mm256_maskz_cvtepu16_epi32(__mmask16 k,__m128i a); 
VPMOVZXWQ __m256i __mm256_cvtepu16_epi64(__m128i a); 

VPMOVZXWQ __m256i __mm256_mask_cvtepu16_epi64(__m256i a, ___mmask8 k, __m128i b); 
VPMOVZXWQ __m256i __mm256_maskz_cvtepu16_epi64(__mmask8 k, __m128i a); 
VPMOVZXBW __m128i _mm_mask_cvtepu8_epi16(__m128i a,__ mmask8 k, __m128i b); 
VPMOVZXBW __m128i _mm_maskz_cvtepu8_epi16(__mmask8 k, __m128i b); 

VPMOVZXBD __m128i __mm_mask_cvtepu8_epi32(__m128i a,__ mmask8 k, __m128i b); 
VPMOVZXBD __m128i __mm_maskz_cvtepu8_epi32(__mmask8 k, __m128i b); 

VPMOVZXBQ __m128i _mm_mask_cvtepu8_epi64(__m128i a, __ mmask8 k, __m128i b); 
VPMOVZXBQ __m128i _mm_maskz_cvtepu8_epi64(__mmask8 k, __m128i a); 

VPMOVZXDQ __m128i _mm_mask_cvtepu32_epi64(__m128i a, __ mmask8 k, __m128i b); 
VPMOVZXDQ __m128i _mm_maskz_cvtepu32_epi64(__mmask8 k, __m128i a); 
VPMOVZXWD __m128i __mm_mask_cvtepu16_epi32(__m128i a,__ mmask16 k,___m128i b); 
VPMOVZXWD __m128i__mm_maskz_cvtepu16_epi32(__mmask8 k, __m128i a); 
VPMOVZXWQ __m128i __mm_mask_cvtepu16_epi64(__m128i a, __mmask8 k, __m128i b); 
VPMOVZXWQ __m128i __mm_maskz_cvtepu16_epi64(__mmask8 k, __m128i a); 

PMOVZXBW __m128i__mm_cvtepu8_epi16 (__m128i a); 

PMOVZXBD __m128i__mm_cvtepu8_epi32 (__m128i a); 

PMOVZXBQ __m128i__mm_ cvtepu8_epi64 (__m128i a); 

PMOVZXWD __m128i_mm_cvtepu16_epi32 (__m128i a); 

PMOVZXWQ __m128i __mm_cvtepu16_epi64 (__m128i a); 

PMOVZXDQ __m128i__mm_cvtepu32_epi64 (__m128i a); 


m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-22, “Type 5 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-51, “Type E5 Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B, or EVEX.vvvv != 1111B. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 38 28 /r A VIV SSE4_1 Multiply packed signed doubleword integers in xmm1 by 
PMULDQ xmm1, xmm2/m128 packed signed doubleword integers in xmm2/m1 28, and 
store the quadword results in xmm1. 
VEX.128.66.0F38.WIG 28 /r B VIV AVX Multiply packed signed doubleword integers in xmm2 by 
VPMULDQ xmm1, xmm2, packed signed doubleword integers in xmm3/m1 28, and 
xmm3/m128 store the quadword results in xmm1. 
VEX.256.66.0F38.WIG 28 /r B VIV AVX2 Multiply packed signed doubleword integers in ymm2 by 
VPMULDQ ymm1, ymm2, packed signed doubleword integers in ymm3/m256, and 
ymm3/m256 store the quadword results in ymm1. 
EVEX.128.66.0F38.W1 28 /r C VIV AVX512VL | Multiply packed signed doubleword integers in xmm2 by 
VPMULDQ xmm1 {k1}{z}, xmm2, AVX512F packed signed doubleword integers in 
xmm3/m1 28/m64bcst xmm3/m128/m64bcst, and store the quadword results in 
xmm_1 using writemask k1. 
EVEX.256.66.0F38.W1 28 /r C VIV AVX512VL | Multiply packed signed doubleword integers in ymm2 by 
VPMULDQ ymm1 {k1}{z}, ymm2, AVX512F packed signed doubleword integers in 
ymm3/m256/m64bcst ymm3/m256/m64bcst, and store the quadword results in 
ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 28 /r C VIV AVX512F Multiply packed signed doubleword integers in zmm2 by 
VPMULDQ zmm1 {k1}{z}, zmm2, packed signed doubleword integers in 
zmm3/m512/m64bcst zmm3/m512/m64bcst, and store the quadword results in 
zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Cc Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies packed signed doubleword integers in the even-numbered (zero-based reference) elements of the first 
source operand with the packed signed doubleword integers in the corresponding elements of the second source 
operand and stores packed signed quadword results in the destination operand. 


128-bit Legacy SSE version: The input signed doubleword integers are taken from the even-numbered elements of 
the source operands, i.e. the first (low) and third doubleword element. For 128-bit memory operands, 128 bits are 
fetched from memory, but only the first and third doublewords are used in the computation. The first source 
operand and the destination XMM operand is the same. The second source operand can be an XMM register or 128- 
bit memory location. Bits (MAXVL-1:128) of the corresponding destination register remain unchanged. 


VEX.128 encoded version: The input signed doubleword integers are taken from the even-numbered elements of 
the source operands, i.e., the first (low) and third doubleword element. For 128-bit memory operands, 128 bits are 
fetched from memory, but only the first and third doublewords are used in the computation.The first source 
operand and the destination operand are XMM registers. The second source operand can be an XMM register or 
128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination register are zeroed. 


VEX.256 encoded version: The input signed doubleword integers are taken from the even-numbered elements of 

the source operands, i.e. the first, 3rd, Sth, 7th doubleword element. For 256-bit memory operands, 256 bits are 

fetched from memory, but only the four even-numbered doublewords are used in the computation. The first source 
operand and the destination operand are YMM registers. The second source operand can be a YMM register or 256- 
bit memory location. Bits (MAXVL-1:256) of the corresponding destination ZMM register are zeroed. 
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EVEX encoded version: The input signed doubleword integers are taken from the even-numbered elements of the 
source operands. The first source operand is a ZMM/YMM/XMM registers. The second source operand can be an 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. The destination is a ZMM/YMM/XMM register, and updated according to the writemask at 64- 
bit granularity. 


Operation 


VPMULDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] := SignExtend64( SRC1[i+31:i]) * SignExtend64( SRC2[31:0]) 
ELSE DEST[i+63:i] := SignExtend64( SRC1[i+31:i]) * SignExtend64( SRC2[i+31:i]) 


Fl; 
ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPMULDQ (VEX.256 encoded version) 

DEST[63:0] := SignExtend64( SRC1[31:0]) * SignExtend64( SRC2[31:0]) 
DEST[127:64] := SignExtend64( SRC1[95:64]) * SignExtend64( SRC2[95:64]) 
DEST[191:128] := SignExtend64( SRC1[159:128]) * SignExtend64( SRC2[159:128}) 
DEST[255:192] := SignExtend64( SRC1[223:192]) * SignExtend64( SRC2[223:192]) 
DEST[MAXVL-1:256] := 0 


VPMULDQ (VEX.128 encoded version) 

DEST[63:0] := SignExtend64( SRC1[31:0]) * SignExtend64( SRC2[31:0]) 
DEST[127:64] := SignExtend64( SRC1[95:64]) * SignExtend64( SRC2[95:64]) 
DEST[MAXVL-1:128] := 0 


PMULDQ (128-bit Legacy SSE version) 

DEST[63:0] := SignExtend64( DEST[31:0]) * SignExtend64( SRC[31:0]) 
DEST[127:64] := SignExtend64( DEST[95:64]) * SignExtend64( SRC[95:64]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMULDQ __m512i__mm512_mul_epi32(__m512i a, __m512i b); 


VPMULDQ __m512i__mm512_mask_mul_epi32(__m512i s, __mmask8 k,___m512i a, __m512i b); 
VPMULDQ __m512i__mm512_maskz_mul_epi32(__mmask8 k,___m512i a, ___m512i b); 
VPMULDQ __m256i _mm256_mask_mul_epi32(__m256i s,___mmask8 k, __m256i a, __m256i b); 


VPMULDQ __m256i _mm256_mask_mul_epi32(__mmask8 k, __m256i a, __m256i b); 
VPMULDQ __m128i _mm_mask_mul_epi32(__m128i s,___mmask8 k,___m128i a, __m128i b); 
VPMULDQ __m128i _mm_mask_mul_epi32(__mmask8 k, __m128i a, ___m128i b); 
(V)PMULDQ __m128i __mm_mul_epi32(__m128i a, __m128i b); 

VPMULDQ __m256i _mm256_mul_epi32(__m256i a, __m256i b); 


PMULDQ—Multiply Packed Doubleword Integers Vol.2B 4-373 


INSTRUCTION SET REFERENCE, M-U 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PMULHRSW — Packed Multiply High with Round and Scale 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 OB /r’ A VIV SSSE3 Multiply 16-bit signed words, scale and round 

PMULHRSW mm1, mm2/m64 signed doublewords, pack high 16 bits to 
mm1,. 

66 OF 38 OB /r A VIV SSSE3 Multiply 16-bit signed words, scale and round 

PMULHRSW xmm1, xmm2/m128 signed doublewords, pack high 16 bits to 
xmm1. 

VEX.128.66.0F38.WIG OB /r B VIV AVX Multiply 16-bit signed words, scale and round 

VPMULHRSW xmm1, xmm2, xmm3/m128 signed doublewords, pack high 16 bits to 
xmm1. 

VEX.256.66.0F38.WIG OB /r B VIV AVX2 Multiply 16-bit signed words, scale and round 

VPMULHRSW ymm1, ymm2, ymm3/m256 signed doublewords, pack high 16 bits to 
ymm1. 

EVEX.128.66.0F38.WIG OB /r C VIV AVX512VL | Multiply 16-bit signed words, scale and round 

VPMULHRSW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | signed doublewords, pack high 16 bits to 
xmm1 under writemask k1. 

EVEX.256.66.0F38.WIG OB /r C VIV AVX512VL_ | Multiply 16-bit signed words, scale and round 

VPMULHRSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | signed doublewords, pack high 16 bits to 
ymm1 under writemask k1. 

EVEX.512.66.0F38.WIG OB /r C VIV AVX512BW | Multiply 16-bit signed words, scale and round 

VPMULHRSW zmm1 {k1}{z}, zmm2, zmm3/m512 signed doublewords, pack high 16 bits to 
zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


PMULHRSW multiplies vertically each signed 16-bit integer from the destination operand (first operand) with the 
corresponding signed 16-bit integer of the source operand (second operand), producing intermediate, signed 32- 
bit integers. Each intermediate 32-bit integer is truncated to the 18 most significant bits. Rounding is always 
performed by adding 1 to the least significant bit of the 18-bit intermediate result. The final result is obtained by 
selecting the 16 bits immediately to the right of the most significant bit of each 18-bit intermediate result and 
packed to the destination operand. 


When the source operand is a 128-bit memory operand, the operand must be aligned on a 16-byte boundary ora 
general-protection exception (#GP) will be generated. 


In 64-bit mode and not encoded with VEX/EVEX, use the REX prefix to access XMM8-XMM15 registers. 


Legacy SSE version 64-bit operand: Both operands can be MMX registers. The second source operand is an MMX 
register or a 64-bit memory location. 
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128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 


VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM 
register conditionally updated with writemask k1. 


Operation 


PMULHRSW (with 64-bit operands) 
temp0[31:0] = INT32 ((DEST[15:0] * SRC[15:0]) >>14) + 1; 
temp1[31:0] = INT32 ((DEST[31:16] * SRC[31:16]) >>14) + 1; 
temp2[31:0] = INT32 ((DEST[47:32] * SRC[47:32]) >> 14) + 1; 
temp3[31:0] = INT32 ((DEST[63:48] * SRc[63:48]) >> 14) + 1; 
DEST[15:0] = tempO[16:1]; 
DEST[31:16] = temp1[16:1]; 
DEST[47:32] = temp2[16:1]; 
DEST[63:48] = temp3[16:1]; 


PMULHRSW (with 128-bit operand) 
temp0[31:0] = INT32 ((DEST[15:0] * SRC[15:0]) >>14) + 1; 
temp1[31:0] = INT32 ((DEST[31:16] * SRC[31:16]) >>14) + 1 
temp2[31:0] = INT32 ((DEST[47:32] * SRC[47:32]) >>14) + 1 
temp3[31:0] = INT32 ((DEST[63:48] * SRC[63:48]) >>14) + 1; 
temp4[31:0] = INT32 ((DEST[79:64] * SRC[79:64]) >>14) + 1 
temp5[31:0] = INT32 ((DEST[95:80] * SRC[95:80]) >>14) + 1; 
temp6[31:0] = INT32 ((DEST[1 11:96] * SRC[111:96]) >>14) + 1; 
temp7[31:0] = INT32 ((DEST[127:112] * SRC[127:112) >>14) + 1; 
DEST[15:0] = tempO[16:1]; 
DEST[31:16] = temp1[16:1]; 
DEST[47:32] = temp2[16:1]; 
DEST[63:48] = temp3[16:1]; 
DEST[79:64] = temp4[1 6:1]; 
DEST[95:80] = temp5[16:1]; 
DEST[1 11:96] = temp6[16:1]; 
DEST[127:112] = temp7[16:1]; 


VPMULHRSW (VEX.128 encoded version) 
tempO[31:0] := INT32 ((SRC1[15:0] * SRC2[15:0]) >>14) + 1 


temp5[31:0] := INT32 ((SRC1[95:80] * SRC2[95:80]) >>14) + 1 
temp6[31:0] := INT32 ((SRC1[1 11:96] * SRC2[111:96]) >>14) + 1 
temp7[31:0] := INT32 ((SRC1[127:112] * SRC2[127:112) >>14) + 1 
DEST[15:0] := tempO[16:1] 

DEST[31:16] := temp1[16:1] 

DEST[47:32] := temp2[16:1] 


temp1[31:0] := INT32 ((SRC1[31:16] * SRC2[31:16]) >>14) +1 
temp2[31:0] := INT32 ((SRC1[47:32] * SRC2[47:32]) >>14) +1 
temp3[31:0] := INT32 ((SRC1[63:48] * SRC2[63:48]) >>14) + 1 
temp4[31:0] := INT32 ((SRC1[79:64] * SRC2[79:64]) >>14) + 1 
( 
( 
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DEST[63:48] := temp3[16:1] 
DEST[79:64] := temp4[16:1] 
DEST[95:80] := temp5[16:1] 
DEST[111:96] := temp6[16:1] 
DEST[127:112] := temp7[16:1] 
DEST[MAXVL-1:128] := 0 


VPMULHRSW (VEX.256 encoded version) 
temp0[31:0] := INT32 ((SRC1[15:0] * SRC2[15:0]) >>14) + 1 
temp1[31:0] := INT32 ((SRC1[31:16] * SRC2[31:16]) >>14 
temp2[31:0] := INT32 ((SRC1[47:32] * SRC2[47:32]) >>14 
temp3[31:0] := INT32 ((SRC1[63:48] * SRC2[63:48]) >>14 
temp4[31:0] := INT32 ((SRC1[79:64] * SRC2[79:64]) >>14) +1 
temp5[31:0] := INT32 ((SRC1[95:80] * SRC2[95:80]) >>14) + 1 

( 

( 

( 

( 


+] 
+4 
+] 


Sea SPS aS 


temp6[31:0] := INT32 ((SRC1[111:96] * SRC2[111:96]) >>14) +1 
temp7[31:0] := INT32 ((SRC1[127:112] * SRC2[127:112) >>14) +1 
temp8[31:0] := INT32 ((SRC1[143:128] * SRC2[143:128]) >>14) + 1 
temp9[31:0] := INT32 ((SRC1[159:144] * SRC2[159:144]) >>14) +1 
temp10[31:0] := INT32 ((SRC1[75:160] * SRC2[175:160]) >>14) +1 
temp11[31:0] := INT32 ((SRC1[191:176] * SRC2[191:176]) >>14) +1 
temp12[31:0] := INT32 ((SRC1[207:192] * SRC2[207:192]) >>14) +1 
temp13[31:0] := INT32 ((SRC1[223:208] * SRC2[223:208]) >>14) +1 
(( ) )+1 
(( 


EEE ae 


temp14[31:0] := INT32 ((SRC1[239:224] * SRC2[239:224]) >>14 
temp15[31:0] := INT32 ((SRC1[255:240] * SRC2[255:240) >>14) +1 


DEST[15:0] := tempO[16:1] 
DEST[31:16] := temp1[16:1] 
DEST[47:32] := temp2[16:1] 
DEST[63:48] := temp3[16:1] 
DEST[79:64] := temp4[16:1] 
DEST[95:80] := temp5[16:1] 
DEST[1 11:96] := temp6[16:1] 
DEST[127:112] := temp7[16:1] 
DEST[143:128] := temp8[16:1] 
DEST[159:144] := temp9[16:1] 
DEST[175:160] := temp10[16:1] 
DEST[191:1 76] := temp11[16:1] 
DEST[207:192] := temp12[16:1] 
DEST[223:208] := temp13[16:1] 
DEST[239:224] := temp14[16:1] 
DEST[255:240] := temp15[16:1] 
DEST[MAXVL-1:256] := 0 


VPMULHRSW (EVEX encoded version) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
temp[31:0] := ((SRC1[i+15:i] * SRC2[i+15:i]) >>14) + 1 
DEST[i+1 5:i] = tmp[16:1] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
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ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 
VPMULHRSW __m512i_mm512_mulhrs_epi16(__m512i a,__m512ib); 

VPMULHRSW __m512i_mm512_mask_mulhrs_epi16(__m512i s,__ mmask32 k,___m512i a,__m512ib); 
VPMULHRSW __m512i_mm512_maskz_mulhrs_epi16(__mmask32 k,___m512i a,__m512i b); 
VPMULHRSW __m256i__mm256_mask_mulhrs_epi16(__m256i s,__ mmask16 k,__ m256i a,___m256i b); 
VPMULHRSW __m256i __mm256_maskz_mulhrs_epi16(__mmask16 k, __m256i a,__m256i b); 
VPMULHRSW __m128i__mm_mask_mulhrs_epi16(__m128i s,___ mmask8 k, __m128i a, ___m128i b); 
VPMULHRSW __m128i__mm_maskz_mulhrs_epi16(__mmask8 k,___m128i a, ___m128i b); 

PMULHRSW: __m64 _mm_mulhrs_pi16 (__m64 a,__m64 b) 

(V)PMULHRSW: __m128i__mm_mulhrs_epi16 (__m128i a, 
VPMULHRSW:__m256i __mm256_mulhrs_epi16 (__m256i a, 


m128i b) 
m256i b) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 


4-378 Vol. 2B PMULHRSW — Packed Multiply High with Round and Scale 


INSTRUCTION SET REFERENCE, M-U 


PMULHUW—Multiply Packed Unsigned Integers and Store High Result 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF €4 /r' A VIV SSE Multiply the packed unsigned word integers in 

PMULHUW mm1, mm2/m64 mm1 register and mm2/m64, and store the 
high 16 bits of the results in mm7. 

66 OF E4/r A VIV SSE2 Multiply the packed unsigned word integers in 

PMULHUW xmm1, xmm2/m128 xmm1 and xmm2/m128, and store the high 
16 bits of the results in xmm7. 

VEX.128.66.0F.WIG E4 /r B VV AVX Multiply the packed unsigned word integers in 

VPMULHUW xmm1, xmm2, xmm3/m128 xmm2 and xmm3/m128, and store the high 
16 bits of the results in xmm7. 

VEX.256.66.0F.WIG E4 /r B VV AVX2 Multiply the packed unsigned word integers in 

VPMULHUW ymm1, ymm2, ymm3/m256 ymmeé and ymm3/m256, and store the high 
16 bits of the results in ymm7. 

EVEX.128.66.0F.WIG E4 /r C VV AVX512VL | Multiply the packed unsigned word integers in 

VPMULHUW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2 and xmm3/m1 28, and store the high 
16 bits of the results in xmm1 under 
writemask k1. 

EVEX.256.66.0F.WIG E4 /r C VIV AVX512VL | Multiply the packed unsigned word integers in 

VPMULHUW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2 and ymm3/m256, and store the high 
16 bits of the results in ymm1 under 
writemask k1. 

EVEX.512.66.0F.WIG E4 /r C VV AVX512BW | Multiply the packed unsigned word integers in 

VPMULHUW zmm1 {k1}{z}, zmm2, zmm3/m512 zmme2 and zmm3/m51 2, and store the high 16 
bits of the results in zmm1 under writemask 
k1, 

NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD unsigned multiply of the packed unsigned word integers in the destination operand (first operand) 
and the source operand (second operand), and stores the high 16 bits of each 32-bit intermediate results in the 
destination operand. (Figure 4-12 shows this operation when using 64-bit operands.) 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The source operand can be an MMX technology register or a 64-bit memory 
location. The destination operand is an MMX technology register. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 
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VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. VEX.L must be 0, otherwise the instruction will #UD. 


VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM 
register conditionally updated with writemask k1. 


SRC x3 x2 x1 x0 
DEST Y3 Y2 Y1 YO 

TEMP | Z3=X3* Y3 Z2 =X2«Y2 Z1=X1#Y1 Z0 = XO * YO 
DEST 23[31:16] | Z2[31:16] | 21[31:16]] Z0[31:16] 


Figure 4-12. PMULHUW and PMULHW Instruction Operation Using 64-bit Operands 


Operation 


PMULHUW (with 64-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Unsigned multiplication *) 
TEMP1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
DEST[15:0] := TEMPO[31:16]; 
DEST[31:16] := TEMP1[31:16]; 
DEST[47:32] := TEMP2[31:16]; 
DEST[63:48] := TEMP3[31:16]; 


PMULHUW (with 128-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Unsigned multiplication *) 
TEMP1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
TEMP4[31:0] := DEST[79:64] * SRC[79:64]; 
TEMP5[31:0] := DEST[95:80] * SRC[95:80]; 
TEMP6[31:0] := DEST[11 1:96] * SRC[1 11:96]; 
TEMP7[31:0] := DEST[127:112] * SRC[127:112]; 
DEST[15:0] := TEMPO[31:16]; 
DEST[31:16] := TEMP1[31:16]; 
DEST[47:32] := TEMP2[31:16]; 
DEST[63:48] := TEMP3[31:16]; 
DEST[79:64] := TEMP4[31:16]; 
DEST[95:80] := TEMP5[31:16]; 
DEST[1 11:96] := TEMP6[31:16]; 
DEST[127:112] := TEMP7[31:16]; 
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VPMULHUW (VEX.128 encoded version) 
TEMPO[31:0] := SRC1[15:0] * SRC2[15:0) 
TEMP 1[31:0] := SRC1[31:16] * SRC2[31:16] 
TEMP2[31:0] := SRC1[47:32] * SRC2[47:32] 
TEMP3[31:0] := SRC1[63:48] * SRC2[63:48] 
TEMP4[3 1:0] := SRC1[79:64] * SRC2[79:64] 
TEMP5[3 1:0] := SRC1[95:80] * SRC2[95:80] 
TEMP6[31:0] := SRC1[111:96] * SRC2[1 11:96] 
TEMP7[31:0] := SRC1[127:112] * SRC2[127:112] 
DEST[15:0] := TEMPO[31:16] 

DEST[31:16] := TEMP1[31:16] 

DEST[47:32] := TEMP2[31:16] 

DEST[63:48] := TEMP3[31:16] 

DEST[79:64] := TEMP4[31:16] 

DEST[95:80] := TEMP5[31:16] 

DEST[11 1:96] := TEMP6[31:16] 
DEST[127:112] := TEMP7[31:16] 
DEST[MAXVL-1:128] := 0 


PMULHUW (VEX.256 encoded version) 
TEMPO[31:0] := SRC1[15:0] * SRC2[15:0] 

TEMP 1[31:0] := SRC1[31:16] * SRC2[31:16] 
TEMP2[31:0] := SRC1[47:32] * SRC2[47:32] 
TEMP3[3 1:0] := SRC1[63:48] * SRC2[63:48] 
TEMP4[3 1:0] := SRC1[79:64] * SRC2[79:64] 
TEMP5[3 1:0] := SRC1[95:80] * SRC2[95:80] 
TEMP6[31:0] := SRC1[111:96] * SRC2[1 11:96] 
TEMP7[31:0] := SRC1[127:112] * SRC2[127:112] 
TEMP8[31:0] := SRC1[143:128] * SRC2[143:128] 
TEMP9[3 1:0] := SRC1[159:144] * SRC2[159:144] 
TEMP 10[31:0] := SRC1[175:160] * SRC2[175:160] 
TEMP1 1[31:0] := SRC1[191:176] * SRC2[191:176] 
TEMP 1 2[31:0] := SRC1[207:192] * SRC2[207:192] 
TEMP 1 3[31:0] := SRC1[223:208] * SRC2[223:208] 
TEMP 14[31:0] := SRC1[239:224] * SRC2[239:224] 
TEMP 15[31:0] := SRC1[255:240] * SRC2[255:240] 
DEST[15:0] := TEMPO[31:16] 

DEST[31:16] := TEMP1[31:16] 

DEST[47:32] := TEMP2[31:16] 

DEST[63:48] := TEMP3[31:16] 

DEST[79:64] := TEMP4[31:16] 

DEST[95:80] := TEMP5[31:16] 

DEST[11 1:96] := TEMP6[31:16] 

DEST[127:112] := TEMP7[31:16] 

DEST[143:128] := TEMP8[31:16] 

DEST[159:144] := TEMP9[31:16] 

DEST[175:160] := TEMP10[31:16] 

DEST[191:1 76] := TEMP11[31:16] 

DEST[207:192] := TEMP12[31:16] 

DEST[223:208] := TEMP13[31:16] 

DEST[239:224] := TEMP14[31:16] 

DEST[255:240] := TEMP15[31:16] 
DEST[MAXVL-1:256] := 0 
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PMULHUW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
temp[31:0] := SRC1[i+15:i] * SRC2[i+15:i] 
DEST[i+1 5:i] = tmp[31:16] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMULHUW __m512i_mm512_mulhi_epu16(__m512i a,__m512i b); 


VPMULHUW __m512i_mm512_mask_mulhi_epu16(__m512is,__ mmask32 k,__m512i a,__m512ib); 
VPMULHUW __m512i_mm512_maskz_mulhi_epu16(__mmask32 k,__m512ia,__m512i b); 
VPMULHUW __m256i_mm256_mask_mulhi_epu16(__m256i s,__ mmask16 k,__ m256i a, __m256i b); 


VPMULHUW __m256i __mm256_maskz_mulhi_epu16(__mmask16 k,___ m256i a, ___ m256i b); 
VPMULHUW __m128i__mm_mask_mulhi_epu16(__m128is,__ mmask8 k,__m128i a,__m128i b); 
VPMULHUW __m128i__mm_maskz_mulhi_epu16(__mmask8 k, __m128i a,__m128i b); 
PMULHUW:__m64 _mm_mulhi_pu16(__m64 a, ___m64 b) 

(V)PMULHUW:__m128i __mm_mulhi_epu16 (__m128i a, ___m128i b) 
VPMULHUW:__m256i__mm256_mulhi_epu16 (__m256i a, __m256i b) 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PMULHW—Multiply Packed Signed Integers and Store High Result 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF €5 /r' A VIV MMX Multiply the packed signed word integers in mm17 

PMULHW mm, mm/m64 register and mm2/m64, and store the high 16 
bits of the results in mm7. 

66 OF E5 /r A VIV SSE2 Multiply the packed signed word integers in 

PMULHW xmm1, xmm2/m128 xmm1 and xmm2/m128, and store the high 16 
bits of the results in xmm17. 

VEX.128.66.0F.WIG E5 /r B VIV AVX Multiply the packed signed word integers in 

VPMULHW xmm1, xmm2, xmm3/m128 xmm2 and xmm3/m128, and store the high 16 
bits of the results in xmm1. 

VEX.256.66.0F.WIG E5 /r B VIV AVX2 Multiply the packed signed word integers in 

VPMULHW ymm1, ymm2, ymm3/m256 ymme and ymm3/m256, and store the high 16 
bits of the results in ymm7. 

EVEX.128.66.0F.WIG E5 /r C VIV AVX512VL_ | Multiply the packed signed word integers in 

VPMULHW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2 and xmm3/m128, and store the high 16 
bits of the results in xmm1 under writemask k1. 

EVEX.256.66.0F.WIG E5 /r C VIV AVX512VL_ | Multiply the packed signed word integers in 

VPMULHW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2 and ymm3/m256, and store the high 16 
bits of the results in ymm1 under writemask k1. 

EVEX.512.66.0F.WIG E5 /r C VIV AVX512BW | Multiply the packed signed word integers in 

VPMULHW zmm1 {k1}{z}, zmm2, zmm3/m512 zmme2 and zmm3/m512, and store the high 16 
bits of the results in zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD signed multiply of the packed signed word integers in the destination operand (first operand) and 
the source operand (second operand), and stores the high 16 bits of each intermediate 32-bit result in the destina- 
tion operand. (Figure 4-12 shows this operation when using 64-bit operands.) 


n 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The source operand can be an MMX technology register or a 64-bit memory 
location. The destination operand is an MMX technology register. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. VEX.L must be 0, otherwise the instruction will #UD. 
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VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 


first source and destination operands are YMM registers. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM 


register conditionally updated with writemask k1. 


Operation 


PMULHW (with 64-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Signed multiplication *) 
TEMP 1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
DEST[15:0] := TEMPO[31:16]; 
DEST[31:16] := TEMP1[31:16]; 
DEST[47:32] := TEMP2[31:16]; 
DEST[63:48] := TEMP3[31:16]; 


PMULHW (with 128-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Signed multiplication *) 
TEMP1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
TEMP4[31:0] := DEST[79:64] * SRC[79:64]; 
TEMP5[31:0] := DEST[95:80] * SRC[95:80]; 
TEMP6[31:0] := DEST[11 1:96] * SRC[1 11:96]; 
TEMP7[31:0] := DEST[127:112] * SRC[127:112]; 
DEST[15:0] := TEMPO[31:16]; 
DEST[31:16] := TEMP1[31:16]; 
DEST[47:32] := TEMP2[31:16]; 
DEST[63:48] := TEMP3[31:16]; 
DEST[79:64] := TEMP4[31:16]; 
DEST[95:80] := TEMP5[31:16]; 
DEST[111:96] := TEMP6[3 1:16]; 
DEST[127:112] := TEMP7[31:16]; 


VPMULHW (VEX.128 encoded version) 
TEMPO[31:0] := SRC1[15:0] * SRC2[15:0] (*Signed Multiplication*) 
TEMP 1[31:0] := SRC1[31:16] * SRC2[31:16] 
TEMP2[31:0] := SRC1[47:32] * SRC2[47:32] 
TEMP3[31:0] := SRC1[63:48] * SRC2[63:48] 
TEMP4[3 1:0] := SRC1[79:64] * SRC2[79:64] 
TEMP5[31:0] := SRC1[95:80] * SRC2[95:80] 
TEMP6[3 1:0] := SRC1[111:96] * SRC2[1 11:96] 
TEMP7[31:0] := SRC1[127:112] * SRC2[127:112] 
DEST[15:0] := TEMPO[31:16] 

DEST[31:16] := TEMP1[31:16] 

DEST[47:32] := TEMP2[31:16] 

DEST[63:48] := TEMP3[31:16] 

DEST[79:64] := TEMP4[31:16] 

DEST[95:80] := TEMP5[31:16] 

DEST[1 11:96] := TEMP6[31:16] 

DEST[127:112] := TEMP7[31:16] 
DEST[MAXVL-1:128] := 0 
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PMULHW (VEX.256 encoded version) 
TEMPO[31:0] := SRC1[15:0] * SRC2[15:0] (*Signed Multiplication*) 
TEMP 1[31:0] := SRC1[31:16] * SRC2[31:16] 
TEMP2[31:0] := SRC1[47:32] * SRC2[47:32] 
TEMP3[31:0] := SRC1[63:48] * SRC2[63:48] 
TEMP4[3 1:0] := SRC1[79:64] * SRC2[79:64] 
TEMP5[3 1:0] := SRC1[95:80] * SRC2[95:80] 
TEMP6[31:0] := SRC1[111:96] * SRC2[1 11:96] 
TEMP7[31:0] := SRC1[127:112] * SRC2[127:112] 
TEMP8[31:0] := SRC1[143:128] * SRC2[143:128] 
TEMP9[3 1:0] := SRC1[159:144] * SRC2[159:144] 
TEMP 10[31:0] := SRC1[175:160] * SRC2[175:160] 
TEMP 1 1[31:0] := SRC1[191:176] * SRC2[191:176] 
TEMP 1 2[31:0] := SRC1[207:192] * SRC2[207:192] 
TEMP 1 3[31:0] := SRC1[223:208] * SRC2[223:208] 
TEMP 14[31:0] := SRC1[239:224] * SRC2[239:224] 
TEMP 15[31:0] := SRC1[255:240] * SRC2[255:240] 
DEST[15:0] := TEMPO[31:16] 

DEST[31:16] := TEMP1[31:16] 

DEST[47:32] := TEMP2[31:16] 

DEST[63:48] := TEMP3[31:16] 

DEST[79:64] := TEMP4[31:16] 

DEST[95:80] := TEMP5[31:16] 

DEST[111:96] := TEMP6[31:16] 

DEST[127:112] := TEMP7[31:16] 

DEST[143:128] := TEMP8[31:16] 

DEST[159:144] := TEMP9[31:16] 

DEST[175:160] := TEMP10[31:16] 

DEST[191:1 76] := TEMP11[31:16] 

DEST[207:192] := TEMP12[31:16] 

DEST[223:208] := TEMP13[31:16] 

DEST[239:224] := TEMP14[31:16] 

DEST[255:240) := TEMP15[31:16] 
DEST[MAXVL-1:256] := 0 


PMULHW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
temp[31:0] := SRC1[i+15:i] * SRC2[i+15:i] 
DEST[i+15:i] := tmp[31:16] 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 

VPMULHW __m512i__mm512_mulhi_epi16(__m512i a, ___m512i b); 

VPMULHW __m512i__mm512_mask_mulhi_epi16(__m512is,___ mmask32 k,__m512i a,__m512i b); 
VPMULHW __m512i__mm512_maskz_mulhi_epi16(__ mmask32 k,__m512i a,__m512ib); 
VPMULHW __m256i _mm256_mask_mulhi_epi16(__m256i s,__ mmask16 k,__ m256i a, __ m256i b); 
VPMULHW __m256i __mm256_maskz_mulhi_epi16(__ mmask16 k,__ m256i a, ___m256i b); 
VPMULHW __m128i __mm_mask_mulhi_epi16(__m128i s,___ mmask8 k,___m128i a,__m128i b); 
VPMULHW __m128i __mm_maskz_mulhi_epi16(__mmask8 k,___m128i a,__m128i b); 
PMULHW:__m64 __mm_mulhi_pi16 (__m64 m1,__ m64 m2) 
(V)PMULHW:__m128i__mm_mulhi_epi16 (__m128i a,__m128ib) 

VPMULHW:__m256i __mm256_mulhi_epi16 (__m256i a, __m256i b) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PMULLD/PMULLQ—Multiply Packed Integers and Store Low Result 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

66 OF 38 40 /r A VIV SSE4_1 Multiply the packed dword signed integers in xmm1 and 
PMULLD xmm1, xmm2/m128 xmm2/m128 and store the low 32 bits of each product in 

xmm1. 
VEX.128.66.0F38.WIG 40 /r B VIN AVX Multiply the packed dword signed integers in xmm2 and 
VPMULLD xmm1, xmm2z, xmm3/m128 and store the low 32 bits of each product in 
xmm3/m128 xmm1. 
VEX.256.66.0F38.WIG 40 /r B VV AVX2 Multiply the packed dword signed integers in ymm2 and 
VPMULLD ymm1, ymm2, ymm3/m256 and store the low 32 bits of each product in 
ymm3/m256 ymm1. 
EVEX.128.66.0F38.W0 40 /r C VV AVX512VL | Multiply the packed dword signed integers in xmm2 and 
VPMULLD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m32bcst and store the low 32 bits of each 
xmm3/m128/m32bcst product in xmm1 under writemask k1. 
EVEX.256.66.0F38.W0 40 /r C VIV AVX512VL | Multiply the packed dword signed integers in ymm2 and 
VPMULLD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and store the low 32 bits of each 
ymm3/m256/m32bcst product in ymm1 under writemask k1. 
EVEX.512.66.0F38.W0 40 /r C VV AVX512F Multiply the packed dword signed integers in zmm2 and 
VPMULLD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and store the low 32 bits of each 
zmm3/m512/m32bcst product in zmm1 under writemask k1. 
EVEX.128.66.0F38.W1 40 /r C VV AVX512VL | Multiply the packed qword signed integers in xmm2 and 
VPMULLOQ xmm1 {k1}{z}, xmm2, AVX512DQ | xmm3/m128/m64bcst and store the low 64 bits of each 
xmm3/m128/m64bcst product in xmm1 under writemask k1. 
EVEX.256.66.0F38.W1 40 /r C VIV AVX512VL | Multiply the packed qword signed integers in ymm2 and 
VPMULLQ ymm1 {k1}{z}, ymm2, AVX512DQ | ymm3/m256/m64bcst and store the low 64 bits of each 
ymm3/m256/m64bcst product in ymm1 under writemask k1. 
EVEX.512.66.0F38.W1 40 /r a VIN AVX512DQ | Multiply the packed qword signed integers in zmm2 and 
VPMULLO zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and store the low 64 bits of each 
zmm3/m512/m64bcst product in zmm1 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD signed multiply of the packed signed dword/qword integers from each element of the first source 
operand with the corresponding element in the second source operand. The low 32/64 bits of each 64/128-bit 
intermediate results are stored to the destination operand. 

128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding ZMM destina- 
tion register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding ZMM register 
are zeroed. 


VEX.256 encoded version: The first Source operand is a YMM register; The second source operand is a YMM register 
or 256-bit memory location. Bits (MAXVL-1:256) of the corresponding destination ZMM register are zeroed. 
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EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is conditionally updated based on writemask k1. 


Operation 


VPMULLQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN Temp[1 27:0] := SRC1[i+63:i] * SRC2[63:0] 
ELSE Temp[1 27:0] := SRC1[i+63:i] * SRC2[i+63:i] 
Fl; 
DEST[i+63:i] = Temp[63:0] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMULLD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN Temp[63:0] := SRC1[i+31:i] * SRC2[31:0] 
ELSE Temp[63:0] := SRC1[i+31:i] * SRC2[i+31:i] 
Fl; 
DEST[i+31:i] = Temp[31:0] 
ELSE 
IF *merging-masking* ; merging-masking 
*DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VPMULLD (VEX.256 encoded version) 
Temp0[63:0] := SRC1[31:0] * SRC2[31:0] 

Temp1 [63:0] := SRC1[63:32] * SRC2[63:32] 
Temp2[63:0] := SRC1[95:64] * SRC2[95:64] 
Temp3[63:0] := SRC1[127:96] * SRC2[127:96] 
Temp4[63:0] := SRC1[159:128] * SRC2[159:128] 
Temp5[63:0] := SRC1[191:160] * SRC2[191:160] 
Temp6[63:0] := SRC1[223:192] * SRC2[223:192] 
Temp7[63:0] := SRC1[255:224] * SRC2[255:224] 


DEST[31:0] := TempO0[31:0] 
DEST[63:32] = Temp1[31:0] 
DEST[95:64] = Temp2[31:0] 
DEST[127:96] := Temp3[31:0] 
DEST[159:128] = Temp4[31:0] 
DEST[191:160] = Temp5[31:0] 
DEST[223:192] = Temp6[31:0] 
DEST[255:224] := Temp7[31:0] 
DEST[MAXVL-1:256] := 0 


VPMULLD (VEX.128 encoded version) 
TempO[63:0] := SRC1[31:0] * SRC2[31:0] 
Temp1 [63:0] := SRC1[63:32] * SRC2[63:32] 
Temp2[63:0] := SRC1[95:64] * SRC2[95:64] 
Temp3[63:0] := SRC1[127:96] * SRC2[127:96] 
DEST[31:0] := Temp0[31:0] 

DEST[63:32] := Temp1[31:0] 

DEST[95:64] := Temp2[31:0] 

DEST[127:96] := Temp3[31:0] 
DEST[MAXVL-1:128] := 0 


PMULLD (128-bit Legacy SSE version) 
Temp0[63:0] := DEST[31:0] * SRC[31:0] 
Temp1[63:0] := DEST[63:32] * SRC[63:32] 
Temp2[63:0] := DEST[95:64] * SRC[95:64] 
Temp3[63:0] := DEST[127:96] * SRC[127:96] 
DEST[31:0] := TempO[31:0] 

DEST[63:32] := Temp1[31:0] 

DEST[95:64] := Temp2[31:0] 

DEST[127:96] := Temp3[31:0] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


INSTRUCTION SET REFERENCE, M-U 


VPMULLD __m512i_mm512_mullo_epi32(__m512i a,__m512i b); 

VPMULLD __m512i_mm512_mask_mullo_epi32(__m512is,__ mmask16 k,__m512i a, ___m512i b); 
VPMULLD __m512i_mm512_maskz_mullo_epi32(__ mmask16 k,__m512i a,__m512i b); 
VPMULLD __m256i__mm256_mask_mullo_epi32(__m256is,__ mmask8 k,__ m256i a, __ m256i b); 
VPMULLD __m256i__mm256_maskz_mullo_epi32(__mmask8 k,__ m256i a, ___ m256i b); 
VPMULLD __m128i__mm_mask_mullo_epi32(__m128is,__ mmask8 k,___m128i a, __m128i b); 
VPMULLD __m128i__mm_maskz_mullo_epi32(__mmask8 k, __m128i a,__m128i b); 

VPMULLD __m256i__mm256_mullo_epi32(__m256i a, __ m256i b); 

PMULLD __m128i __mm_mullo_epi32(__m128i a,__m128i b); 

VPMULLQ __m512i__mm512_mullo_epi64(__m512i a,__m512i b); 

VPMULLQ __m512i__mm512_mask_mullo_epi64(__m512is, __mmask8 k,__m512i a, ___m512i b); 


PMULLD/PMULLQ—Multiply Packed Integers and Store Low Result 


Vol.2B 4-389 


INSTRUCTION SET REFERENCE, M-U 


VPMULLQ __m512i __mm512_maskz_mullo_epi64(_mmask8 k, __m512i a, ___m512i b); 
VPMULLQ __m256i _mm256_mullo_epi64( m256i b); 

VPMULLQ __m256i _mm256_mask_mullo_epi64(__m256i s,___mmask8 k, __m256i a, __m256i b); 
VPMULLQ __m256i _mm256_maskz_mullo_epi64(_mmask8 k, __m256i a, __m256i b); 
VPMULLQ __m128i _mm_mullo_epi64( m1 28i b); 

VPMULLQ __m128i _mm_mask_mullo_epi64( mmask8 k, __m128i a,__m128i b); 
VPMULLQ __m128i __mm_maskz_mullo_epi64(_mmask8 k, __m128i a, __m128i b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PMULLW—Multiply Packed Signed Integers and Store Low Result 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF DS /r' A VIV MMX Multiply the packed signed word integers in 

PMULLW mm, mm/m64 mm 1 register and mm2/m64, and store the low 
16 bits of the results in mm7. 

66 OF D5 /r A VIV SSE2 Multiply the packed signed word integers in 

PMULLW xmm1, xmm2/m128 xmm1 and xmm2/m128, and store the low 16 
bits of the results in xmm7. 

VEX.128.66.0F.WIG D5 /r B VIN AVX Multiply the packed dword signed integers in 

VPMULLW xmm1, xmm2, xmm3/m128 xmmeé and xmm3/m128 and store the low 32 
bits of each product in xmm7. 

VEX.256.66.0F.WIG D5 /r B VIV AVX2 Multiply the packed signed word integers in 

VPMULLW ymm1, ymm2, ymm3/m256 ymmeé and ymm3/m256, and store the low 16 
bits of the results in ymm7. 

EVEX.128.66.0F.WIG D5 /r C VIV AVX512VL | Multiply the packed signed word integers in 

VPMULLW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm2 and xmm3/m128, and store the low 16 
bits of the results in xmm1 under writemask k1. 

EVEX.256.66.0F.WIG D5 /r C VIV AVX512VL | Multiply the packed signed word integers in 

VPMULLW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm2 and ymm3/m256, and store the low 16 
bits of the results in ymm1 under writemask k1. 

EVEX.512.66.0F.WIG D5 /r C VIV AVX512BW | Multiply the packed signed word integers in 

VPMULLW zmm1 {k1}{z}, zmm2, zmm3/m512 zmme2 and zmm3/m512, and store the low 16 
bits of the results in zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD signed multiply of the packed signed word integers in the destination operand (first operand) and 
the source operand (second operand), and stores the low 16 bits of each intermediate 32-bit result in the destina- 
tion operand. (Figure 4-12 shows this operation when using 64-bit operands.) 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The source operand can be an MMX technology register or a 64-bit memory 
location. The destination operand is an MMX technology register. 


128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 


VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. VEX.L must be 0, otherwise the instruction will #UD. 
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VEX.256 encoded version: The second source operand can be an YMM register or a 256-bit memory location. The 
first source and destination operands are YMM registers. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand is a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination operand is conditionally updated 
based on writemask k1. 


SRC x3 x2 x1 x0 
DEST l vs | v2 | v1 | vo | 

TEMP | Z3=X3* Y3 Z2 = X2 * Y2 Z1=X1*Y1 ZO = X0 « YO 
DEST 23[15:0] | Z2[15:0] | Z1[15:0] | Z0[15:0] 


Figure 4-13. PMULLU Instruction Operation Using 64-bit Operands 


Operation 


PMULLW (with 64-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Signed multiplication *) 
TEMP1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
DEST[15:0] := TEMPO[15:0); 
DEST[31:16] := TEMP1[15:0]; 
DEST[47:32] := TEMP2[15:0]; 
DEST[63:48] := TEMP3[15:0]; 


PMULLW (with 128-bit operands) 
TEMPO[31:0] := DEST[15:0] * SRC[15:0]; (* Signed multiplication *) 
TEMP 1[31:0] := DEST[31:16] * SRC[31:16]; 
TEMP2[31:0] := DEST[47:32] * SRC[47:32]; 
TEMP3[31:0] := DEST[63:48] * SRC[63:48]; 
TEMP4[31:0] := DEST[79:64] * SRC[79:64]; 
TEMP5[31:0] := DEST[95:80] * SRC[95:80]; 
TEMP6[31:0] := DEST[111:96] * SRC[111:96]; 
TEMP7[31:0] := DEST[127:112] * SRC[127:112]; 
DEST[15:0] := TEMPO[15:0); 
DEST[31:16] := TEMP1[15:0]; 
DEST[47:32] := TEMP2[15:0]; 
DEST[63:48] := TEMP3[15:0]; 
DEST[79:64] := TEMP4[15:0]; 
DEST[95:80] := TEMP5[15:0]; 
DEST[111:96] := TEMP6[1 5:0); 
DEST[127:112] := TEMP7[15:0}; 
DEST[MAXVL-1:256] := 0 
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VPMULLW (VEX.128 encoded version) 
Temp0[31:0] := SRC1[15:0] * SRC2[15:0] 
Temp1[31:0] := SRC1[31:16] * SRC2[31:16] 
Temp2[31:0] := SRC1[47:32] * SRC2[47:32] 
Temp3[31:0] := SRC1[63:48] * SRC2[63:48] 
Temp4[31:0] := SRC1[79:64] * SRC2[79:64] 
Temp5[31:0] := SRC1[95:80] * SRC2[95:80] 
Temp6[31:0] := SRC1[111:96] * SRC2[1 11:96] 
Temp7[31:0] := SRC1[127:112] * SRC2[127:112] 
DEST[15:0] := TempO[15:0] 

DEST[31:16] := Temp1[15:0] 

DEST[47:32] := Temp2[15:0] 

DEST[63:48] := Temp3[15:0] 

DEST[79:64] := Temp4[15:0] 

DEST[95:80] := Temp5[15:0] 

DEST[11 1:96] := Temp6[15:0] 

DEST[127:112] := Temp7[15:0] 
DEST[MAXVL-1:128] := 0 


PMULLW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
temp[31:0] := SRC1[i+15:i] * SRC2[i+15:i] 
DEST[i+1 5:i] = temp[1 5:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPMULLW __m512i_mm512_mullo_epi16(__m512ia,__m512i b); 

VPMULLW __m512i_mm512_mask_mullo_epi16(__m512is,__ mmask32 k,___m512ia,__m512ib); 
VPMULLW __m512i_mm512_maskz_mullo_epi16(__ mmask32 k,__m512i a,__m512ib); 
VPMULLW __m256i__mm256_mask_mullo_epi16(__m256is,__ mmask16 k,___ m256i a,__m256i b); 
VPMULLW __m256i__mm256_maskz_mullo_epi16(___ mmask16 k,__ m256i a, __m256i b); 
VPMULLW __m128i__mm_mask_mullo_epi16(__m128is,__ mmask8 k,___m128i a, __m128i b); 
VPMULLW __m128i__mm_maskz_mullo_epi16(__mmask8 k, __m128i a,__m128i b); 

PMULLW: __m64 _mm_mullo_pi16(__m64 m1,__m64 m2) 


(V)PMULLW: __m128i__mm_mullo_epi16 (__m128i a, ___m128i b) 
VPMULLW:__m256i__mm256_mullo_epi16 (__m256i a, ___m256i b); 
Flags Affected 

None. 
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SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF F4 /r' A VIV SSE2 Multiply unsigned doubleword integer in mm7 by 

PMULUDQ mm1, mm2/m64 unsigned doubleword integer in mm2/m64, and 
store the quadword result in mm17. 

66 OF F4 /r A VIV SSE2 Multiply packed unsigned doubleword integers in 

PMULUDQ xmm1, xmm2/m128 xmm1 by packed unsigned doubleword integers 
in xmm2/m1 28, and store the quadword results 
in xmm1. 

VEX.128.66.0F.WIG F4 /r B VIV AVX Multiply packed unsigned doubleword integers in 

VPMULUDQ xmm1, xmm2, xmm3/m128 xmm_e by packed unsigned doubleword integers 
in xmm3/m1 28, and store the quadword results 
in xmm1. 

VEX.256.66.0F.WIG F4 /r B VIV AVX2 Multiply packed unsigned doubleword integers in 

VPMULUDQ ymm1, ymm2, ymm3/m256 ymm_e by packed unsigned doubleword integers 
in ymm3/m256, and store the quadword results 
in ymm1. 

EVEX.128.66.0F.W1 F4 /r Cc VIV AVX512VL_ | Multiply packed unsigned doubleword integers in 

VPMULUDQ xmm1 {k1}{z}, xmm2, AVX512F xmme2 by packed unsigned doubleword integers 

xmm3/m128/m64bcst in xmm3/m128/m64bcst, and store the 
quadword results in xmm1 under writemask k1. 

EVEX.256.66.0F.W1 F4 /r @ VIV AVX512VL_ | Multiply packed unsigned doubleword integers in 

VPMULUDQ ymm1 {k1}{z}, ymm2, AVX512F ymm_e by packed unsigned doubleword integers 

ymm3/m256/m64bcst in ymm3/m256/m64bcst, and store the 
quadword results in ymm1 under writemask k1. 

EVEX.512.66.0F.W1 F4 /r @ VIV AVX512F Multiply packed unsigned doubleword integers in 


VPMULUDQ zmm1 {k1}{z}, zmm2, 
zmm3/m512/m64bcst 


zmme by packed unsigned doubleword integers 
in zmm3/m512/m64bcst, and store the 
quadword results in zmm1 under writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 


Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the first operand (destination operand) by the second operand (source operand) and stores the result in 
the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The source operand can be an unsigned doubleword integer stored in the low 
doubleword of an MMX technology register or a 64-bit memory location. The destination operand can be an 
unsigned doubleword integer stored in the low doubleword an MMX technology register. The result is an unsigned 
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quadword integer stored in the destination an MMX technology register. When a quadword result is too large to be 
represented in 64 bits (overflow), the result is wrapped around and the low 64 bits are written to the destination 
element (that is, the carry is ignored). 


For 64-bit memory operands, 64 bits are fetched from memory, but only the low doubleword is used in the compu- 
tation. 


128-bit Legacy SSE version: The second source operand is two packed unsigned doubleword integers stored in the 
first (low) and third doublewords of an XMM register or a 128-bit memory location. For 128-bit memory operands, 
128 bits are fetched from memory, but only the first and third doublewords are used in the computation. The first 
source operand is two packed unsigned doubleword integers stored in the first and third doublewords of an XMM 
register. The destination contains two packed unsigned quadword integers stored in an XMM register. Bits (MAXVL- 
1:128) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: The second source operand is two packed unsigned doubleword integers stored in the 
first (low) and third doublewords of an XMM register or a 128-bit memory location. For 128-bit memory operands, 
128 bits are fetched from memory, but only the first and third doublewords are used in the computation. The first 
source operand is two packed unsigned doubleword integers stored in the first and third doublewords of an XMM 
register. The destination contains two packed unsigned quadword integers stored in an XMM register. Bits (MAXVL- 
1:128) of the destination YMM register are zeroed. 

VEX.256 encoded version: The second source operand is four packed unsigned doubleword integers stored in the 
first (low), third, fifth and seventh doublewords of a YMM register or a 256-bit memory location. For 256-bit 
memory operands, 256 bits are fetched from memory, but only the first, third, fifth and seventh doublewords are 
used in the computation. The first source operand is four packed unsigned doubleword integers stored in the first, 
third, fifth and seventh doublewords of an YMM register. The destination contains four packed unaligned quadword 
integers stored in an YMM register. 

EVEX encoded version: The input unsigned doubleword integers are taken from the even-numbered elements of 
the source operands. The first source operand is a ZMM/YMM/XMM registers. The second source operand can be an 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. The destination is a ZMM/YMM/XMM register, and updated according to the writemask at 64- 
bit granularity. 


Operation 


PMULUDQ (with 64-Bit operands) 
DEST[63:0] := DEST[31:0] * SRC[31:0]; 


PMULUDQ (with 128-Bit operands) 
DEST[63:0] := DEST[31:0] * SRC[31:0]; 
DEST[127:64] := DEST[95:64] * SRC[95:64]; 


VPMULUDQ (VEX.128 encoded version) 
DEST[63:0] := SRC1[31:0] * SRC2[31:0] 
DEST[127:64] := SRC1[95:64] * SRC2[95:64] 
DEST[MAXVL-1:128] := 0 


VPMULUDQ (VEX.256 encoded version) 
DEST[63:0] := SRC1[31:0] * SRC2[31:0] 
DEST[127:64] := SRC1[95:64] * SRC2[95:64 
DEST[191:128] := SRC1[159:128] * SRC2[159:128] 
DEST[255:192] := SRC1[223:192] * SRC2[223:192] 
DEST[MAXVL-1:256] := 0 
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VPMULUDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] = ZeroExtend64( SRC1[i+31:i]) * ZeroExtend64( SRC2[31:0] ) 
ELSE DEST[i+63:i] := ZeroExtend64( SRC1[i+31:i]) * ZeroExtend64( SRC2[i+31:i] ) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VPMULUDQ __m512i__mm512_mul_epu32(__m512i a, ___m512i b); 


VPMULUDQ __m512i__mm512_mask_mul_epu32(__m512i s, __mmask8 k, __m512i a, ___m512i b); 
VPMULUDQ __m512i __mm512_maskz_mul_epu32(__mmask8 k, __m512i a,__m512i b); 
VPMULUDQ __m256i _mm256_mask_mul_epu32(__m256i s, __mmask8 k, __m256i a, __m256i b); 


VPMULUDQ __m256i _mm256_maskz_mul_epu32(__mmask8 k, __m256i a, __m256i b); 
VPMULUDQ __m128i _mm_mask_mul_epu32(__m128i s,___mmask8 k, __m128i a, __m128i b); 


VPMULUDQ __m128i _mm_maskz_mul_epu32(__mmask8 k, __m128i a, __m128i b); 
PMULUDQ:__m64 _mm_mul_su32 (__m64 a, ___m64 b) 
(V)PMULUDQ:__m128i __mm_mul_epu32 (__m128i a, __m128i b) 


VPMULUDQ:__m256i__mm256_mul_epu32(__m256i a, __m256i b); 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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POP—Pop a Value from the Stack 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
8F /0 POP r/m16 M Valid Valid Pop top of stack into m16; increment stack 
pointer. 
8F /0 POP r/m32 M N.E. Valid Pop top of stack into m32, increment stack 
pointer. 
8F /0 POP r/m64 M Valid N.E. Pop top of stack into m64; increment stack 
pointer. Cannot encode 32-bit operand size. 
58+ rw POP r16 O Valid Valid Pop top of stack into r76; increment stack 
pointer. 
58+ rd POP r32 0 N.E. Valid Pop top of stack into r32; increment stack 
pointer. 
58+ rd POP r64 O Valid N.E. Pop top of stack into r64; increment stack 
pointer. Cannot encode 32-bit operand size. 
1F POP DS ZO | Invalid Valid Pop top of stack into DS; increment stack 
pointer. 
07 POP ES ZO | Invalid Valid Pop top of stack into ES; increment stack 
pointer. 
17 POP SS ZO | Invalid Valid Pop top of stack into SS; increment stack 
pointer. 
OF Al POP FS ZO | Valid Valid Pop top of stack into FS; increment stack 
pointer by 16 bits. 
OF Al POP FS ZO |N.E. Valid Pop top of stack into FS; increment stack 
pointer by 32 bits. 
OF Al POP FS ZO ‘| Valid N.E. Pop top of stack into FS; increment stack 
pointer by 64 bits. 
OF AQ POP GS ZO | Valid Valid Pop top of stack into GS; increment stack 
pointer by 16 bits. 
OF AQ POP GS ZO |N.E. Valid Pop top of stack into GS; increment stack 
pointer by 32 bits. 
OF AQ POP GS ZO | Valid N.E. Pop top of stack into GS; increment stack 
pointer by 64 bits. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
O opcode + rd (w) NA NA NA 
ZO NA NA NA NA 
Description 


Loads the value from the top of the stack to the location specified with the destination operand (or explicit opcode) 
and then increments the stack pointer. The destination operand can be a general-purpose register, memory loca- 
tion, or segment register. 


Address and operand sizes are determined and used as follows: 


e Address size. The D flag in the current code-segment descriptor determines the default address size; it may be 
overridden by an instruction prefix (67H). 
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The address size is used only when writing to a destination operand in memory. 


° Operand size. The D flag in the current code-segment descriptor determines the default operand size; it may 
be overridden by instruction prefixes (66H or REX.W). 


The operand size (16, 32, or 64 bits) determines the amount by which the stack pointer is incremented (2, 4 
or 8). 

¢ Stack-address size. Outside of 64-bit mode, the B flag in the current stack-segment descriptor determines the 
size of the stack pointer (16 or 32 bits); in 64-bit mode, the size of the stack pointer is always 64 bits. 


The stack-address size determines the width of the stack pointer when reading from the stack in memory and 
when incrementing the stack pointer. (As stated above, the amount by which the stack pointer is incremented 
is determined by the operand size.) 


If the destination operand is one of the segment registers DS, ES, FS, GS, or SS, the value loaded into the register 
must be a valid segment selector. In protected mode, popping a segment selector into a segment register automat- 
ically causes the descriptor information associated with that segment selector to be loaded into the hidden 
(shadow) part of the segment register and causes the selector and the descriptor information to be validated (see 
the “Operation” section below). 


A NULL value (0000-0003) may be popped into the DS, ES, FS, or GS register without causing a general protection 
fault. However, any subsequent attempt to reference a segment whose corresponding segment register is loaded 
with a NULL value causes a general protection exception (#GP). In this situation, no memory reference occurs and 
the saved value of the segment register is NULL. 


The POP instruction cannot pop a value into the CS register. To load the CS register from the stack, use the RET 
instruction. 


If the ESP register is used as a base register for addressing a destination operand in memory, the POP instruction 
computes the effective address of the operand after it increments the ESP register. For the case of a 16-bit stack 

where ESP wraps to OH as a result of the POP instruction, the resulting location of the memory write is processor- 
family-specific. 


The POP ESP instruction increments the stack pointer (ESP) before data at the old top of stack is written into the 
destination. 


Loading the SS register with a POP instruction suppresses or inhibits some debug exceptions and inhibits interrupts 
on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of the 
next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruction 
(POP ESP) before an event can be delivered. See Section 6.8.3, “Masking Exceptions and Interrupts When 
Switching Stacks,” in Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. Intel recom- 
mends that software use the LSS instruction to load the SS register and ESP together. 


In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). When in 
64-bit mode, POPs using 32-bit operands are not encodable and POPs to DS, ES, SS are not valid. See the 
summary chart at the beginning of this section for encoding data and limits. 


Operation 
IF StackAddrSize = 32 
THEN 
IF OperandSize = 32 
THEN 
DEST := SS:ESP; (* Copy a doubleword *) 
ESP := ESP + 4; 


ELSE (* OperandSize = 16*) 
DEST := SS:ESP; (* Copy a word *) 
ESP := ESP + 2; 


Fl; 
ELSE IF StackAddrSize = 64 
THEN 
IF OperandSize = 64 
THEN 


POP—Pop a Value from the Stack Vol.2B 4-399 


INSTRUCTION SET REFERENCE, M-U 


DEST := SS:RSP; (* Copy quadword *) 
RSP := RSP + 8; 

ELSE (* OperandSize = 16*) 
DEST := SS:RSP; (* Copy a word *) 


RSP := RSP + 2; 
FI; 
FI; 
ELSE StackAddrSize = 16 
THEN 
IF OperandSize = 16 
THEN 
DEST := SS:SP; (* Copy a word *) 
SP := SP + 2; 
ELSE (* OperandSize = 32 *) 
DEST := SS:SP; (* Copy a doubleword *) 
SP := SP + 4; 
FI; 


Fl; 


Loading a segment register while in protected mode results in special actions, as described in the following listing. 
These checks are performed on the segment selector and the segment descriptor it points to. 


64-BIT_MODE 
IF FS, or GS is loaded with non-NULL selector; 
THEN 
IF segment selector index is outside descriptor table limits 
OR segment is not a data or readable code segment 
OR ((segment is a data or nonconforming code segment) 
AND ((RPL > DPL) or (CPL > DPL)) 
THEN #GP(selector); 
IF segment not marked present 
THEN #NP(selector); 
ELSE 
SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; 


Fl; 
Fl; 
IF FS, or GS is loaded with a NULL selector; 
THEN 
SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; 
Fl; 


PREOTECTED MODE OR COMPATIBILITY MODE; 


IF SS is loaded; 
THEN 
IF segment selector is NULL 
THEN #GP(0); 
Fl; 
IF segment selector index is outside descriptor table limits 
or segment selector’s RPL # CPL 
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or segment is not a writable data segment 


or DPL# CPL 
THEN #GP(selector); 
Fl; 
IF segment not marked present 
THEN #SS(selector); 
ELSE 


Fl; 
Fl; 


SS := segment selector; 
SS := segment descriptor; 


IF DS, ES, FS, or GS is loaded with non-NULL selector; 


THEN 


IF segment selector index is outside descriptor table limits 
or segment is not a data or readable code segment 
or ((segment is a data or nonconforming code segment) 
and ((RPL > DPL) or (CPL > DPL)) 


THEN #GP(selector); 
Fl; 
IF segment not marked present 
THEN #NP(selector); 
ELSE 


Fl; 
Fl; 


SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; 


IF DS, ES, FS, or GS is loaded with a NULL selector 


THEN 


SegmentRegister := segment selector; 
SegmentRegister := segment descriptor; 


Fl; 


Flags Affected 


None. 


Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


If attempt is made to load SS register with NULL segment selector. 
If the destination operand is in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If segment selector index is outside descriptor table limits. 

If the SS register is being loaded and the segment selector's RPL and the segment descriptor’s 
DPL are not equal to the CPL. 

If the SS register is being loaded and the segment pointed to is a 

non-writable data segment. 

If the DS, ES, FS, or GS register is being loaded and the segment pointed to is not a data or 
readable code segment. 

If the DS, ES, FS, or GS register is being loaded and the segment pointed to is a data or 
nonconforming code segment, but both the RPL and the CPL are greater than the DPL. 
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#SS(0) 


#SS(selector) 
#NP 


#PF(fault-code) 
#AC(0) 


#UD 


If the current top of stack is not within the stack segment. 
If a memory operand effective address is outside the SS segment limit. 
If the SS register is being loaded and the segment pointed to is marked not present. 


If the DS, ES, FS, or GS register is being loaded and the segment pointed to is marked not 
present. 


If a page fault occurs. 


If an unaligned memory reference is made while the current privilege level is 3 and alignment 
checking is enabled. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 
#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 
#PF(fault-code) 
#AC(0) 

#UD 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a page fault occurs. 

If an unaligned memory reference is made while alignment checking is enabled. 

If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 


#GP(0) 
#SS(0) 
#GP(selector) 


#AC(0) 
#PF(fault-code) 
#NP 

#UD 
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If the memory address is in a non-canonical form. 
If the stack address is in a non-canonical form. 
If the descriptor is outside the descriptor table limit. 


If the FS or GS register is being loaded and the segment pointed to is not a data or readable 
code segment. 


If the FS or GS register is being loaded and the segment pointed to is a data or nonconforming 
code segment, but both the RPL and the CPL are greater than the DPL. 


If an unaligned memory reference is made while alignment checking is enabled. 

If a page fault occurs. 

If the FS or GS register is being loaded and the segment pointed to is marked not present. 
If the LOCK prefix is used. 

If the DS, ES, or SS register is being loaded. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
61 POPA ZO | Invalid Valid Pop DI, SI, BP, BX, DX, CX, and AX. 
61 POPAD ZO | Invalid Valid Pop EDI, ESI, EBP, EBX, EDX, ECX, and EAX. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Pops doublewords (POPAD) or words (POPA) from the stack into the general-purpose registers. The registers are 
loaded in the following order: EDI, ESI, EBP, EBX, EDX, ECX, and EAX (if the operand-size attribute is 32) and DI, 
SI, BP, BX, DX, CX, and AX (if the operand-size attribute is 16). (These instructions reverse the operation of the 
PUSHA/PUSHAD instructions.) The value on the stack for the ESP or SP register is ignored. Instead, the ESP or SP 
register is incremented after each register is loaded. 


The POPA (pop all) and POPAD (pop all double) mnemonics reference the same opcode. The POPA instruction is 
intended for use when the operand-size attribute is 16 and the POPAD instruction for when the operand-size attri- 
bute is 32. Some assemblers may force the operand size to 16 when POPA is used and to 32 when POPAD is used 
(using the operand-size override prefix [66H] if necessary). Others may treat these mnemonics as synonyms 
(POPA/POPAD) and use the current setting of the operand-size attribute to determine the size of values to be 
popped from the stack, regardless of the mnemonic used. (The D flag in the current code segment’s segment 
descriptor determines the operand-size attribute. ) 


This instruction executes as described in non-64-bit modes. It is not valid in 64-bit mode. 


Operation 


IF 64-Bit Mode 
THEN 
#UD; 
ELSE 
IF OperandSize = 32 (* Instruction = POPAD *) 
THEN 
EDI := Pop(); 
ESI := Pop(); 
EBP := Pop(); 
Increment ESP by 4; (* Skip next 4 bytes of stack *) 
EBX := Pop(); 
EDX := Pop(); 
ECX := Pop(); 
EAX := Pop(); 
ELSE (* OperandSize = 16, instruction = POPA *) 
DI := Pop(); 
SI := Pop(); 
BP := Pop(); 
Increment ESP by 2; (* Skip next 2 bytes of stack *) 


Fl; 
Fl; 
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Flags Affected 
None. 


Protected Mode Exceptions 


#SS(0) If the starting or ending stack address is not within the stack segment. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while the current privilege level is 3 and alignment 
checking is enabled. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#SS If the starting or ending stack address is not within the stack segment. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#SS(0) If the starting or ending stack address is not within the stack segment. 
#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
F3 OF B8 /r POPCNT 176, r/m16 RM _ | Valid Valid POPCNT on r/m16 
F3 OF B8 /r POPCNT 132, r/m32 RM_ | Valid Valid POPCNT on r/m32 
F3 REX.W OF B8 /r POPCNT 164, r/m64 RM_ | Valid N.E. POPCNT on r/m64 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction calculates the number of bits set to 1 in the second operand (source) and returns the count in the 
first operand (a destination register). 


Operation 


Count = 0; 

For (i=0; i < OperandSize; i++) 

{ IF (SRC[ i] = 1) //i’th bit 
THEN Count++; Fl; 


} 
DEST := Count; 


Flags Affected 
OF, SF, ZF, AF, CF, PF are all cleared. ZF is set if SRC = 0, otherwise ZF is cleared. 


Intel C/C++ Compiler Intrinsic Equivalent 
POPCNT: 
POPCNT: 


int __mm_popcnt_u32(unsigned int a); 


int64_t __mm_popcnt_u64(unsigned __int64 a); 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS or GS segments. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF (fault-code) For a page fault. 

#AC(0) If an unaligned memory reference is made while the current privilege level is 3 and alignment 
checking is enabled. 

#UD If CPUID.01H:ECX.POPCNT [Bit 23] = 0. 


If LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#UD If CPUID.01H:ECX.POPCNT [Bit 23] = 0. 


If LOCK prefix is used. 
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Virtual 8086 Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF (fault-code) For a page fault. 

#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 

#UD If CPUID.O1H:ECX.POPCNT [Bit 23] = 0. 


If LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in Protected Mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If CPUID.01H:ECX.POPCNT [Bit 23] = 0. 


If LOCK prefix is used. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
9D POPF ZO | Valid Valid Pop top of stack into lower 16 bits of EFLAGS. 
9D POPFD ZO |NE. Valid Pop top of stack into EFLAGS. 
9D POPFQ ZO ‘| Valid N.E. Pop top of stack and zero-extend into RFLAGS. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Pops a doubleword (POPFD) from the top of the stack (if the current operand-size attribute is 32) and stores the 
value in the EFLAGS register, or pops a word from the top of the stack (if the operand-size attribute is 16) and 
stores it in the lower 16 bits of the EFLAGS register (that is, the FLAGS register). These instructions reverse the 
operation of the PUSHF/PUSHFD/PUSHFQ instructions. 


The POPF (pop flags) and POPFD (pop flags double) mnemonics reference the same opcode. The POPF instruction 
is intended for use when the operand-size attribute is 16; the POPFD instruction is intended for use when the 
operand-size attribute is 32. Some assemblers may force the operand size to 16 for POPF and to 32 for POPFD. 
Others may treat the mnemonics as synonyms (POPF/POPFD) and use the setting of the operand-size attribute to 
determine the size of values to pop from the stack. 


The effect of POPF/POPFD on the EFLAGS register changes, depending on the mode of operation. See Table 4-21 
and the key below for details. 


When operating in protected, compatibility, or 64-bit mode at privilege level 0 (or in real-address mode, the equiv- 
alent to privilege level 0), all non-reserved flags in the EFLAGS register except RF‘, VIP, VIF, and VM may be modi- 
fied. VIP, VIF and VM remain unaffected. 


When operating in protected, compatibility, or 64-bit mode with a privilege level greater than 0, but less than or 

equal to IOPL, all flags can be modified except the IOPL field and RF, IF, VIP, VIF, and VM; these remain unaffected. 
The AC and ID flags can only be modified if the operand-size attribute is 32. The interrupt flag (IF) is altered only 
when executing at a level at least as privileged as the IOPL. If a POPF/POPFD instruction is executed with insuffi- 
cient privilege, an exception does not occur but privileged bits do not change. 


When operating in virtual-8086 mode (EFLAGS.VM = 1) without the virtual-8086 mode extensions (CR4.VME = 0), 
the POPF/POPFD instructions can be used only if IOPL = 3; otherwise, a general-protection exception (#GP) 
occurs. If the virtual-8086 mode extensions are enabled (CR4.VME = 1), POPF (but not POPFD) can be executed in 
virtual-8086 mode with IOPL < 3. 


(The protected-mode virtual-interrupt feature — enabled by setting CR4.PVI — affects the CLI and STI instructions 
in the same manner as the virtual-8086 mode extensions. POPF, however, is not affected by CR4.PVI.) 


In 64-bit mode, the mnemonic assigned is POPFQ (note that the 32-bit operand is not encodable). POPFQ pops 64 
bits from the stack. Reserved bits of RFLAGS (including the upper 32 bits of RFLAGS) are not affected. 


See Chapter 3 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for more informa- 
tion about the EFLAGS registers. 


1. RF is always zero after the execution of POPF. This is because POPF, like all instructions, clears RF as it begins to execute. 
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Table 4-21. Effect of POPF/POPFD on the EFLAGS Register 


Flags 
Mode ie cpt opt | 21 | 20] 19 | 18| 17116|14]1312/11/10)91/8]7|/61|4) 2] 0 | Notes 
ID | vip | vie | AC | VM | RE | NT | IOPL | OF | DF IF | TE | SF| ZF | AF | PF | CF 
Real-Address 16 0 |/03/N)N/)NINI/I NI] O S 
Mode 
(CRO.PE = 0) 32 o0/o03/S)/N/N] S/N] 0/5 S sis isisilsisisislis 
16 0 1/03/N)/N/NIN/IN]I OJ] S S sisilsilsisisisIisls 
Protected, 
Compatibility, 16 13) <cPL| N|/ N/|NININ] OJ] S N s|s Mes isisisis|s 
sa ni 16 1-3.}2CPL| N| N|NI|NI/|N1]0O/]S N sisilsilsislisisisl¢s 
odes 
32.64 | 0/03/S|/nN]/N/S]N] 0] 5 S Sisisisilsisislisls 
(CRO.PE = 1 32,64 | 1-3)<cPL) S| N/N/]S/N/O/S N 5s |S BNM Sis isisi|s is 
EFLAGS.VM = 0) 
32,64 | 1-3 /2cPL| S| N| NI] S|NI]O]S N sisisisilsisisisles 
16 3 | om | x | x I xc | oe | oe | oe oe | oes se Il oe I oe | oe | se Se |) oe | ae I x 1 
Virtual-8086 
(CRO.PE = 1 16 3 3 |NIN]INININ] OJ} S N Sisisisilsisis|islisg 
EFLAGS.VM = 1 32 3 | oe | x | x | xl xl «i xl Xx xe ll 5c |) Se se | Se Se ll xe oe I 1 
CR4.VME = 0) 
32 3 3 |s|niniS|TNi]O]S N sisisIilslsisislslgs 
16 3/02 }nN | N/]swi ne] ne f}or] sc | nx | sr} sei} nei sr} se] se) se} sv) sp] 28 
VME x}|x}x}x}x|x]x x |x ial x |x |x | x | x | x 
(CRO.PE = 1 16 3 3 |NI|N]I|NININ] OO] S sisilslsislslislsls 
EFLAGS.VM = 1 ; 
CR4.VME = 1) 32 3 | om | x | x | xe | xe] se ee | Oe OL se |) oe I oe |e | oe 8 |) oe | oe | x 
32 3 3 |}s|n{i|NIS|NI]O]S N sisisilslslisilslisl¢g 
NOTES: 


1. #GP fault - no flag update 
2. #GP fault with no flag update if VIP=1 in EFLAGS register and IF=1 in FLAGS value on stack 
3. #GP fault with no flag update if TF=1 in FLAGS value on stack 


Key 
Ss Updated from stack 
SV Updated from IF (bit 9) in FLAGS value on stack 
N No change in value 
No EFLAGS update 
0 Value is cleared 
Operation 
IF EFLAGS.VM = 0 (* Not in Virtual-8086 Mode *) 
THEN IF CPL = 0 OR CRO.PE = 0 
THEN 


IF OperandSize = 32; 
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THEN 
EFLAGS := Pop(); (* 32-bit pop *) 


(* All non-reserved flags except RF, VIP, VIF, and VM can be modified; 
VIP, VIF, VM, and all reserved bits are unaffected. RF is cleared. *) 


ELSE IF (Operandsize = 64) 
RFLAGS = Pop(); (* 64-bit pop *) 


(* All non-reserved flags except RF, VIP, VIF, and VM can be modified; 
VIP, VIF, VM, and all reserved bits are unaffected. RF is cleared. *) 
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ELSE (* OperandSize = 16 *) 
EFLAGS[1 5:0] := Pop(); (* 16-bit pop *) 
(* All non-reserved flags can be modified. *) 


FI; 
ELSE (* CPL >0 *) 
IF OperandSize = 32 
THEN 
IF CPL > IOPL 
THEN 
EFLAGS := Pop(); (* 32-bit pop *) 
(* All non-reserved bits except IF, IOPL, VIP, VIF, VM and RF can be modified; 
IF, IOPL, VIP, VIF, VM and all reserved bits are unaffected; RF is cleared. *) 
ELSE 
EFLAGS := Pop(); (* 32-bit pop *) 
(* All non-reserved bits except IOPL, VIP, VIF, VM and RF can be modified; 
IOPL, VIP, VIF, VM and all reserved bits are unaffected; RF is cleared. *) 
Fl; 
ELSE IF (Operandsize = 64) 
IF CPL > IOPL 
THEN 
RFLAGS := Pop(); (* 64-bit pop *) 
(* All non-reserved bits except IF, IOPL, VIP, VIF, VM and RF can be modified; 
IF, IOPL, VIP, VIF, VM and all reserved bits are unaffected; RF is cleared. *) 
ELSE 
RFLAGS := Pop(); (* 64-bit pop *) 
(* All non-reserved bits except IOPL, VIP, VIF, VM and RF can be modified; 
IOPL, VIP, VIF, VM and all reserved bits are unaffected; RF is cleared. *) 
Fl; 
ELSE (* OperandSize = 16 *) 
EFLAGS[15:0] := Pop(); (* 16-bit pop *) 
(* All non-reserved bits except IOPL can be modified; IOPL and all 
reserved bits are unaffected. *) 
Fl; 
Fl; 
ELSE (* In virtual-8086 mode *) 
IF IOPL = 3 
THEN 
IF OperandSize = 32 
THEN 


EFLAGS := Pop(); 
(* All non-reserved bits except IOPL, VIP, VIF, VM, and RF can be modified; 
VIP, VIF, VM, IOPL and all reserved bits are unaffected. RF is cleared. *) 
ELSE 
EFLAGS[15:0] := Pop(); FI; 
(* All non-reserved bits except IOPL can be modified; IOPL and all reserved bits are unaffected. *) 
Fl; 
ELSE (* IOPL < 3 *) 
IF (Operandsize = 32) OR (CR4.VME = 0) 
THEN #GP(0); (* Trap to virtual-8086 monitor. *) 
ELSE (* Operandsize = 16 and CR4.VME = 1 *) 
tempFLAGS := Pop(); 
IF (EFLAGS.VIP = 1 AND tempFLAGS[9] = 1) OR tempFLAGS[8] = 1 
THEN #GP(0); 
ELSE 
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EFLAGS.VIF := tempFLAGS[9]; 

EFLAGS[15:0] := tempFLAGS; 

(* All non-reserved bits except IOPL and IF can be modified; 
IOPL, IF, and all reserved bits are unaffected. *) 

FI; 
FI; 
Fl; 
FI; 


Flags Affected 


All flags may be affected; see the Operation section for details. 


Protected Mode Exceptions 


#SS(0) If the top of stack is not within the stack segment. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while CPL = 3 and alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#SS If the top of stack is not within the stack segment. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) If IOPL < 3 and VME is not enabled. 
If IOPL < 3 and the 32-bit operand size is used. 
If IOPL < 3, EFLAGS.VIP = 1, and bit 9 (IF) is set in the FLAGS value on the stack. 
If IOPL < 3 and bit 8 (TF) is set in the FLAGS value on the stack. 
If an attempt is made to execute the POPF/POPFD instruction with an operand-size override 


prefix. 
#SS(0) If the top of stack is not within the stack segment. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same as for protected mode exceptions. 


64-Bit Mode Exceptions 


#SS(0) If the stack address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF €B /r' A VIN MMX Bitwise OR of mm/m64 and mm. 

POR mm, mm/m64 

66 OF EB /r A VIN SSE2 Bitwise OR of xmm2/m128 and xmm1. 

POR xmm1, xmm2/m128 

VEX.128.66.0F.WIG EB /r B VIN AVX Bitwise OR of xmm2/m128 and xmm3. 

VPOR xmm1, xmm2, xmm3/m128 

VEX.256.66.0F.WIG EB /r B VN AVX2 Bitwise OR of ynm2/m256 and ymm3. 

VPOR ymm1, ymm2, ymm3/m256 

EVEX.128.66.0F.WO EB /r C VIV AVX512VL | Bitwise OR of packed doubleword integers in 

VPORD xmm1 {k1}{z}, xmm2, xmm3/m128/m32bcst AVX512F | xmm2 and xmm3/m128/m32bcst using 
writemask k1. 

EVEX.256.66.0F.WO EB /r C VIV AVX512VL | Bitwise OR of packed doubleword integers in 

VPORD ymm1 {k1}{z}, ymm2, ymm3/m256/m32bcst AVX512F | ymm2 and ymm3/m256/m32bcst using 
writemask k1. 

EVEX.512.66.0F.WO EB /r C VIV AVX512F | Bitwise OR of packed doubleword integers in 

VPORD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst zmme2 and zmm3/m512/m32bcst using 
writemask k1. 

EVEX.128.66.0F.W1 EB /r C VIV AVX512VL | Bitwise OR of packed quadword integers in 

VPORQ xmm1 {k1}{z}, xmm2, xmm3/m128/m64bcst AVX512F | xmm2 and xmm3/m128/m64bcst using 
writemask k1. 

EVEX.256.66.0F.W1 EB /r C VIV AVX512VL | Bitwise OR of packed quadword integers in 

VPORQ ymm1 {k1}{Z}, ymm2, ymm3/m256/m64bcst AVX512F | ymm2 and ymm3/m256/m64bcst using 
writemask k1. 

EVEX.512.66.0F.W1 EB /r C VIV AVX512F | Bitwise OR of packed quadword integers in 

VPORQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst zmme2 and zmm3/m512/m64bcst using 
writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical OR operation on the source operand (second operand) and the destination operand (first 
operand) and stores the result in the destination operand. Each bit of the result is set to 1 if either or both of the 
corresponding bits of the first and second operands are 1; otherwise, it is set to 0. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


POR—Bitwise Logical OR 


Vol.2B 4-411 
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Legacy SSE version: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand is an MMX technology register. 


128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 
source and destination operands can be XMM registers. Bits (MAXVL-1:128) of the corresponding YMM destination 
register remain unchanged. 

VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 
source and destination operands can be XMM registers. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 

VEX.256 encoded version: The second source operand is an YMM register or a 256-bit memory location. The first 
source and destination operands can be YMM registers. 

EVEX encoded version: The first source operand is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 
writemask ki at 32/64-bit granularity. 


Operation 


POR (64-bit operand) 
DEST := DEST OR SRC 


POR (128-bit Legacy SSE version) 
DEST := DEST OR SRC 
DEST[MAXVL-1:128] (Unmodified) 


VPOR (VEX.128 encoded version) 
DEST := SRC1 OR SRC2 
DEST[MAXVL-1:128] := 0 


VPOR (VEX.256 encoded version) 
DEST := SRC1 OR SRC2 
DEST[MAXVL-1:256] := 0 


VPORD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] = SRC1[i+31:i] BITWISE OR SRC2[31:0] 
ELSE DEST[i+31:i] := SRC1[i+31:i] BITWISE OR SRC2[i+31:i] 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
*DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 

VPORD __m512i_mm512_or_epi32(__m512ia,__m512i b); 

VPORD __m512i_mm512_mask_or_epi32(__m512is,__mmask16 k,_m512i a, 
VPORD __m512i_mm512_maskz_or_epi32(__mmask16 k,___m512i a, __m512i b); 

VPORD __m256i __mm256_or_epi32(__m256i a, ___m256i b); 

VPORD __m256i__mm256_mask_or_epi32(__m256is, _mmask8 k,__ m256i a,__ m256i b,); 
VPORD __m256i__mm256_maskz_or_epi32(__mmask8 k,___ m256i a, ___ m256i b); 

VPORD __m128i_mm_or_epi32(__m128i a,__m128i b); 
VPORD __m128i __mm_mask_or_epi32(__m128is,___ mmask8 k, 
VPORD __m128i __mm_maskz_or_epi32(__mmask8 k,___m128i a,__m128i b); 

VPORQ __m512i_mm512_or_epi64(__m512i a, ___m512i b); 

VPORQ __m512i_mm512_mask_or_epi64(__m512is,___ mmask8 k,__m512i a, ___m512i b); 
VPORQ __m512i_mm512_maskz_or_epi64(__mmask8 k, __m512i a, ___m512i b); 

VPORQ __m256i _mm256_or_epi64(__m256i a, int imm); 

VPORQ __m256i __mm256_mask_or_epi64(__m256i s,___mmask8 k, 
VPORQ __m256i _mm256_maskz_or_epi64(__mmask8 k,___m256i a, 
VPORQ __m128i__mm_or_epi64(__m128i a, __m128i b); 

VPORQ __m128i _mm_mask_or_epi64(__m128i s, __mmask8 k, __m128i a, __m128i b); 
VPORQ __m128i __mm_maskz_or_epi64(__mmask8 k, __m128i a, ___m128i b); 

POR __m64_mm_or_si64(__m64 m1,__m64 m2) 

(V)POR: __m128i __mm_or_si128(__m128i m1,_m128i m2) 

VPOR: m256i_mm256_or_si256 (__m25Gi a,__m256i b) 


m512i b); 


m128i a,__m128ib); 


m256i a, 
m256i b); 


m256i b); 


Flags Affected 


None. 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PREFETCHh—Prefetch Data Into Caches 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF 18/1 PREFETCHTO m8 M Valid Valid Move data from m8 closer to the processor 
using TO hint. 

OF 18/2 PREFETCHT1 m8 M Valid Valid Move data from m8 closer to the processor 
using T1 hint. 

OF 18/3 PREFETCHT2 m8 M Valid Valid Move data from m8 closer to the processor 
using T2 hint. 

OF 18/0 PREFETCHNTA m8 M Valid Valid Move data from m8 closer to the processor 
using NTA hint. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Fetches the line of data from memory that contains the byte specified with the source operand to a location in the 
cache hierarchy specified by a locality hint: 


¢ TO (temporal data)—prefetch data into all levels of the cache hierarchy. 

¢ T1 (temporal data with respect to first level cache misses)—prefetch data into level 2 cache and higher. 

¢ T2 (temporal data with respect to second level cache misses)—prefetch data into level 3 cache and higher, or 
an implementation-specific choice. 

¢ NTA (non-temporal data with respect to all cache levels)—prefetch data into non-temporal cache structure and 
into a location close to the processor, minimizing cache pollution. 


The source operand is a byte memory location. (The locality hints are encoded into the machine level instruction 
using bits 3 through 5 of the ModR/M byte.) 


If the line selected is already present in the cache hierarchy at a level closer to the processor, no data movement 
occurs. Prefetches from uncacheable or WC memory are ignored. 


The PREFETCHA instruction is merely a hint and does not affect program behavior. If executed, this instruction 
moves data closer to the processor in anticipation of future use. 


The implementation of prefetch locality hints is implementation-dependent, and can be overloaded or ignored by a 
processor implementation. The amount of data prefetched is also processor implementation-dependent. It will, 
however, be a minimum of 32 bytes. Additional details of the implementation-dependent locality hints are 
described in Section 7.4 of Intel® 64 and IA-32 Architectures Optimization Reference Manual. 


It should be noted that processors are free to speculatively fetch and cache data from system memory regions that 
are assigned a memory-type that permits speculative reads (that is, the WB, WC, and WT memory types). A 
PREFETCHA instruction is considered a hint to this speculative behavior. Because this speculative fetching can occur 
at any time and is not tied to instruction execution, a PREFETCHA instruction is not ordered with respect to the 
fence instructions (MFENCE, SFENCE, and LFENCE) or locked memory references. A PREFETCHA instruction is also 
unordered with respect to CLFLUSH and CLFLUSHOPT instructions, other PREFETCHA instructions, or any other 
general instruction. It is ordered with respect to serializing instructions such as CPUID, WRMSR, OUT, and MOV CR. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
FETCH (m8); 
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Intel C/C++ Compiler Intrinsic Equivalent 
void __mm_prefetch(char *p, int i) 


The argument “*p” gives the address of the byte (and corresponding cache line) to be prefetched. The value “i” 
gives a constant (_MM_HINT_TO, _MM_HINT_T1, _MM_HINT_T2, or _MM_HINT_NTA) that specifies the type of 
prefetch operation to be performed. 


Numeric Exceptions 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 
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PREFETCHW—Prefetch Data into Caches in Anticipation of a Write 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support Flag 
OF OD /1 A VIV PREFETCHW | Move data from m8 closer to the processor in anticipation of a 
PREFETCHW m8 write. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Fetches the cache line of data from memory that contains the byte specified with the source operand to a location 
in the 1st or 2nd level cache and invalidates other cached instances of the line. 


The source operand is a byte memory location. If the line selected is already present in the lowest level cache and 
is already in an exclusively owned state, no data movement occurs. Prefetches from non-writeback memory are 
ignored. 


The PREFETCHW instruction is merely a hint and does not affect program behavior. If executed, this instruction 
moves data closer to the processor and invalidates other cached copies in anticipation of the line being written to 
in the future. 


The characteristic of prefetch locality hints is implementation-dependent, and can be overloaded or ignored by a 
processor implementation. The amount of data prefetched is also processor implementation-dependent. It will, 
however, be a minimum of 32 bytes. Additional details of the implementation-dependent locality hints are 
described in Section 7.4 of Intel® 64 and IA-32 Architectures Optimization Reference Manual. 


It should be noted that processors are free to speculatively fetch and cache data with exclusive ownership from 
system memory regions that permit such accesses (that is, the WB memory type). A PREFETCHW instruction is 
considered a hint to this speculative behavior. Because this speculative fetching can occur at any time and is not 
tied to instruction execution, a PREFETCHW instruction is not ordered with respect to the fence instructions 
(MFENCE, SFENCE, and LFENCE) or locked memory references. A PREFETCHW instruction is also unordered with 
respect to CLFLUSH and CLFLUSHOPT instructions, other PREFETCHW instructions, or any other general instruction 


It is ordered with respect to serializing instructions such as CPUID, WRMSR, OUT, and MOV CR. 
This instruction's operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
FETCH_WITH_EXCLUSIVE_OWNERSHIP (m8); 


Flags Affected 
All flags are affected. 


C/C++ Compiler Intrinsic Equivalent 


void _m_prefetchw( void * ); 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
#UD If the LOCK prefix is used. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
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PSADBW—Compute Sum of Absolute Differences 


NOTES: 


Opcode/ Op/ | 64/32 bit | CPUID Feature | Description 
Instruction En |Mode Flag 
Support 
NP OF F6 /r' A VIN SSE Computes the absolute differences of the 
PSADBW mm1, mm2/m64 packed unsigned byte integers from mm2 
/m64 and mm/1; differences are then summed 
to produce an unsigned word integer result. 
66 OF F6 /r A VIN SSE2 Computes the absolute differences of the 
PSADBW xmm1, xmm2/m128 packed unsigned byte integers from xmm2 
/m128 and xmm1; the 8 low differences and 8 
high differences are then summed separately 
to produce two unsigned word integer results. 
VEX.128.66.0F.WIG F6 /r B VIN AVX Computes the absolute differences of the 
VPSADBW xmm1, xmm2, xmm3/m128 packed unsigned byte integers from xmm3 
/m128 and xmm2, the 8 low differences and 8 
high differences are then summed separately 
to produce two unsigned word integer results. 
VEX.256.66.0F.WIG F6 /r B VIN AVX2 Computes the absolute differences of the 
VPSADBW ymm1, ymm2, ymm3/m256 packed unsigned byte integers from ymm3 
/m256 and ymm_2; then each consecutive 8 
differences are summed separately to produce 
four unsigned word integer results. 
EVEX.128.66.0F.WIG F6 /r C VIN AVX512VL Computes the absolute differences of the 
VPSADBW xmm1, xmm2, xmm3/m128 AVX512BW packed unsigned byte integers from xmm3 
/m128 and xmm2; then each consecutive 8 
differences are summed separately to produce 
two unsigned word integer results. 
EVEX.256.66.0F.WIG F6 /r C VIN AVX512VL Computes the absolute differences of the 
VPSADBW ymm1, ymm2, ymm3/m256 AVX512BW packed unsigned byte integers from ymm3 
/m256 and ymmc2; then each consecutive 8 
differences are summed separately to produce 
four unsigned word integer results. 
EVEX.512.66.0F.WIG F6 /r C VN AVX512BW Computes the absolute differences of the 
VPSADBW zmm1, zmm2, zmm3/m512 packed unsigned byte integers from zmm3 
/m512 and zmmd2; then each consecutive 8 
differences are summed separately to produce 
eight unsigned word integer results. 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv ModRM:r/m (r) NA 
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Description 


Computes the absolute value of the difference of 8 unsigned byte integers from the source operand (second 
operand) and from the destination operand (first operand). These 8 differences are then summed to produce an 
unsigned word integer result that is stored in the destination operand. Figure 4-14 shows the operation of the 
PSADBW instruction when using 64-bit operands. 


When operating on 64-bit operands, the word integer result is stored in the low word of the destination operand, 
and the remaining bytes in the destination operand are cleared to all Os. 


When operating on 128-bit operands, two packed results are computed. Here, the 8 low-order bytes of the source 
and destination operands are operated on to produce a word result that is stored in the low word of the destination 
operand, and the 8 high-order bytes are operated on to produce a word result that is stored in bits 64 through 79 
of the destination operand. The remaining bytes of the destination operand are cleared. 


For 256-bit version, the third group of 8 differences are summed to produce an unsigned word in bits[143:128] of 
the destination register and the fourth group of 8 differences are summed to produce an unsigned word in 
bits[207:192] of the destination register. The remaining words of the destination are set to 0. 


For 512-bit version, the fifth group result is stored in bits [271:256] of the destination. The result from the sixth 
group is stored in bits [335:320]. The results for the seventh and eighth group are stored respectively in bits 
[399:384] and bits [463:447], respectively. The remaining bits in the destination are set to 0. 


In 64-bit mode and not encoded by VEX/EVEX prefix, using a REX prefix in the form of REX.R permits this instruc- 
tion to access additional registers (XMM8-XMM15). 


Legacy SSE version: The source operand can be an MMX technology register or a 64-bit memory location. The 
destination operand is an MMX technology register. 


128-bit Legacy SSE version: The first source operand and destination register are XMM registers. The second 
source operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding ZMM 
destination register remain unchanged. 


VEX.128 and EVEX.128 encoded versions: The first source operand and destination register are XMM registers. The 
second source operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding 
ZMM register are zeroed. 


VEX.256 and EVEX.256 encoded versions: The first source operand and destination register are YMM registers. The 
second source operand is an YMM register or a 256-bit memory location. Bits (MAXVL-1:256) of the corresponding 
ZMM register are zeroed. 


EVEX.512 encoded version: The first source operand and destination register are ZMM registers. The second 
source operand is a ZMM register or a 512-bit memory location. 


SRC X7 X6 X5 x4 | X3 X2 x1 X0 


DEST; y7 Y6 Y5 Y4 Y3 Y2 v1 YO 


TEMP | ABS(x7:Y7)| ABS(X6:Y6)| ABS(X5:Y5) | ABS(X4:Y4)] ABS(X3:Y3)| ABS(X2:Y2) | ABS(X1:Y1) | ABS(X0:Y0) 


DEST) 00H 00H 00H 00H | 00H OOH | SUM(TEMP7...TEMPO) 


Figure 4-14. PSADBW Instruction Operation Using 64-bit Operands 
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Operation 

VPSADBW (EVEX encoded versions) 

VL = 128, 256,512 

TEMPO := ABS(SRC1[7:0] - SRC2[7:0]) 

(* Repeat operation for bytes 1 through 15 *) 
TEMP15 := ABS(SRC1[127:120] - SRC2[127:120)) 
DEST[15:0] := SUM(TEMPO:TEMP7) 

DEST[63:16] := OOOOOOO00000H 

DEST[79:64] := SUM(TEMP8:TEMP15) 

DEST[1 27:80] := OOOOOO00000H 


IF VL >= 256 
(* Repeat operation for bytes 16 through 31*) 
TEMP31 := ABS(SRC1[255:248] - SRC2[255:248]) 
DEST[143:128] := SUM(TEMP16:TEMP23) 
DEST[191:144] := QOOOOO000000H 
DEST[207:192] := SUM(TEMP24:TEMP31) 
DEST[223:208] := QOOOO000000H 

Fl; 

IF VL >= 512 

(* Repeat operation for bytes 32 through 63%) 
TEMP63 := ABS(SRC1[511:504] - SRC2[511:504]) 
DEST[271:256] := SUM(TEMPO:TEMP7) 
DEST[319:272] := QOOOOO000000H 
DEST[335:320] := SUM(TEMP8:TEMP15) 
DEST[383:336] := QOOOO000000H 
DEST[399:384] := SUM(TEMP16:TEMP23) 
DEST[447:400] := QOOOOO000000H 
DEST[463:448] := SUM(TEMP24:TEMP31) 
DEST[511:464] := QOOOOO00000H 

Fl; 

DEST[MAXVL-1:VL] := 0 


VPSADBW (VEX.256 encoded version) 
TEMPO := ABS(SRC1[7:0] - SRC2[7:0]) 

(* Repeat operation for bytes 2 through 30%) 
TEMP31 := ABS(SRC1[255:248] - SRC2[255:248]) 
DEST[15:0] := SUM(TEMPO:TEMP7) 
DEST[63:16] := OOOOOOO00000H 
DEST[79:64] := SUM(TEMP8:TEMP15) 
DEST[1 27:80] := OOOOOO00000H 
DEST[143:128] := SUM(TEMP16:TEMP23) 
DEST[191:144] := QOOOOO000000H 
DEST[207:192] := SUM(TEMP24:TEMP31) 
DEST[223:208] := OOOOOO00000H 
DEST[MAXVL-1:256] := 0 
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VPSADBW (VEX.128 encoded version) 

TEMPO := ABS(SRC1[7:0] - SRC2[7:0]) 

(* Repeat operation for bytes 2 through 14 *) 
TEMP15 := ABS(SRC1[127:120] - SRC2[127:120)]) 
DEST[15:0] := SUM(TEMPO:TEMP7) 

DEST[63:16] := OOOOOO000000H 

DEST[79:64] := SUM(TEMP8:TEMP15) 

DEST[1 27:80] := OOOOOOO0000H 
DEST[MAXVL-1:128] := 0 


PSADBW (128-bit Legacy SSE version) 

TEMPO := ABS(DEST[7:0] - SRC[7:0]) 

(* Repeat operation for bytes 2 through 14 *) 
TEMP15 := ABS(DEST[1 27:1 20] - SRC[127:120]) 
DEST[15:0] := SUM(TEMPO:TEMP7) 

DEST[63:16] := OOOOOOO00000H 

DEST[79:64] := SUM(TEMP8:TEMP15) 

DEST[1 27:80] := OOOOO000000 
DEST[MAXVL-1:128] (Unmodified) 


PSADBW (64-bit operand) 

TEMPO := ABS(DEST[7:0] - SRC[7:0]) 

(* Repeat operation for bytes 2 through 6 *) 
TEMP7 := ABS(DEST[63:56] - SRC[63:56]) 
DEST[15:0] := SUM(TEMPO:TEMP7) 
DEST[63:16] := OOOOOOO00000H 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSADBW __m512i_mm512_sad_epu8(__m512i a, 
PSADBW:__m64 _mm_sad_pu8(__m64 a,__m64 b) 
(V)PSADBW:__m128i __mm_sad_epu8(__m128i a,___m128i b) 
VPSADBW:__m256i__mm256_sad_epu8(__m256i a,__ m256i b) 


m512i b) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
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Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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PSHUFB — Packed Shuffle Bytes 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF 38 00 /r’ A VV SSSE3 Shuffle bytes in mm7 according to contents of 
PSHUFB mm1, mm2/m64 mme/m64. 
66 OF 38 00 /r A VIN SSSE3 Shuffle bytes in xmm7 according to contents of 
PSHUFB xmm1, xmm2/m128 xmme/m1 28. 
VEX.128.66.0F38.WIG 00 /r B VN AVX Shuffle bytes in xmm2 according to contents of 
VPSHUFB xmm1, xmm2, xmm3/m128 xmm3/m1 28. 
VEX.256.66.0F38.WIG 00 /r B VIN AVX2 Shuffle bytes in ymm2 according to contents of 
VPSHUFB ymm1, ymm2, ymm3/m256 ymm3/m256. 
EVEX.128.66.0F38.WIG 00 /r C VV AVX512VL | Shuffle bytes in xmm2 according to contents of 
VPSHUFB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 under write mask k1. 
EVEX.256.66.0F38.WIG 00 /r C VV AVX512VL | Shuffle bytes in ymm2 according to contents of 
VPSHUFB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 under write mask k1. 
EVEX.512.66.0F38.WIG 00 /r C VV AVX512BW | Shuffle bytes in zmm_2 according to contents of 
VPSHUFB zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 under write mask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


PSHUFB performs in-place shuffles of bytes in the destination operand (the first operand) according to the shuffle 
control mask in the source operand (the second operand). The instruction permutes the data in the destination 
operand, leaving the shuffle mask unaffected. If the most significant bit (bit[7]) of each byte of the shuffle control 
mask is set, then constant zero is written in the result byte. Each byte in the shuffle control mask forms an index 
to permute the corresponding byte in the destination operand. The value of each index is the least significant 4 bits 
(128-bit operation) or 3 bits (64-bit operation) of the shuffle control byte. When the source operand is a 128-bit 
memory operand, the operand must be aligned on a 16-byte boundary or a general-protection exception (#GP) will 
be generated. 


In 64-bit mode and not encoded with VEX/EVEX, use the REX prefix to access XMM8-XMM15 registers. 
Legacy SSE version 64-bit operand: Both operands can be MMX registers. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:128) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: The destination operand is the first operand, the first source operand is the second 
operand, the second source operand is the third operand. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. 


VEX.256 encoded version: Bits (255:128) of the destination YMM register stores the 16-byte shuffle result of the 
upper 16 bytes of the first source operand, using the upper 16-bytes of the second source operand as control mask. 
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The value of each index is for the high 128-bit lane is the least significant 4 bits of the respective shuffle control 
byte. The index value selects a source data element within each 128-bit lane. 

EVEX encoded version: The second source operand is an ZMM/YMM/XMM register or an 512/256/128-bit memory 
location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination is condi- 
tionally updated with writemask k1. 


EVEX and VEX encoded version: Four/two in-lane 128-bit shuffles. 


Operation 


PSHUFB (with 64 bit operands) 
TEMP := DEST 
fori=Oto7{ 
if (SRC[(i * 8)+7] = 1 ) then 
DEST[(i*8)+7...(i*8)+0] := 0; 
else 
index[2..0] := SRC[(i*8)+2 .. (i*8)+0]; 
DEST[(i*8)+7...(i*8)+0] := TEMP[(index*8+7)..(index*8+0)]; 
endif; 


} 


PSHUFB (with 128 bit operands) 
TEMP := DEST 
fori=Oto 15{ 
if (SRC[(i * 8)+7] = 1) then 
DEST[(i*8)+7..(i*8)+0] := 0; 
else 
index[3..0] := SRC[(i*8)+3 .. (i*8)+0]; 
DEST[(i*8)+7..(i*8)+0] := TEMP[(index*8+7)..(index*8+0)]; 
endif 
} 


VPSHUFB (VEX.128 encoded version) 
fori=Oto 15{ 
if (SRC2[(i * 8)+7] = 1) then 
DEST[(i*8)+7..(i*8)+0] := 0; 
else 
index[3..0] := SRC2[(i*8)+3 .. (i*8)+0]; 
DEST[(i*8)+7..(i*8)+0] := SRC1[(index*8+7)..(index*8+0)]; 
endif 


} 
DEST[MAXVL-1:128] := 0 


VPSHUFB (VEX.256 encoded version) 
fori=Oto15{ 
if (SRC2[(i * 8)+7] == 1 ) then 
DEST[(i*8)+7..(i*8)+0] := 0; 
else 
index[3..0] := SRC2[(i*8)+3 .. (i*8)+0]; 
DEST[(i*8)+7..(i*8)+0] := SRC1[(index*8+7)..(index*8+0)]; 
endif 
if (SRC2[128 + (i * 8)+7] == 1 ) then 
DEST[128 + (i*8)+7..(i*8)+0] := 0; 
else 
index[3..0] := SRC2[128 + (i*8)+3 .. (i*8)+0]; 
DEST[128 + (i*8)+7..(i*8)+0] := SRC1[128 + (index*8+7)..(index*8+0)]; 
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endif 
} 
VPSHUFB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
jmask := (KL-1) & ~OxF // 0x00, 0x10, 0x30 depending on the VL 
FOR j =O TOKL-1 // dest 
IF kI[ i ] or no_masking 
index := src.byte[ j ]; 
IF index & 0x80 
Dest.byte[ j ] := 0; 
ELSE 
index := (index & OXF) + (j & jmask); // 16-element in-lane lookup 
Dest.byte[ j ] := src.byte[ index J; 
ELSE if zeroing 
Dest.byte[ j ] := 0; 
DEST[MAXVL-1:VL] := 0; 


MM2 
07H 07H FFH 80H 01H 00H 00H 00H 
MM1 
04H 01H 07H 03H 02H 02H FFH 01H 
04H 04H 00H 00H FFH 01H 01H 01H 


Figure 4-15. PSHUFB with 64-Bit Operands 


Intel C/C++ Compiler Intrinsic Equivalent 
VPSHUFB __m512i__mm512_shuffle_epi8(__m512i a,__m512i b); 


VPSHUFB __m512i__mm512_mask_shuffle_epi8(__m512is, _ mmask64 k,___m512i a,__m512i b); 
VPSHUFB __m512i __mm512_maskz_shuffle_epi8(__mmask64 k,__m512ia,__m512i b); 
VPSHUFB __m256i __mm256_mask_shuffle_epi8(__m256i s, _ mmask32 k,__ m256i a,___m256i b); 


VPSHUFB __m256i _mm256_maskz_shuffle_epi8(__mmask32 k,___ m256i a, ___ m256i b); 
VPSHUFB __m128i _mm_mask_shuffle_epi8(__m128i s,___ mmask16 k,__m128i a, __m128i b); 
VPSHUFB __m128i __mm_maskz_shuffle_epi8(__mmask16 k,__m128i a, ___m128i b); 
PSHUFB: __m64__mm_shuffle_pi8 (__m64 a,__m64 b) 

(V)PSHUFB: __m128i__mm_shuffle_epi8 (__m128i a,__m128i b) 
VPSHUFB:__m256i__mm256_shuffle_epi8(__m256i a, ___m256i b) 


SIMD Floating-Point Exceptions 


None. 
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Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 


PSHUFB — Packed Shuffle Bytes Vol.2B 4-425 


INSTRUCTION SET REFERENCE, M-U 


PSHUFD—Shuffle Packed Doublewords 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 70 /rib A VIV SSE2 Shuffle the doublewords in xmm2/m128 based on 
PSHUFD xmm1, xmm2/m128, imm8 the encoding in imm8 and store the result in xmm1. 
VEX.128.66.0F.WIG 70 /r ib A VIN AVX Shuffle the doublewords in xmm2/m128 based on 
VPSHUFD xmm1, xmm2/m128, imm8 the encoding in imm8 and store the result in xmm1. 
VEX.256.66.0F.WIG 70 /r ib A VIV AVX2 Shuffle the doublewords in ymm2/m256 based on 
VPSHUFD ymm1, ymm2/m256, imm8 the encoding in imm8 and store the result in ymm1. 
EVEX.128.66.0F.WO 70 /r ib B VV AVX512VL | Shuffle the doublewords in xmm2/m128/m32bcst 
VPSHUFD xmm1 {k1}{z}, xmm2/m128/m32bcst, AVX512F | based on the encoding in imm8 and store the result 
imm8 in xmm1 using writemask k1. 
EVEX.256.66.0F.WO 70 /r ib B VIN AVX512VL | Shuffle the doublewords in ynm2/m256/m32bcst 
VPSHUFD ymm1 {k1}{z}, ymm2/m256/m32bcst, AVX512F | based on the encoding in imm8 and store the result 
imm8 in ymm1 using writemask k1. 
EVEX.512.66.0F.WO 70 /r ib B VIN AVX512F | Shuffle the doublewords in zmm2/m51 2/m32bcst 
VPSHUFD zmm1 {k1}{z}, zmm2/m51 2/m32bcst, based on the encoding in imm8 and store the result 
imm8 in zmm1 using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Copies doublewords from source operand (second operand) and inserts them in the destination operand (first 
operand) at the locations selected with the order operand (third operand). Figure 4-16 shows the operation of the 
256-bit VPSHUFD instruction and the encoding of the order operand. Each 2-bit field in the order operand selects 
the contents of one doubleword location within a 128-bit lane and copy to the target element in the destination 
operand. For example, bits 0 and 1 of the order operand targets the first doubleword element in the low and high 
128-bit lane of the destination operand for 256-bit VPSHUFD. The encoded value of bits 1:0 of the order operand 
(see the field encoding in Figure 4-16) determines which doubleword element (from the respective 128-bit lane) of 
the source operand will be copied to doubleword 0 of the destination operand. 


For 128-bit operation, only the low 128-bit lane are operative. The source operand can be an XMM register or a 
128-bit memory location. The destination operand is an XMM register. The order operand is an 8-bit immediate. 
Note that this instruction permits a doubleword in the source operand to be copied to more than one doubleword 
location in the destination operand. 
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SRC X7 X6 X5 X4 | x3 X2 x1 X0 
DEST Y7 Y6 Y5 Y4 Y3 Y2 Y1 YO 


qi ae Encoding 0OB - XO 
of Fields in 01B-X5 ORDER recuse Gin 
ORDER  10B - X6 of Fields in - 


ORDER _ 10B - X2 
Operand 11B - X7 7654321 0 Operand 11B-X3 


Figure 4-16. 256-bit VPSHUFD Instruction Operation 


The source operand can be an XMM register or a 128-bit memory location. The destination operand is an XMM 
register. The order operand is an 8-bit immediate. Note that this instruction permits a doubleword in the source 
operand to be copied to more than one doubleword location in the destination operand. 


In 64-bit mode and not encoded in VEX/EVEX, using REX.R permits this instruction to access XMM8-XMM15. 


128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain 
unchanged. 

VEX.128 encoded version: The source operand can be an XMM register or a 128-bit memory location. The destina- 
tion operand is an XMM register. Bits (MAXVL-1:128) of the corresponding ZMM register are zeroed. 

VEX.256 encoded version: The source operand can be an YMM register or a 256-bit memory location. The destina- 
tion operand is an YMM register. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. Bits (255- 
1:128) of the destination stores the shuffled results of the upper 16 bytes of the source operand using the imme- 
diate byte as the order operand. 

EVEX encoded version: The source operand can be an ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion, or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register updated according to the writemask. 

Each 128-bit lane of the destination stores the shuffled results of the respective lane of the source operand using 
the immediate byte as the order operand. 


Note: EVEX.vvvv and VEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


Operation 


PSHUFD (128-bit Legacy SSE version) 
DEST[31:0] := (SRC >> (ORDER[1:0] * 32))[31:0); 
DEST[63:32] := (SRC >> (ORDER[3:2] * 32))[31:0]; 
DEST[95:64] := (SRC >> (ORDER[5:4] * 32))[31:0]; 
DEST[127:96] := (SRC >> (ORDER[7:6] * 32))[31:0]; 
DEST[MAXVL-1:128] (Unmodified) 


VPSHUFD (VEX.128 encoded version) 
DEST[31:0] := (SRC >> (ORDER[1:0] * 32))[31:0]; 
DEST[63:32] := (SRC >> (ORDER[3:2] * 32))[31:0]; 
DEST[95:64] := (SRC >> (ORDER[5:4] * 32))[31:0]; 
DEST[127:96] := (SRC >> (ORDER[7:6] * 32))[31:0]; 
DEST[MAXVL-1:128] := 0 
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VPSHUFD (VEX.256 encoded version) 

DEST[31:0] := (SRC[127:0] >> (ORDER[1:0] * 32))[31:0); 
DEST[63:32] := (SRC[127:0] >> (ORDER[3:2] * 32))[31:0]; 
DEST[95:64] := (SRC[127:0] >> (ORDER[5:4] * 32))[31:0]; 
DEST[127:96] := (SRC[127:0] >> (ORDER[7:6] * 32))[31:0]; 
DEST[159:128] := (SRC[255:128] >> (ORDER[1:0] * 32))[31:0]; 
DEST[191:160] := (SRC[255:128] >> (ORDER[3:2] * 32))[31:0]; 
DEST[223:192] := (SRC[255:128] >> (ORDER[S:4] * 32))[31:0]; 
DEST[255:224] := (SRC[255:128] >> (ORDER[7:6] * 32))[31:0]; 
DEST[MAXVL-1:256] := 0 


Se TSCM SM 


VPSHUFD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN TMP_SRC[i+31:i] = SRC[31:0] 
ELSE TMP_SRC[i+31:i] := SRC[i+31:i] 
Fl; 
ENDFOR; 
IF VL >= 128 
TMP_DEST[31:0] := (TMP_SRC[1 27:0] >> (ORDER[1:0] * 32))[31:0]; 
TMP_DEST[63:32] := (TMP_SRC[1 27:0] >> (ORDER[3:2] * 32))[31:0]; 
TMP_DEST[95:64] := (TMP_SRC[1 27:0] >> (ORDER[5:4] * 32))[31:0]; 
TMP_DEST[127:96] := (TMP_SRC[127:0] >> (ORDER[7:6] * 32))[31:0]; 


Fl; 
IF VL >= 256 
TMP_DEST[159:1 28] := (TMP_SRC[255:128] >> (ORDER[1:0] * 32))[31:0]; 
TMP_DEST[191:160] := (TMP_SRC[255:128] >> (ORDER[3:2] * 32))[31:0]; 
TMP_DEST[223:192] := (TMP_SRC[255:128] >> (ORDER[5:4] * 32))[31:0]; 
TMP_DEST[255:224] := (TMP_SRC[255:128] >> (ORDER[7:6] * 32))[31:0]; 
Fl; 
IF VL >=512 
TMP_DEST[287:256] := (TMP_SRC[383:256] >> (ORDER[1:0] * 32))[31:0]; 
TMP_DEST[319:288] := (TMP_SRC[383:256] >> (ORDER[3:2] * 32))[31:0]; 
TMP_DEST[351:320] := (TMP_SRC[383:256] >> (ORDER[5:4] * 32))[31:0]; 
TMP_DEST[383:352] := (TMP_SRC[383:256] >> (ORDER[7:6] * 32))[31:0]; 
TMP_DEST[415:384] := (TMP_SRC[511:384] >> (ORDER[1:0] * 32))[31:0]; 
TMP_DEST[447:416] := (TMP_SRC[511:384] >> (ORDER[3:2] * 32))[31:0]; 
TMP_DEST[479:448] := (TMP_SRC[511:384] >> (ORDER[5:4] * 32))[31:0]; 
TMP_DEST[51 1:480] := (TMP_SRC[511:384] >> (ORDER[7:6] * 32))[31:0]; 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
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DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPSHUFD __m512i__mm512_shuffle_epi32(__m512i a, int n); 

VPSHUFD __m512i_mm512_mask_shuffle_epi32(__m512is,___mmask16 k,__m512ia, int n); 
VPSHUFD __m512i_mm512_maskz_shuffle_epi32(__mmask16 k,__m512ia, int n ); 
VPSHUFD __m256i __mm256_mask_shuffle_epi32(__m256i s,__ mmask8 k,__ m256i a, int n ); 
VPSHUFD __m256i__mm256_maskz_shuffle_epi32(___mmask8 k, __ m256i a, int n ); 

VPSHUFD __m128i __mm_mask_shuffle_epi32(__m128is,__ mmask8 k,__m128i a, int n); 
VPSHUFD __m128i __mm_maskz_shuffle_epi32(__mmask8 k,___m128i a, int n); 
(V)PSHUFD:__m128i __mm_shuffle_epi32(__m128i a, int n) 

VPSHUFD:__m256i __mm256_shuffle_epi32(__m256i a, const int n) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 


EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 
Additionally: 
#UD If VEX.vvvv # 1111B or EVEX.vvvv # 1111B. 


PSHUFD—Shuffle Packed Doublewords 


INSTRUCTION SET REFERENCE, M-U 


Vol.2B 4-429 


INSTRUCTION SET REFERENCE, M-U 


PSHUFHW-—Shuffle Packed High Words 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 OF 70 /rib A VIV SSE2 Shuffle the high words in xmm2/m128 based 


on the encoding in imm8 and store the result in 
xmm1. 


PSHUFHW xmm17, xmm2/m128, imm8 


VEX.128.F3.0F.WIG 70 /r ib A VIV AVX 
VPSHUFHW xmm1, xmm2/m128, imm8 


Shuffle the high words in xmm2/m128 based 
on the encoding in imm8 and store the result in 
xmm1. 


VEX.256.F3.0F.WIG 70 /r ib A VIN AVX2 
VPSHUFHW ymm1, ymm2/m256, imm8 


Shuffle the high words in ymm2/m256 based 
on the encoding in imm8 and store the result in 
ymm1. 


EVEX.128.F3.0F.WIG 70 /r ib B VN 
VPSHUFHW xmm1 {k1}{z}, xmm2/m1 28, imm8 


AVX512VL | Shuffle the high words in xmm2/m1 28 based 
AVX512BW | on the encoding in imm8 and store the result in 
xmm1 under write mask k1. 

AVX512VL | Shuffle the high words in ymm2/m256 based 
AVX512BW | on the encoding in imm8 and store the result in 
ymm1 under write mask k1. 

AVX512BW | Shuffle the high words in zmm2/m512 based 
on the encoding in imm8 and store the result in 
zmm1 under write mask k1. 


EVEX.256.F3.0F.WIG 70 /r ib B VN 
VPSHUFHW ymm1 {k1}{z}, ymm2/m256, imm8 


EVEX.512.F3.0F.WIG 70 /r ib B VV 
VPSHUFHW zmm1 {k1}{z}, zmm2/m512, imm8 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Copies words from the high quadword of a 128-bit lane of the source operand and inserts them in the high quad- 
word of the destination operand at word locations (of the respective lane) selected with the immediate operand. 
This 256-bit operation is similar to the in-lane operation used by the 256-bit VPSHUFD instruction, which is illus- 
trated in Figure 4-16. For 128-bit operation, only the low 128-bit lane is operative. Each 2-bit field in the immediate 
operand selects the contents of one word location in the high quadword of the destination operand. The binary 
encodings of the immediate operand fields select words (0, 1, 2 or 3, 4) from the high quadword of the source 
operand to be copied to the destination operand. The low quadword of the source operand is copied to the low 
quadword of the destination operand, for each 128-bit lane. 


Note that this instruction permits a word in the high quadword of the source operand to be copied to more than one 
word location in the high quadword of the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


128-bit Legacy SSE version: The destination operand is an XMM register. The source operand can be an XMM 
register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destination register remain 
unchanged. 


VEX.128 encoded version: The destination operand is an XMM register. The source operand can be an XMM register 
or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are zeroed. VEX.vvvv is 
reserved and must be 1111b, VEX.L must be 0, otherwise the instruction will #UD. 


VEX.256 encoded version: The destination operand is an YMM register. The source operand can be an YMM register 
or a 256-bit memory location. 
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EVEX encoded version: The destination operand is a ZMM/YMM/XMM registers. The source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is updated according to the 
writemask. 


Note: In VEX encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


PSHUFHW (128-bit Legacy SSE version) 
DEST[63:0] := SRC[63:0] 

DEST[79:64] := (SRC >> (imm[1:0] *16))[79:64] 
DEST[95:80] := (SRC >> (imm[3:2] * 16))[79:64] 
DEST[111:96] := (SRC >> (imm[5:4] * 16))[79:64] 
DEST[127:112] := (SRC >> (imm[7:6] * 16))[79:64] 
DEST[MAXVL-1:1 28] (Unmodified) 


VPSHUFHW (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] 

DEST[79:64] := (SRC1 >> (imm[1:0] *16))[79:64] 
DEST[95:80] := (SRC1 >> (imm[3:2] * 16))[79:64] 
DEST[111:96] := (SRC1 >> (imm[5:4] * 16))[79:64] 
DEST[127:112] := (SRC1 >> (imm[7:6] * 16))[79:64] 
DEST[MAXVL-1:128] := 0 


VPSHUFHW (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] 

DEST[79:64] := (SRC1 >> (imm[1:0] *16))[79:64] 
DEST[95:80] := (SRC1 >> (imm[3:2] * 16))[79:64] 
DEST[111:96] := (SRC1 >> (imm[5:4] * 16))[79:64] 
DEST[127:112] := (SRC1 >> (imm[7:6] * 16))[79:64] 
DEST[191:128] := SRC1[191:128] 

DEST[207192] := (SRC1 >> (imm[1:0] *16))[207:192] 
DEST[223:208] := (SRC1 >> (imm[3:2] * 16))[207:192] 
DEST[239:224] := (SRC1 >> (imm[5:4] * 16))[207:192] 
DEST[255:240] := (SRC1 >> (imm[7:6] * 16))[207:192] 
DEST[MAXVL-1:256] := 0 


VPSHUFHW (EVEX encoded versions) 

(KL, VL) = (8, 128), (16, 256), (32, 512) 

IF VL >= 128 
TMP_DEST[63:0] := SRC1[63:0] 
TMP_DEST[79:64] := (SRC1 >> (imm[1:0] *16))[79:64] 
TMP_DEST[95:80] := (SRC1 >> (imm[3:2] * 16))[79:64] 
TMP_DEST[11 1:96] := (SRC1 >> (imm[5:4] * 16))[79:64] 
TMP_DEST[127:112] := (SRC1 >> (imm[7:6] * 16))[79:64] 

Fl; 

IF VL >= 256 
TMP_DEST[191:128] := SRC1[191:128] 
TMP_DEST[207:192] := (SRC1 >> (imm[1:0] *16))[207:192] 
TMP_DEST[223:208] := (SRC1 >> (imm[3:2] * 16))[207:192] 
TMP_DEST[239:224] := (SRC1 >> (imm[5:4] * 16))[207:192] 
TMP_DEST[255:240] := (SRC1 >> (imm[7:6] * 16))[207:192] 

Fl; 

IF VL >= 512 
TMP_DEST[319:256] := SRC1[319:256] 
TMP_DEST[335:320] := (SRC1 >> (imm[1:0] *16))[335:320] 


aan nN 
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TMP_DEST[351:336] := (SRC1 >> (imm[3:2] * 16))[335:320] 
TMP_DEST[367:352] := (SRC1 >> (imm[5:4] * 16))[335:320] 
TMP_DEST[383:368] := (SRC1 >> (imm[7:6] * 16))[335:320] 
TMP_DEST[447:384] := SRC1[447:384] 

TMP_DEST[463:448] := (SRC1 >> (imm[1:0] *16) 
TMP_DEST[479:464] := (SRC1 >> (imm[3:2] * 16 
TMP_DEST[495:480] := (SRC1 >> (imm[5:4] * 16 
TMP_DEST[51 1:496] := (SRC1 >> (imm[7:6] * 16 


[463:448] 
)[463:448] 
)[463:448] 
)[463:448] 


i am 
SS re are a 


Fl; 


FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST{[i+1 5:i] = TMP_DEST[i+15:i]; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPSHUFHW __m512i_mm512_shufflehi_epi16(__m512i a, int n); 

VPSHUFHW __m512i_mm512_mask_shufflehi_epi16(__m512is,__mmask16 k,__m512ia, int n); 
VPSHUFHW __m512i_mm512_maskz_shufflehi_epi16(__mmask16 k,__m512ia, int n); 
VPSHUFHW __m256i__mm256_mask_shufflehi_epi16(__m256i s,__ mmask8 k,__ m256i a, int n ); 
VPSHUFHW __m256i__mm256_maskz_shufflehi_epi16(__mmask8 k,___ m256i a, int n ); 
VPSHUFHW __m128i __mm_mask_shufflehi_epi1 6(__m128i s,__ mmask8 k, __m128i a, int n); 
VPSHUFHW __m128i __mm_maskz_shufflehi_epi16(__ mmask8 k, __m128i a, int n); 
(V)PSHUFHW:__m128i __mm_shufflehi_epi1 6(__m128i a, int n) 

VPSHUFHW:__m256i _mm256_shufflehi_epi1 6(__m256i a, const int n) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
Additionally: 

#UD If VEX.vvvv != 1111B, or EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, M-U 


PSHUFLW—Shuffle Packed Low Words 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F2 OF 70 /rib A VIV SSE2 Shuffle the low words in xmm2/m128 based on 


the encoding in imm@ and store the result in 
xmm1. 


PSHUFLW xmm1, xmm2/m128, imm8& 


VEX.128.F2.0F.WIG 70 /r ib A VIV AVX 
VPSHUFLW xmm1, xmm2/m128, imm8 


Shuffle the low words in xmm2/m128 based on 
the encoding in imm8 and store the result in 
xmm1. 


VEX.256.F2.0F.WIG 70 /r ib A VV AVX2 
VPSHUFLW ymm17, ymm2/m256, imm8 


Shuffle the low words in ynm2/m256 based on 
the encoding in imm8 and store the result in 
ymm1. 


EVEX.128.F2.0F.WIG 70 /r ib B VV 
VPSHUFLW xmm1 {k1}{z}, xmm2/m1 28, imm8 


AVX512VL_ | Shuffle the low words in xmm2/m1 28 based on 
AVX512BW | the encoding in imm8 and store the result in 
xmm1 under write mask k1. 


EVEX.256.F2.0F.WIG 70 /r ib B VV 
VPSHUFLW ymm1 {k1}{z}, ymm2/m256, imm8 


AVX512VL | Shuffle the low words in ymm2/m256 based on 
AVX512BW | the encoding in imm8 and store the result in 
ymm1 under write mask k1. 


EVEX.512.F2.0F.WIG 70 /r ib B VIN AVX512BW | Shuffle the low words in zmm2/m512 based on 
VPSHUFLW zmm1 {k1}{z}, zmm2/m512, imm8 the encoding in imm8 and store the result in 


zmm1 under write mask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) imm8 NA 
B Full Mem ModRM:reg (w) ModRM:r/m (r) Imms NA 
Description 


Copies words from the low quadword of a 128-bit lane of the source operand and inserts them in the low quadword 
of the destination operand at word locations (of the respective lane) selected with the immediate operand. The 
256-bit operation is similar to the in-lane operation used by the 256-bit VPSHUFD instruction, which is illustrated 
in Figure 4-16. For 128-bit operation, only the low 128-bit lane is operative. Each 2-bit field in the immediate 
operand selects the contents of one word location in the low quadword of the destination operand. The binary 
encodings of the immediate operand fields select words (0, 1, 2 or 3) from the low quadword of the source operand 
to be copied to the destination operand. The high quadword of the source operand is copied to the high quadword 
of the destination operand, for each 128-bit lane. 


Note that this instruction permits a word in the low quadword of the source operand to be copied to more than one 
word location in the low quadword of the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


128-bit Legacy SSE version: The destination operand is an XMM register. The source operand can be an XMM 
register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destination register remain 
unchanged. 


VEX.128 encoded version: The destination operand is an XMM register. The source operand can be an XMM register 
or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are zeroed. 

VEX.256 encoded version: The destination operand is an YMM register. The source operand can be an YMM register 
or a 256-bit memory location. 


EVEX encoded version: The destination operand is a ZMM/YMM/XMM registers. The source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is updated according to the 
writemask. 
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INSTRUCTION SET REFERENCE, M-U 


Note: In VEX encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


PSHUFLW (128-bit Legacy SSE version) 
DEST[15:0] := (SRC >> (imm[1:0] *16))[15:0] 
DEST[31:16] := (SRC >> (imm[3:2] * 16))[15:0] 
DEST[47:32] := (SRC >> (imm[5:4] * 16))[15:0] 
DEST[63:48] := (SRC >> (imm[7:6] * 16))[15:0] 
DEST[127:64] := SRC[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


VPSHUFLW (VEX.128 encoded version) 
DEST[15:0] := (SRC1 >> (imm[1:0] *16))[15:0] 
DEST[31:16] := (SRC1 >> (imm[3:2] * 16))[15:0] 
DEST[47:32] := (SRC1 >> (imm[5:4] * 16))[15:0] 
DEST[63:48] := (SRC1 >> (imm[7:6] * 16))[15:0] 
DEST[127:64] := SRC[127:64] 
DEST[MAXVL-1:128] := 0 


VPSHUFLW (VEX.256 encoded version) 
DEST[15:0] := (SRC1 >> (imm[1:0] *16))[15:0] 
DEST[31:16] := (SRC1 >> (imm[3:2] * 16))[15:0] 
DEST[47:32] := (SRC1 >> (imm[5:4] * 16))[15:0] 
DEST[63:48] := (SRC1 >> (imm[7:6] * 16))[15:0] 
DEST[127:64] := SRC1[127:64] 
DEST[143:128] := (SRC1 >> (imm[1:0] *16) 
DEST[159:144] := (SRC1 >> (imm[3:2] * 16 
DEST[175:160] := (SRC1 >> (imm[5:4] * 16 
DEST[191:176] := (SRC1 >> (imm[7:6] * 16 
DEST[255:192] := SRC1[255:192] 
DEST[MAXVL-1:256] := 0 


— 


[143:128] 
)[143:128] 
)[143:128] 
)[143:128] 


Sa a 


VPSHUFLW (EVEX.U1.512 encoded version) 

(KL, VL) = (8, 128), (16, 256), (32, 512) 

IF VL >= 128 
TMP_DEST[15:0] := (SRC1 >> (imm[1:0] *16))[15:0] 
TMP_DEST[31:16] := (SRC1 >> (imm[3:2] * 16))[15:0] 
TMP_DEST[47:32] := (SRC1 >> (imm[5:4] * 16))[15:0] 
TMP_DEST[63:48] := (SRC1 >> (imm[7:6] * 16))[15:0] 
TMP_DEST[127:64] := SRC1[127:64] 

Fl; 

IF VL >= 256 
TMP_DEST[143:1 28] := (SRC1 >> (imm[1:0] *16))[143:128] 
TMP_DEST[159:144] := (SRC1 >> (imm[3:2] * 16))[143:128] 
TMP_DEST[175:160] := (SRC1 >> (imm[5:4] * 16))[143:128] 
TMP_DEST[191:176] := (SRC1 >> (imm[7:6] * 16))[143:128] 
TMP_DEST[255:192] := SRC1[255:192] 

Fl; 

IF VL >= 512 
TMP_DEST[271:256] := 
TMP_DEST[287:272] := 


ie 


SRC1 >> (imm{[1:0] *16) 
SRC1 >> (imm[3:2] * 16 
TMP_DEST[303:288] := (SRC1 >> (imm[5:4] * 16 
TMP_DEST[319:304] := (SRC1 >> (imm[7:6] * 16 
TMP_DEST[383:320] := SRC1[383:320] 


[271:256] 
)[271:256] 
)[271:256] 
)[271:256] 


ann ons 
ee ey) 
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TMP_DEST[399:384] := (SRC1 >> (imm[1:0] *16))[399:384] 
TMP_DEST[415:400] := (SRC1 >> (imm[3:2] * 16))[399:384] 
TMP_DEST[431:416] := (SRC1 >> (imm[5:4] * 16))[399:384] 
TMP_DEST[447:432] := (SRC1 >> (imm[7:6] * 16))[399:384] 


TMP_DEST[51 1:448] := SRC1[511:448] 
Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] = TMP_DEST[i+15:i]; 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VPSHUFLW __m512i__mm512_shufflelo_epi16(__m512i a, int n); 
VPSHUFLW __m512i__mm512_mask_shufflelo_epi16(__m512is, 


VPSHUFLW __m256i __mm256_mask_shufflelo_epi16(__m256i s, 


VPSHUFLW __m128i __mm_mask_shufflelo_epi16(__m128i s, 


(V)PSHUFLW:__m128i __mm_shufflelo_epi16(__m128i a, int n) 
VPSHUFLW:__m256i__mm256_shufflelo_epi16(__m256i a, const int n) 


Flags Affected 
None. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


mmask16 k,__m512ia, int n); 
VPSHUFLW __m512i__mm512_maskz_shufflelo_epi16(__mmask16 k,__m512i a, int n); 
mmask8 k,___m256i a, int n ); 
VPSHUFLW __m256i __mm256_maskz_shufflelo_epi16(__mmask8 k,__ m256i a, int n ); 
mmask8 k, 
VPSHUFLW __m128i __mm_maskz_shufflelo_epi16(__mmask8 k, __m128i a, int n); 


m128i a, int n); 


INSTRUCTION SET REFERENCE, M-U 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 


Additionally: 


#UD If VEX.vvvv != 1111B, or EVEX.vvvv != 1111B. 
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PSHUFW-—Shuffle Packed Words 


PSHUFW mm1, mm2/m64, imm8 


Opcode/ Op/ | 64-Bit Compat/ |Description 
Instruction En |Mode Leg Mode 
NP OF 70 /rib RMI | Valid Valid Shuffle the words in mm2/m64 based on the 


encoding in imm8 and store the result in mm7. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
Description 


Copies words from the source operand (second operand) and inserts them in the destination operand (first 
operand) at word locations selected with the order operand (third operand). This operation is similar to the opera- 
tion used by the PSHUFD instruction, which is illustrated in Figure 4-16. For the PSHUFW instruction, each 2-bit 
field in the order operand selects the contents of one word location in the destination operand. The encodings of the 
order operand fields select words from the source operand to be copied to the destination operand. 


The source operand can be an MMX technology register or a 64-bit memory location. The destination operand is an 
MMX technology register. The order operand is an 8-bit immediate. Note that this instruction permits a word in the 
source operand to be copied to more than one word location in the destination operand. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 


(XMM8-XMM15). 


Operation 


DEST[15:0] := (SRC >> (ORDER[1:0] * 16))[15:0]; 
DEST[31:16] := (SRC >> (ORDER[3:2] * 16))[15:0]; 
DEST[47:32] := (SRC >> (ORDER[5:4] * 16))[15:0]; 
DEST[63:48] := (SRC >> (ORDER[7:6] * 16))[15:0]; 


Intel C/C++ Compiler Intrinsic Equivalent 


PSHUFW: 


Flags Affected 
None. 


Numeric Exceptions 


None. 


Other Exceptions 
See Table 21-7, “Exception Conditions for SIMD/MMX Instructions with Memory Reference” in the Inte/® 64 and 


IA-32 Architectures Software Developer’s Manual, Volume 3A. 
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m64 _mm_shuffle_pi16(__m64 a, int n) 


PSHUFW—Shuffle Packed Words 


PSIGNB/PSIGNW/PSIGND — Packed SIGN 


INSTRUCTION SET REFERENCE, M-U 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF 38 08 /r’ RM | V/V SSSE3 Negate/zero/preserve packed byte integers in 

PSIGNB mm1, mm2/m64 mm1 depending on the corresponding sign in 
mm2/m64. 

66 OF 38 08 /r RM | V/V SSSE3 Negate/zero/preserve packed byte integers in 

PSIGNB xmm1, xmm2/m128 Xmm1 depending on the corresponding sign in 
xmm2/m1 28. 

NP OF 38 09 /r’ RM | V/V SSSE3 Negate/zero/preserve packed word integers 

PSIGNW mm1, mm2/m64 in mm1 depending on the corresponding sign 
in mm2/m128. 

66 OF 38 09 /r RM | V/V SSSE3 Negate/zero/preserve packed word integers 

PSIGNW xmm1, xmm2/m128 in xmm1 depending on the corresponding sign 
in xmm2/m128. 

NP OF 38 OA /r! RM | V/V SSSE3 Negate/zero/preserve packed doubleword 

PSIGND mm1, mm2/m64 integers in mm7 depending on the 
corresponding sign in mm2/m128. 

66 OF 38 OA /r RM | V/V SSSE3 Negate/zero/preserve packed doubleword 

PSIGND xmm1, xmm2/m128 integers in xmm1 depending on the 
corresponding sign in xmm2/m128. 

VEX.128.66.0F38.WIG 08 /r RVM | V/V AVX Negate/zero/preserve packed byte integers in 

VPSIGNB xmm1, xmm2, xmm3/m128 Xmm_2 depending on the corresponding sign in 
xmm3/m1 28. 

VEX.128.66.0F38.WIG 09 /r RVM | V/V AVX Negate/zero/preserve packed word integers 

VPSIGNW xmm1, xmm2, xmm3/m128 in xmme2 depending on the corresponding sign 
in xmm3/m128. 

VEX.128.66.0F38.WIG OA /r RVM | V/V AVX Negate/zero/preserve packed doubleword 

VPSIGND xmm1, xmm2, xmm3/m128 integers in xmm2 depending on the 
corresponding sign in xmm3/m128. 

VEX.256.66.0F38.WIG 08 /r RVM | V/V AVX2 Negate packed byte integers in ymm2 if the 

VPSIGNB ymm1, ymm2, ymm3/m256 corresponding sign in ymm3/m256 is less 
than zero. 

VEX.256.66.0F38.WIG 09 /r RVM | V/V AVX2 Negate packed 16-bit integers in ymm2 if the 

VPSIGNW ymm1, ymm2, ymm3/m256 corresponding sign in ymm3/m256 is less 
than zero. 

VEX.256.66.0F38.WIG OA /r RVM | V/V AVX2 Negate packed doubleword integers in ymm2 

VPSIGND ymm1, ymm2, ymm3/m256 if the corresponding sign in ymm3/m256 is 
less than zero. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
PSIGNB/PSIGNW/PSIGND — Packed SIGN Vol.2B 4-437 
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Description 


(V)PSIGNB/(V)PSIGNW/(V)PSIGND negates each data element of the destination operand (the first operand) if the 
signed integer value of the corresponding data element in the source operand (the second operand) is less than 
zero. If the signed integer value of a data element in the source operand is positive, the corresponding data 
element in the destination operand is unchanged. If a data element in the source operand is zero, the corre- 
sponding data element in the destination operand is set to zero. 


(V)PSIGNB operates on signed bytes. (V)PSIGNW operates on 16-bit signed words. (V)PSIGND operates on signed 
32-bit integers. 

Legacy SSE instructions: Both operands can be MMxX registers. In 64-bit mode, use the REX prefix to access addi- 
tional registers. 

128-bit Legacy SSE version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding YMM destina- 
tion register remain unchanged. 

VEX.128 encoded version: The first source and destination operands are XMM registers. The second source 
operand is an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the destination YMM register are 
zeroed. VEX.L must be 0, otherwise instructions will #UD. 


VEX.256 encoded version: The first source and destination operands are YMM registers. The second source 
operand is an YMM register or a 256-bit memory location. 


Operation 
def byte_sign(control, input_val): 
if control<O: 
return negate(input_val) 
elif control==0: 
return 0 
return input_val 


def word_sign(control, input_val): 
if control<O: 
return negate(input_val) 
elif control==0: 
return 0 
return input_val 


def dword_sign(control, input_val): 
if control<O: 
return negate(input_val) 
elif control==0: 
return 0 
return input_val 


PSIGNB srcdest, src // MMX 64-bit operands 
VL=64 
KL := VL/8 
for iin O..KL-1: 
srcdest.byte[i] := byte_sign(src.byte[i], srcdest.byte[i]) 


PSIGNW srcdest, src // MMX 64-bit operands 


VL=64 
KL := VL/16 
FOR i in O...KL-1: 


srcdest.word[i] := word_sign(src.word[i], srcdest.word[i]) 
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PSIGND srcdest, src // MMX 64-bit operands 
VL=64 
KL := VL/32 
FOR i in O...KL-1: 
srcdest.dword{i] := dword_sign(src.dword[i], srcdest.dword[i]) 


PSIGNB srcdest, src // SSE 128-bit operands 
VL=128 
KL := VL/8 
FOR i in O...KL-1: 
srcdest.byte[i] := byte_sign(src.byte[i], srcdest.byte[i]) 


PSIGNW srcdest, src // SSE 128-bit operands 
VL=128 
KL := VL/16 
FOR i in O...KL-1: 
srcdest.word[i] := word_sign(src.word[i], srcdest.word[i]) 


PSIGND srcdest, src // SSE 128-bit operands 
VL=128 
KL := VL/32 
FOR i in O...KL-1: 
srcdest.dword{i] := dword_sign(src.dword[i], srcdest.dword[i]) 


VPSIGNB dest, src1, src2_ // AVX 128-bit or 256-bit operands 
VL=(128,256) 
KL := VL/8 
FOR i in O...KL-1: 

dest.byte[i] := byte_sign(src2.byte[i], src1.byte[i]) 
DEST[MAXVL-1:VL] := 0 


VPSIGNW dest, src1, src2_ // AVX 128-bit or 256-bit operands 
VL=(128,256) 
KL := VL/16 
FOR i in O...KL-1: 

dest.word[i] := word_sign(src2.word[i], src1.word[i]) 
DEST[MAXVL-1:VL] := 0 


VPSIGND dest, src1, src2.  // AVX 128-bit or 256-bit operands 
VL=(128,256) 
KL := VL/32 
FOR i in O...KL-1: 

dest.dword[i] := dword_sign(src2.dword{i], src1.dword[i]) 
DEST[MAXVL-1:VL] := 0 


PSIGNB/PSIGNW/PSIGND — Packed SIGN 


INSTRUCTION SET REFERENCE, M-U 
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INSTRUCTION SET REFERENCE, M-U 


Intel C/C++ Compiler Intrinsic Equivalent 


PSIGNB: m64 _mm_sign_pi8 (__m64 a,__m64 b) 
(V)PSIGNB: m128i __mm_sign_epi8 (__m128i a, ___m128i b) 
VPSIGNB: m256i_mm256_sign_epi8 (__m256i a,___m256i b) 
PSIGNW: m64 _mm_sign_pi16 (_m64a,__m64 b) 
(V)PSIGNW: m128i __mm_sign_epi16 (__m128i a, __m128i b) 
VPSIGNW: m256i_mm256_sign_epi16 (__m256i a,__m256i b) 
PSIGND: m64 _mm_sign_pi32 (__m64 a,__m64 b) 
(V)PSIGND: m128i __mm_sign_epi32 (__m128i a,__m128i b) 
VPSIGND: m256i __mm256_sign_epi32 (__m256i a,___m256i b) 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD If VEX.L = 1. 
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PSIGNB/PSIGNW/PSIGND — Packed SIGN 


PSLLDQ—Shift Double Quadword Left Logical 


INSTRUCTION SET REFERENCE, M-U 


Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
66 OF 73/7 ib A VN SSE2 Shift xmm7 left by imm8 bytes while shifting 
PSLLDQ xmm1, imm8 in Os. 
VEX.128.66.0F.WIG 73 /7 ib B VN AVX Shift xmm2 left by imm8 bytes while shifting 
VPSLLDQ xmm1, xmm2, imm8 in Os and store result in xmm17. 
VEX.256.66.0F.WIG 73 /7 ib B VV AVX2 Shift ymm2 left by imm8 bytes while shifting 
VPSLLDQ ymm1, ymm2, imm8 in Os and store result in ymm17. 
EVEX.128.66.0F.WIG 73 /7 ib C VV AVX512VL | Shift xmm2/m128 left by imm8 bytes while 
VPSLLDQ xmm1,xmme2/ m128, imm8 AVX512BW | shifting in Os and store result in xmm1. 
EVEX.256.66.0F.WIG 73 /7 ib C VN AVX512VL | Shift ymnm2/m256 left by imm8 bytes while 
VPSLLDQ ymm1, ymm2/m256, imm8 AVX512BW | shifting in Os and store result in ymm1. 
EVEX.512.66.0F.WIG 73 /7 ib C VN AVX512BW | Shift zmm2/m512 left by imm8 bytes while 
VPSLLDQ zmm1, zmm2/m512, imm8 shifting in Os and store result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (r, w) imm8 NA NA 
B NA VEX.vvvv (w) ModRM:r/m (r) imm8 NA 
C Full Mem EVEX.vvvv (w) ModRM:r/m (R) Imm8 NA 
Description 


Shifts the destination operand (first operand) to the left by the number of bytes specified in the count operand 
(second operand). The empty low-order bytes are cleared (set to all Os). If the value specified by the count operand 
is greater than 15, the destination operand is set to all Os. The count operand is an 8-bit immediate. 

128-bit Legacy SSE version: The source and destination operands are the same. Bits (MAXVL-1:128) of the corre- 
sponding YMM destination register remain unchanged. 


VEX.128 encoded version: The source and destination operands are XMM registers. Bits (MAXVL-1:128) of the 
destination YMM register are zeroed. 


VEX.256 encoded version: The source operand is YMM register. The destination operand is an YMM register. Bits 
(MAXVL-1:256) of the corresponding ZMM register are zeroed. The count operand applies to both the low and high 
128-bit lanes. 

EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operand is a ZMM/YMM/XMM register. The count operand applies to each 128-bit lanes. 


Operation 

VPSLLDQ (EVEX.U1.512 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; Fl 
DEST[127:0] := SRC[127:0] << (TEMP * 8) 
DEST[255:1 28] := SRC[255:128] << (TEMP * 8) 
DEST[383:256] := SRC[383:256] << (TEMP * 8) 
DEST[511:384] := SRC[511:384] << (TEMP * 8) 
DEST[MAXVL-1:512] := 0 
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VPSLLDQ (VEX.256 and EVEX.256 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; FI 

DEST[127:0] := SRC[127:0] << (TEMP * 8) 
DEST[255:128] := SRC[255:128] << (TEMP * 8) 
DEST[MAXVL-1:256] := 0 


VPSLLDQ (VEX.128 and EVEX.128 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; FI 

DEST := SRC << (TEMP * 8) 

DEST[MAXVL-1:128] := 0 


PSLLDQ(128-bit Legacy SSE version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; Fl 
DEST := DEST << (TEMP * 8) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


(V)PSLLDQ:__m128i _mm_slli_si128 (__m128i a, int imm) 
VPSLLDQ:__m256i _mm256_slli_si256 (__m256i a, const int imm) 
VPSLLDQ __m512i_mm512_bslli_epi128 (__m512i a, const int imm) 


Flags Affected 


None. 


Numeric Exceptions 


None. 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-24, “Type 7 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF F1 /r' A VN MMX Shift words in mm left mm/m64 while shifting in 
PSLLW mm, mm/m64 Os. 
66 OF F1 /r A VIV SSE2 Shift words in xmm7 left by xmm2/m128 while 
PSLLW xmm1, xmm2/m128 shifting in Os. 
NP OF 71 /6 ib B VIN MMX Shift words in mm left by imm8 while shifting in 
PSLLW mm1, imm8 Os. 
66 OF 71 /6 ib B VIN SSE2 Shift words in xmm7 left by imm8 while shifting 
PSLLW xmm1, imm8 in Os. 
NP OF Fe /r' A VIV MMX Shift doublewords in mm left by mm/m64 while 
PSLLD mm, mm/m64 shifting in Os. 
66 OF Fe /r A VIV SSE2 Shift doublewords in xmm7 left by xmm2/m128 
PSLLD xmm1, xmm2/m128 while shifting in Os. 
NP OF 72 /6 ib! B VIV MMX Shift doublewords in mm left by imm8 while 
PSLLD mm, imm8 shifting in Os. 
66 OF 72 /6 ib B VIV SSE2 Shift doublewords in xmm7 left by imm8 while 
PSLLD xmm1, imm8 shifting in Os. 
NP OF F3 /r' A VIV MMX Shift quadword in mm left by mm/m64 while 
PSLLO mm, mm/m64 shifting in Os. 
66 OF F3 /r A VIV SSE2 Shift quadwords in xmm7 left by xmm2/m128 
PSLLO xmm1, xmm2/m128 while shifting in Os. 
NP OF 73 /6 ib! B VIV MMX Shift quadword in mm left by imm8 while 
PSLLO mm, imm8 shifting in Os. 
66 OF 73 /6 ib B VIV SSE2 Shift quadwords in xmm7 left by imm8 while 
PSLLO xmm1, imm8 shifting in Os. 
VEX.128.66.0F.WIG F1 /r C VIN AVX Shift words in xmm2 left by amount specified in 
VPSLLW xmm1, xmme2, xmm3/m128 xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 71 /6 ib D VIV AVX Shift words in xmm2 left by imm8 while shifting 
VPSLLW xmm1, xmm2, imm8 in Os. 
VEX.128.66.0F.WIG F2 /r C VIV AVX Shift doublewords in xmm2 left by amount 
VPSLLD xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 72 /6 ib D VIV AVX Shift doublewords in xmm2 left by imm8 while 
VPSLLD xmm1, xmm2, imm8 shifting in Os. 
VEX.128.66.0F.WIG F3 /r G VIV AVX Shift quadwords in xmm2 left by amount 
VPSLLOQ xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 73 /6 ib D VIV AVX Shift quadwords in xmm2 left by imm8 while 
VPSLLQ xmm1, xmm2, imm8 shifting in Os. 
VEX.256.66.0F.WIG F1 /r C VN AVX2 Shift words in ymm2 left by amount specified in 
VPSLLW ymm 1, ymm2, xmm3/m128 xmm3/m128 while shifting in Os. 
VEX.256.66.0F.WIG 71 /6 ib D VV AVX2 Shift words in ymm2 left by imm8 while shifting 


VPSLLW ymm7, ymm2, imm8 


in Os. 
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VEX.256.66.0F.WIG Fe /r VIV AVX2 Shift doublewords in ymm2 left by amount 

VPSLLD ymm1, ymm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 

VEX.256.66.0F.WIG 72 /6 ib VIV AVX2 Shift doublewords in ymm2 left by imm8 while 

VPSLLD ymm1, ymm2, imm8 shifting in Os. 

VEX.256.66.0F.WIG F3 /r VIV AVX2 Shift quadwords in ymm2 left by amount 

VPSLLO ymm1, ymm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 

VEX.256.66.0F.WIG 73 /6 ib VIV AVX2 Shift quadwords in ymm2 left by imm8 while 

VPSLLOQ ymm1, ymm2, imm8 shifting in Os. 

EVEX.128.66.0F.WIG F1 /r VIV AVX512VL | Shift words in xmm2 left by amount specified in 

VPSLLW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.256.66.0F.WIG F1 /r VIV AVX512VL | Shift words in ymmz2 left by amount specified in 

VPSLLW ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512BW | xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.512.66.0F.WIG F1 /r VV AVX512BW | Shift words in zmm2 left by amount specified in 

VPSLLW zmm1 {k1}{z}, zmm2, xmm3/m128 xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.128.66.0F.WIG 71 /6 ib VV AVX512VL | Shift words in xmm2/m128 left by imm8 while 

VPSLLW xmm1 {k1}{z}, xmm2/m1 28, imm8 AVX512BW | shifting in Os using writemask k1. 

EVEX.256.66.0F.WIG 71 /6 ib VV AVX512VL | Shift words in ymm2/m256 left by imm8 while 

VPSLLW ymm1 {k1}{z}, ymm2/m256, imm8 AVX512BW | shifting in Os using writemask k1. 

EVEX.512.66.0F.WIG 71 /6 ib VV AVX512BW | Shift words in zmm2/m512 left by imm8 while 

VPSLLW zmm1 {k1}{z}, zmm2/m512, imm8 shifting in O using writemask k1. 

EVEX.128.66.0F.WO Fe /r VIV AVX512VL | Shift doublewords in xmmz left by amount 

VPSLLD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F | specified in xmm3/m1 28 while shifting in Os 
under writemask k1. 

EVEX.256.66.0F.WO Fe /r VIV AVX512VL | Shift doublewords in ymm2 left by amount 

VPSLLD ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512F | specified in xmm3/m128 while shifting in Os 
under writemask k1. 

EVEX.512.66.0F.WO Fe /r VIV AVX512F | Shift doublewords in zmm2 left by amount 

VPSLLD zmm1 {k1}{z}, zmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os 
under writemask k1. 

EVEX.128.66.0F.WO 72 /6 ib VV AVX512VL | Shift doublewords in xmm2/m128/m32bcst left 

VPSLLD xmm1 {k1}{z}, xmm2/m128/m32bcst, AVX512F | by imm8 while shifting in Os using writemask k1. 

imm8 

EVEX.256.66.0F.WO 72 /6 ib VV AVX512VL | Shift doublewords in ymm2/m256/m32bcst left 

VPSLLD ymm1 {k1}{z}, ymnm2/m256/m32bcst, AVX512F | by imm8 while shifting in Os using writemask k1. 

imm8 

EVEX.512.66.0F.WO 72 /6 ib VV AVX512F | Shift doublewords in zmm2/m51 2/m32bcst left 

VPSLLD zmm1 {k1}{z}, zmm2/m512/m32bcst, by imm8 while shifting in Os using writemask k1. 

imm8 

EVEX.128.66.0F.W1 F3 /r VIV AVX512VL | Shift quadwords in xmm2 left by amount 

VPSLLOQ xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F | specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 

EVEX.256.66.0F.W1 F3 /r VIV AVX512VL | Shift quadwords in ymm2 left by amount 

VPSLLQ ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512F | specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 

EVEX.512.66.0F.W1 F3 /r VIV AVX512F | Shift quadwords in zmm2 left by amount 


VPSLLQ zmm1 {k1}{z}, zmm2, xmm3/m128 


specified in xmm3/m128 while shifting in Os 
using writemask k1. 
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EVEX.128.66.0F.W1 73 /6 ib F VV AVX512VL | Shift quadwords in xmm2/m128/m64bcst left 
VPSLLQ xmm1 {k1}{z}, xmm2/m1 28/m64bcst, AVX512F | by imm8 while shifting in Os using writemask k1. 
imm8 

EVEX.256.66.0F.W1 73 /6 ib F VV AVX512VL | Shift quadwords in ynm2/m256/m64bcst left 
VPSLLQ ymm1 {k1}{z}, ymm2/m256/m64bcst, AVX512F | by imm8 while shifting in Os using writemask k1. 
imm8 

EVEX.512.66.0F.W1 73 /6 ib F VV AVX512F | Shift quadwords in zmm2/m512/m64bcst left 
VPSLLQ zmm1 {k1}{z}, zmm2/m51 2/m64bcst, by imm8 while shifting in Os using writemask k1. 
imm8 

NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (r, w) imm8 NA NA 
C NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
D NA VEX.vvvv (w) ModRM:r/m (r) imm8 NA 
E Full Mem EVEX.vvvv (w) ModRM:r/m (R) Imm8s NA 
F Full EVEX.vvvv (w) ModRM:r/m (R) Imm8s8 NA 
G Mem128 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Shifts the bits in the individual data elements (words, doublewords, or quadword) in the destination operand (first 
operand) to the left by the number of bits specified in the count operand (second operand). As the bits in the data 
elements are shifted left, the empty low-order bits are cleared (set to 0). If the value specified by the count 
operand is greater than 15 (for words), 31 (for doublewords), or 63 (for a quadword), then the destination operand 
is set to all Os. Figure 4-17 gives an example of shifting words in a 64-bit operand. 


Pre Shit X3 x2 x1 X0 
Shift Left | 
with Zero 
Extension | i 
eg X3 << COUNT | X2 << COUNT | X1 << COUNT | X0 << COUNT 


Figure 4-17. PSLLW, PSLLD, and PSLLQ Instruction Operation Using 64-bit Operand 


The (V)PSLLW instruction shifts each of the words in the destination operand to the left by the number of bits spec- 
ified in the count operand; the (V)PSLLD instruction shifts each of the doublewords in the destination operand; and 
the (V)PSLLQ instruction shifts the quadword (or quadwords) in the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions 64-bit operand: The destination operand is an MMX technology register; the count 
operand can be either an MMX technology register or an 64-bit memory location. 
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128-bit Legacy SSE version: The destination and first source operands are XMM registers. Bits (MAXVL-1:128) of 
the corresponding YMM destination register remain unchanged. The count operand can be either an XMM register 
or a 128-bit memory location or an 8-bit immediate. If the count operand is a memory address, 128 bits are loaded 
but the upper 64 bits are ignored. 

VEX.128 encoded version: The destination and first source operands are XMM registers. Bits (MAXVL-1:128) of the 
destination YMM register are zeroed. The count operand can be either an XMM register or a 128-bit memory loca- 
tion or an 8-bit immediate. If the count operand is a memory address, 128 bits are loaded but the upper 64 bits are 
ignored. 

VEX.256 encoded version: The destination operand is a YMM register. The source operand is a YMM register or a 
memory location. The count operand can come either from an XMM register or a memory location or an 8-bit imme- 
diate. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 

EVEX encoded versions: The destination operand is a ZMM register updated according to the writemask. The count 
operand is either an 8-bit immediate (the immediate count version) or an 8-bit value from an XMM register or a 
memory location (the variable count version). For the immediate count version, the source operand (the second 
operand) can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32/64-bit 
memory location. For the variable count version, the first source operand (the second operand) is a ZMM register, 
the second source operand (the third operand, 8-bit variable count) can be an XMM register or a memory location. 
Note: In VEX/EVEX encoded versions of shifts with an immediate count, vvvv of VEX/EVEX encode the destination 
register, and VEX.B/EVEX.B + ModRM.r/m encodes the source register. 


Note: For shifts with an immediate count (VEX.128.66.0F 71-73 /6, or EVEX.128.66.0F 71-73 /6), 
VEX.vvvv/EVEX.vvvv encodes the destination register. 


Operation 


PSLLW (with 64-bit operand) 
IF (COUNT > 15) 
THEN 
DEST[64:0] := QOOOODD0D0000000H; 
ELSE 
DEST[15:0] := ZeroExtend(DEST[15:0] << COUNT); 
(* Repeat shift operation for 2nd and 3rd words *) 
DEST[63:48] := ZeroExtend(DEST[63:48] << COUNT); 
Fl; 


PSLLD (with 64-bit operand) 

IF (COUNT > 31) 

THEN 
DEST[64:0] := QOOOOOOO00000000H; 

ELSE 
DEST[31:0] := ZeroExtend(DEST[31:0] << COUNT); 
DEST[63:32] := ZeroExtend(DEST[63:32] << COUNT); 

Fl; 


PSLLQ (with 64-bit operand) 
IF (COUNT > 63) 
THEN 
DEST[64:0] := QOOOODD0O0000000H; 
ELSE 
DEST := ZeroExtend(DEST << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_WORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0); 

IF (COUNT > 15) 

THEN 
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DEST[127:0] := OOOOOOOODDDDD0000000000000000000H 
ELSE 
DEST[15:0] := ZeroExtend(SRC[1 5:0] << COUNT); 
(* Repeat shift operation for 2nd through 7th words *) 
DEST[127:1 12] := ZeroExtend(SRC[127:112] << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_DWORDS1(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 

DEST[31:0] := 0 
ELSE 

DEST[31:0] := ZeroExtend(SRC[31:0] << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_DWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[127:0] := OOOOOOOODDDDD0000000000000000000H 
ELSE 
DEST[31:0] := ZeroExtend(SRC[31:0] << COUNT); 
(* Repeat shift operation for 2nd through 3rd words *) 
DEST[1 27:96] := ZeroExtend(SRC[127:96] << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_QWORDS1 (SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 

DEST[63:0] := O 
ELSE 

DEST[63:0] := ZeroExtend(SRC[63:0] << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_QWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 
DEST[127:0] := OOOOOOOODDDDD0000000000000000000H 
ELSE 
DEST[63:0] := ZeroExtend(SRC[63:0] << COUNT); 
DEST[1 27:64] := ZeroExtend(SRC[127:64] << COUNT); 
Fl; 
LOGICAL_LEFT_SHIFT_WORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 15) 
THEN 
DEST[1 27:0] := OOOOOOOODDDD00000000000000000000H 
DEST[255:1 28] := OOOOOOOODDDD00000000000000000000H 
ELSE 
DEST[15:0] := ZeroExtend(SRC[1 5:0] << COUNT); 
(* Repeat shift operation for 2nd through 15th words *) 
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DEST[255:240] := ZeroExtend(SRC[255:240] << COUNT); 
Fl; 


LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[127:0] := OOOOOODDDDD000000000000000000000H 
DEST[255:1 28] := OOOOOODDDDD000000000000000000000H 
ELSE 
DEST[31:0] := ZeroExtend(SRC[31:0] << COUNT); 
(* Repeat shift operation for 2nd through 7th words *) 
DEST[255:224] := ZeroExtend(SRC[255:224] << COUNT); 


Fl; 


LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 
DEST[127:0] := 00000000000000000000000000000000H 
DEST[255:128] := 00000000000000000000000000000000H 
ELSE 
DEST[63:0] := ZeroExtend(SRC[63:0] << COUNT); 
DEST[127:64] := ZeroExtend(SRC[127:64] << COUNT) 
DEST[191:128] = ZeroExtend(SRC[191:128] << COUNT); 
DEST[255:192] := ZeroExtend(SRC[255:1 92] << COUNT); 


Fl; 


VPSLLW (EVEX versions, xmm/m128) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
TMP_DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS_128b(SRC1[127:0], SRC2) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[51 1:256] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1[51 1:256], SRC2) 


Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPSLLW (EVEX versions, imm8) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


IF VL=128 
TMP_DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS_128b(SRC1[1 27:0], imm8) 
Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 
Fl; 
IF VL=512 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 
TMP_DEST[51 1:256] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1[511:256], imm8) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSLLW (ymm, ymm, xmm/m1 28) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_WORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSLLW (ymm, imm8) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_WORD_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 


VPSLLW (xmm, xmm, xmm/m1 28) - VEX.128 encoding 
DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSLLW (xmm, imm8) - VEX.128 encoding 


DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 
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PSLLW (xmm, xmm, xmm/m128) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSLLW (xmm, imm8) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_WORDS(DEST, imm8) 
DEST[MAXVL-1:128] (Unmodified) 


VPSLLD (EVEX versions, imm8) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST[i+31:i] = LOGICAL_LEFT_SHIFT_DWORDS1(SRC1 [31:0], imm8) 
ELSE DEST[i+31:i] := LOGICAL_LEFT_SHIFT_DWORDS1(SRC1[i+31:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSLLD (EVEX versions, xmm/m128) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF VL= 128 
TMP_DEST[127:0] := LOGICAL_LEFT_SHIFT_DWORDS_128b(SRC1[127:0], SRC2) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[51 1:256] := LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC1[511:256], SRC2) 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPSLLD (ymm, ymm, xmm/m1 28) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSLLD (ymm, imm8) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_DWORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 


VPSLLD (xmm, xmm, xmm/m1 28) - VEX.128 encoding 
DEST[127:0] := LOGICAL_LEFT_SHIFT_DWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSLLD (xmm, imm8) - VEX.128 encoding 
DEST[127:0] := LOGICAL_LEFT_SHIFT_DWORDS(SRC1, imms) 
DEST[MAXVL-1:128] := 0 


PSLLD (xmm, xmm, xmm/m128) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_DWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSLLD (xmm, imm8) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_DWORDS(DEST, imms) 
DEST[MAXVL-1:128] (Unmodified) 


VPSLLQ (EVEX versions, imm8) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN DEST[i+63:i] := LOGICAL_LEFT_SHIFT_QWORDS1(SRC1 [63:0], imm8) 
ELSE DEST[i+63:i] := LOGICAL_LEFT_SHIFT_QWORDS1(SRC1[i+63:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


VPSLLQ (EVEX versions, xmm/m128) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF VL= 128 
TMP_DEST[127:0] := LOGICAL_LEFT_SHIFT_QWORDS_128b(SRC1[127:0], SRC2) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC1[255:0], SRC2) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[51 1:256] := LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC1[51 1:256], SRC2) 


Fl; 
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FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSLLQ (ymm, ymm, xmm/m128) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSLLQ (ymm, imm8) - VEX.256 encoding 
DEST[255:0] := LOGICAL_LEFT_SHIFT_QWORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 


VPSLLQ (xmm, xmm, xmm/m1 28) - VEX.128 encoding 
DEST[127:0] := LOGICAL_LEFT_SHIFT_QWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSLLQ (xmm, imm8) - VEX.128 encoding 
DEST[127:0] := LOGICAL_LEFT_SHIFT_QWORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 


PSLLQ (xmm, xmm, xmm/m128) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_QWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSLLQ (xmm, imm8) 
DEST[127:0] := LOGICAL_LEFT_SHIFT_QWORDS(DEST, imm8) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalents 

VPSLLD __m512i__mm512_slli_epi32(__m512i a, unsigned int imm); 

VPSLLD __m512i__mm512_mask_slli_epi32(__m512is,__ mmask16 k,___m512i a, unsigned int imm); 
VPSLLD __m512i__mm512_maskz_slli_epi32(__ mmask16 k, __m512i a, unsigned int imm); 
VPSLLD __m256i __mm256_mask_slli_epi32(__m256is, _ mmask8 k, __m256i a, unsigned int imm); 
VPSLLD __m256i _mm256_maskz_slli_epi32(__ mmask8 k, __m256i a, unsigned int imm); 

VPSLLD __m128i_mm_mask_slli_epi32(__m128is,__ mmask8 k, __m128i a, unsigned int imm); 
VPSLLD __m128i_mm_maskz_slli_epi32(__mmask8 k, __m128i a, unsigned int imm); 

VPSLLD __m512i_mm512_sll_epi32(__m512i a,__m128i cnt); 

VPSLLD __m512i_mm512_mask_sll_epi32(__m512is,__mmask16 k,___m512i a,__m128i cnt); 
VPSLLD __m512i__mm512_maskz_sll_epi32(__mmask16 k,__m512i a,__m128i cnt); 

VPSLLD __m256i__mm256_mask_sll_epi32(__m256i s,___ mmask8 k,__ m256i a,__m128i cnt); 
VPSLLD __m256i _mm256_maskz_sll_epi32(__mmask8 k,___ m256i a, __m128i cnt); 

VPSLLD __m128i __mm_mask_sll_epi32(__m128is,___ mmask8 k,___m128i a,__m128i cnt); 
VPSLLD __m128i_mm_maskz_sll_epi32(__mmask8 k,___m128i a,__m128i cnt); 
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mm512_mask_slli_epi64(__m512i a, unsigned int imm); 


m512i 


mm512_mask_slli_epi64(__m512is,__ mmask8 k, __m512i a, unsigned int imm); 


m512i 


mm512_maskz_slli_epi64(__ mmask8 k,___m512i a, unsigned int imm); 


m256i 


m256i 


mm256_mask_slli_epi64(__m256is,__ mmask8 k, __m256i a, unsigned int imm); 
mm256_maskz_slli_epi64(__ mmask8 k, __m256i a, unsigned int imm); 


m128i 


mm_mask_slli_epi64(__m128is,__ mmask8 k, __m128i a, unsigned int imm); 


m128i 


mm_maskz_slli_epi64(__ mmask8 k, __m128i a, unsigned int imm); 


m512i 


mm512_mask_sll_epi64(__m512i a, __m128i cnt); 


m512i 


mm512_mask_sll_epi64(__m512is,__mmask8 k,__m512i a,__m128i cnt); 


m512i 


mm512_maskz_sll_epi64(__ mmask8 k,___m512ia,__m128i cnt); 


m256i 


m256i 


mm256_mask_sll_epi64(__m256is,___ mmask8 k,__ m256i a, ___m128i cnt); 
mm256_maskz_sll_epi64(__ mmask8 k,__ m256i a,__m128i cnt); 


m128i 


mm_mask_sll_epi64(__m128is,__ mmask8 k,___m128i a,__m128i cnt); 


m128i 


mm_maskz_sll_epi64(__ mmask8 k,___m128i a,__m128i cnt); 


m512i 


mm512_slli_epi16(__m512i a, unsigned int imm); 


m512i 


mm512_mask_slli_epi16(__m512is,__ mmask32 k,___m512i a, unsigned int imm); 


m512i 


mm512_maskz_slli_epi16(__ mmask32 k, __m512i a, unsigned int imm); 


m256i 


m256i 


mm256_mask_slli_epi16(__m256is,__ mmask16 k, __m256i a, unsigned int imm); 
mm256_maskz_slli_epi16(__ mmask16 k, __m256i a, unsigned int imm); 


m128i 


mm_mask_slli_epi16(__m128is,__ mmask8 k, __m128i a, unsigned int imm); 


m128i 


mm_maskz_slli_epi16(__ mmask8 k, __m128i a, unsigned int imm); 


m512i 


mm512_sll_epi16(__m512i a,__m128i cnt); 


m512i 


mm512_mask_sll_epi16(__m512is,__ mmask32 k,__m512i a,__m128i cnt); 


m512i 


mm512_maskz_sll_epi16(__mmask32 k,__m512ia,__m128i cnt); 


m256i 


m256i 


mm256_mask_sll_epi16(__m256is,__ mmask16 k,__ m256i a, ___m128i cnt); 
mm256_maskz_sll_epi16(__mmask16 k,__ m256i a,__m128i cnt); 


m128i 


mm_mask_sll_epi16(__m128is,__ mmask8 k, __m128i a,__m128i cnt); 


m128i 


mm_maskz_sll_epi16(__mmask8 k,___m128i a,__m128i cnt); 


PSLLW:__m64 _mm_slli_pi16 (__m64 m, int count) 


PSLLW:__m64 _mm_sll_pi16(__m64 m, __m64 count) 


(V)PSLLW:__m128i __mm_slli_epi16(__m64 m, int count) 


(V)PSLLW:__m128i _mm_sll_epi16(__m128i m, 


m1 28i count) 


VPSLLW:__m256i __mm256_slli_epi16 (__m256i m, int count) 


VPSLLW:__m256i __mm256_sll_epi16 (__m256i m, 


m1 28i count) 


PSLLD:__m64 _mm_slli_pi32(__m64 m, int count) 


PSLLD:__m64 _mm_sll_pi32(__m64 m, __m64 count) 


(V)PSLLD:__m128i __mm_slli_epi32(__m128i m, int count) 
(V)PSLLD:__m128i __mm_sll_epi32(__m128i m,___m128i count) 


VPSLLD:__m256i __mm256_slli_epi32 (__m256i m, int count) 


VPSLLD:__m256i __mm256_sll_epi32 (__m256i m, 


m1 28i count) 


PSLLQ:__m64 _mm_slli_si64(__m64 m, int count) 


PSLLQ:__m64 _mm_sll_si64(__m64 m, __m64 count) 


(V)PSLLQ;__m128i _mm_slli_epi64(__m128i m, int count) 
(V)PSLLQ:;__m128i _mm_sll_epi64(__m128i m, __m128i count) 
VPSLLQ:;__m256i__mm256_slli_epi64 (__m256i m, int count) 


VPSLLQ:__m256i __mm256_sll_epi64 (__m256i m, 


Flags Affected 


None. 


m1 28i count) 


Numeric Exceptions 


None. 
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Other Exceptions 
VEX-encoded instructions: 


Syntax with RM/RVM operand encoding (A/C in the operand encoding table), see Table 2-21, “Type 4 Class 
Exception Conditions”. 


Syntax with MI/VMI operand encoding (B/D in the operand encoding table), see Table 2-24, “Type 7 Class 
Exception Conditions”. 


EVEX-encoded VPSLLW (E in the operand encoding table), see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF 
Class Exception Conditions”. 


EVEX-encoded VPSLLD/Q: 


Syntax with Memi28 tuple type (G in the operand encoding table), see Exceptions Type E4NF.nb in 
Table 2-50, “Type E4NF Class Exception Conditions”. 


Syntax with Full tuple type (F in the operand encoding table), see Table 2-49, “Type E4 Class Exception Condi- 
tions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
NP OF €1 /r' A VIV MMX Shift words in mm right by mm/m64 while shifting 
PSRAW mm, mm/m64 in sign bits. 
66 OF E1 /r A VIV SSE2 Shift words in xmm7 right by xmm2/m128 while 
PSRAW xmm1, xmm2/m128 shifting in sign bits. 
NP OF 71 /4 ib! B VIV MMX Shift words in mm right by imm8 while shifting in 
PSRAW mm, imm8 sign bits 
66 OF 71 /4 ib B VIV SSE2 Shift words in xmm7 right by imm8 while shifting 
PSRAW xmm1, imm8 in sign bits 
NP OF €2 /r' A VV MMX Shift doublewords in mm right by mm/m64 while 
PSRAD mm, mm/m64 shifting in sign bits. 
66 OF E2 /r A VIV SSE2 Shift doubleword in xmm7 right by xmm2 /m128 
PSRAD xmm1, xmm2/m128 while shifting in sign bits. 
NP OF 72 /4 ib! B VV MMX Shift doublewords in mm right by imm8 while 
PSRAD mm, imm8 shifting in sign bits. 
66 OF 72 /4 ib B VIV SSE2 Shift doublewords in xmm17 right by imm8 while 
PSRAD xmm1, imm8 shifting in sign bits. 
VEX.128.66.0F.WIG E11 /r C VV AVX Shift words in xmm2 right by amount specified in 
VPSRAW xmm1, xmm2, xmm3/m128 xmm3/m128 while shifting in sign bits. 
VEX.128.66.0F.WIG 71 /4 ib D VIV AVX Shift words in xmm2 right by imm8 while shifting 
VPSRAW xmm1, xmm2, imm8 in sign bits. 
VEX.128.66.0F.WIG E2 /r C VV AVX Shift doublewords in xmm2 right by amount 
VPSRAD xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in sign 
bits. 
VEX.128.66.0F.WIG 72 /4 ib D VV AVX Shift doublewords in xmm2 right by imm8 while 
VPSRAD xmm1, xmm2, imm8 shifting in sign bits. 
VEX.256.66.0F.WIG E1 /r C VIV AVX2 Shift words in ymm2 right by amount specified in 
VPSRAW ymm1, ymm2, xmm3/m128 xmm3/m128 while shifting in sign bits. 
VEX.256.66.0F.WIG 71 /4 ib D VIV AVX2 Shift words in ymm2 right by imm8 while shifting 
VPSRAW ymm1, ymm2, imm8 in sign bits. 
VEX.256.66.0F.WIG E2 /r C VIV AVX2 Shift doublewords in ymm2 right by amount 
VPSRAD ymm1, ymm2, xmm3/m128 specified in xmm3/m128 while shifting in sign 
bits. 
VEX.256.66.0F.WIG 72 /4 ib D VIV AVX2 Shift doublewords in ymm2 right by imm8 while 
VPSRAD ymm1, ymm2, imm8 shifting in sign bits. 
EVEX.128.66.0F.WIG E1 /r G VIV AVX512VL | Shift words in xmm_2 right by amount specified in 
VPSRAW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 while shifting in sign bits using 
writemask k1. 
EVEX.256.66.0F.WIG E1 /r G VIV AVX512VL | Shift words in ymm_2 right by amount specified in 
VPSRAW ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512BW | xmm3/m128 while shifting in sign bits using 
writemask k1. 
EVEX.512.66.0F.WIG E11 /r G VIV AVX512BW | Shift words in zmm2 right by amount specified in 


VPSRAW zmm1 {k1}{z}, zmm2, xmm3/m128 


xmm3/m128 while shifting in sign bits using 
writemask k1. 
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EVEX.128.66.0F.WIG 71 /4 ib VV AVX512VL | Shift words in xmm2/m128 right by imm8 while 

VPSRAW xmm1 {k1}{z}, xmm2/m1 28, imm8 AVX512BW | shifting in sign bits using writemask k1. 

EVEX.256.66.0F.WIG 71 /4 ib VIV AVX512VL | Shift words in ymm2/m256 right by imm8 while 

VPSRAW ymm1 {k1}{z}, ymnm2/m256, imm8 AVX512BW | shifting in sign bits using writemask k1. 

EVEX.512.66.0F.WIG 71 /4 ib VV AVX512BW | Shift words in zmm2/m512 right by imm8 while 

VPSRAW zmm1 {k1}{z}, zmm2/m512, imm8 shifting in sign bits using writemask k1. 

EVEX.128.66.0F.WO E2 /r VIV AVX512VL | Shift doublewords in xmm_2 right by amount 

VPSRAD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F | specified in xmm3/m128 while shifting in sign bits 
using writemask k1. 

EVEX.256.66.0F.WO E2 /r VIV AVX512VL | Shift doublewords in ymm2 right by amount 

VPSRAD ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512F | specified in xmm3/m128 while shifting in sign bits 
using writemask k1. 

EVEX.512.66.0F.WO E2 /r VV AVX512F | Shift doublewords in zmm2 right by amount 

VPSRAD zmm1 {k1}{z}, zmm2, xmm3/m128 specified in xmm3/m1 28 while shifting in sign bits 
using writemask k1. 

EVEX.128.66.0F.WO 72 /4 ib VV AVX512VL | Shift doublewords in xmm2/m128/m32bcst right 

VPSRAD xmm1 {k1}{z}, xmm2/m128/m32bcst, AVX512F — | by imm8 while shifting in sign bits using 

imm8 writemask k1. 

EVEX.256.66.0F.WO 72 /4 ib VV AVX512VL | Shift doublewords in ynm2/m256/m32bcst right 

VPSRAD ymm1 {k1}{z}, ymm2/m256/m32bcst, AVX512F | by imm8 while shifting in sign bits using 

imm8 writemask k1. 

EVEX.512.66.0F.WO 72 /4 ib VV AVX512F _ | Shift doublewords in zmm2/m51 2/m32bcst right 

VPSRAD zmm1 {k1}{z}, zmm2/m512/m32bcst, by imm8 while shifting in sign bits using 

imm8 writemask k1. 

EVEX.128.66.0F.W1 E2 /r VIV AVX512VL_ | Shift quadwords in xmm2 right by amount 

VPSRAQ xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F — | specified in xmm3/m128 while shifting in sign bits 
using writemask k1. 

EVEX.256.66.0F.W1 E2 /r VIV AVX512VL_ | Shift quadwords in ymme2 right by amount 

VPSRAQ ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512F _ | specified in xmm3/m1 28 while shifting in sign bits 
using writemask k1. 

EVEX.512.66.0F.W1 E2 /r VIV AVX512F | Shift quadwords in zmm2 right by amount 

VPSRAQ zmm1 {k1}{z}, zmm2, xmm3/m128 specified in xmm3/m1 28 while shifting in sign bits 
using writemask k1. 

EVEX.128.66.0F.W1 72 /4 ib VV AVX512VL | Shift quadwords in xmm2/m128/m64bcst right by 

VPSRAQ xmm_1 {k1}{z}, xmm2/m128/m64bcst, AVX512F — | imm8 while shifting in sign bits using writemask 

imm8 k1. 

EVEX.256.66.0F.W1 72 /4 ib VV AVX512VL | Shift quadwords in ynm2/m256/m64bcst right by 

VPSRAQ ymm1 {k1}{z}, ynm2/m256/m64bcst, AVX512F — | imm8 while shifting in sign bits using writemask 

imm8 k1. 

EVEX.512.66.0F.W1 72 /4 ib VV AVX512F — | Shift quadwords in zmm2/m512/m64bcst right by 


VPSRAQ zmm1 {k1}{z}, zmm2/m512/m64bcst, 
imm8 


imm8 while shifting in sign bits using writemask 
k1, 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” in 
the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (r, w) imm8 NA NA 
C NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
D NA VEX.vvvv (w) ModRM:r/m (r) imm8 NA 
E Full Mem EVEX.vvvv (w) ModRM:r/m (R) Imm8 NA 
F Full EVEX.vvvv (w) ModRM:r/m (R) Imm8s NA 
G Mem128 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Shifts the bits in the individual data elements (words, doublewords or quadwords) in the destination operand (first 
operand) to the right by the number of bits specified in the count operand (second operand). As the bits in the data 
elements are shifted right, the empty high-order bits are filled with the initial value of the sign bit of the data 
element. If the value specified by the count operand is greater than 15 (for words), 31 (for doublewords), or 63 (for 
quadwords), each destination data element is filled with the initial value of the sign bit of the element. (Figure 4-18 
gives an example of shifting words in a 64-bit operand.) 


Shift Right 
with Sign 
Extension 


Post ott | x3 >> COUNT | X2>> COUNT] X1>> COUNT | X0 >> COUNT 


Figure 4-18. PSRAW and PSRAD Instruction Operation Using a 64-bit Operand 


Note that only the first 64-bits of a 128-bit count operand are checked to compute the count. If the second source 
operand is a memory address, 128 bits are loaded. 


The (V)PSRAW instruction shifts each of the words in the destination operand to the right by the number of bits 
specified in the count operand, and the (V)PSRAD instruction shifts each of the doublewords in the destination 
operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions 64-bit operand: The destination operand is an MMX technology register; the count 
operand can be either an MMX technology register or an 64-bit memory location. 


128-bit Legacy SSE version: The destination and first source operands are XMM registers. Bits (MAXVL-1:128) of 
the corresponding YMM destination register remain unchanged. The count operand can be either an XMM register 
or a 128-bit memory location or an 8-bit immediate. If the count operand is a memory address, 128 bits are loaded 
but the upper 64 bits are ignored. 


VEX.128 encoded version: The destination and first source operands are XMM registers. Bits (MAXVL-1:128) of the 
destination YMM register are zeroed. The count operand can be either an XMM register or a 128-bit memory loca- 
tion or an 8-bit immediate. If the count operand is a memory address, 128 bits are loaded but the upper 64 bits are 
ignored. 


VEX.256 encoded version: The destination operand is a YMM register. The source operand is a YMM register or a 
memory location. The count operand can come either from an XMM register or a memory location or an 8-bit 
immediate. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 
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EVEX encoded versions: The destination operand is a ZMM register updated according to the writemask. The count 
operand is either an 8-bit immediate (the immediate count version) or an 8-bit value from an XMM register or a 
memory location (the variable count version). For the immediate count version, the source operand (the second 
operand) can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32/64-bit 
memory location. For the variable count version, the first source operand (the second operand) is a ZMM register, 
the second source operand (the third operand, 8-bit variable count) can be an XMM register or a memory location. 


Note: In VEX/EVEX encoded versions of shifts with an immediate count, vvvv of VEX/EVEX encode the destination 
register, and VEX.B/EVEX.B + ModRM.r/m encodes the source register. 


Note: For shifts with an immediate count (VEX.128.66.0F 71-73 /4, EVEX.128.66.0F 71-73 /4), 


VEX.vvvv/EVEX.vvvv encodes the destination register. 


Operation 


PSRAW (with 64-bit operand) 
IF (COUNT > 15) 
THEN COUNT := 16; 
Fl; 
DEST[15:0] := Sign€xtend(DEST[15:0] >> COUNT); 
(* Repeat shift operation for 2nd and 3rd words *) 
DEST[63:48] := SignExtend(DEST[63:48] >> COUNT); 


PSRAD (with 64-bit operand) 
IF (COUNT > 31) 
THEN COUNT := 32; 
Fl; 
DEST[31:0] := SignExtend(DEST[31:0] >> COUNT); 
DEST[63:32] := SignExtend(DEST[63:32] >> COUNT); 


ARITHMETIC_RIGHT_SHIFT_DWORDS1(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[31:0] := SignBit 
ELSE 
DEST[31:0] := SignExtend(SRC[31:0] >> COUNT); 
Fl; 


ARITHMETIC_RIGHT_SHIFT_QWORDS1(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 
DEST[63:0] := SignBit 
ELSE 
DEST[63:0] := SignExtend(SRC[63:0] >> COUNT); 
Fl; 


ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0); 
IF (COUNT > 15) 

THEN  COUNT:= 16; 


Fl; 
DEST[15:0] := SignExtend(SRC[1 5:0] >> COUNT); 

(* Repeat shift operation for 2nd through 15th words *) 
DEST[255:240] := SignExtend(SRC[255:240] >> COUNT); 
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ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0); 
IF (COUNT > 31) 

THEN COUNT := 32; 


Fl; 
DEST[31:0] := SignExtend(SRC[31:0] >> COUNT); 

(* Repeat shift operation for 2nd through 7th words *) 
DEST[255:224] := SignExtend(SRC[255:224] >> COUNT); 


ARITHMETIC_RIGHT_SHIFT_QWORDS(SRC, COUNT_SRC, VL) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 

THEN COUNT := 64; 
Fl; 
DEST[63:0] := SignExtend(SRC[63:0] >> COUNT); 

(* Repeat shift operation for 2nd through 7th words *) 
DEST[VL-1:VL-64] := SignExtend(SRC[VL-1:VL-64] >> COUNT); 


ARITHMETIC_RIGHT_SHIFT_WORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 15) 

THEN COUNT := 16; 
Fl; 
DEST[15:0] := SignExtend(SRC[1 5:0] >> COUNT); 

(* Repeat shift operation for 2nd through 7th words *) 
DEST[127:112] := SignExtend(SRC[127:112] >> COUNT); 


ARITHMETIC_RIGHT_SHIFT_DWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 

THEN COUNT := 32; 
Fl; 
DEST[31:0] := SignExtend(SRC[31:0] >> COUNT); 

(* Repeat shift operation for 2nd through 3rd words *) 
DEST[1 27:96] := SignExtend(SRC[1 27:96] >> COUNT); 
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VPSRAW (EVEX versions, xmm/m1 28) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
TMP_DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_128b(SRC1[127:0], SRC2) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[511:256] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[511:256], SRC2) 


Fl; 


FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRAW (EVEX versions, imm8) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
TMP_DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_128b(SRC1[127:0], imm8) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 
TMP_DEST[511:256] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1[511:256], imms8) 


Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPSRAW (ymm, ymm, xmm/m1 28) - VEX 
DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPSRAW (ymm, imm8) - VEX 
DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_WORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0 


VPSRAW (xmm, xmm, xmm/m1 28) - VEX 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSRAW (xmm, imm8) - VEX 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 


PSRAW (xmm, xmm, xmm/m1 28) 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSRAW (xmm, imm8) 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_WORDS(DEST, imm8) 
DEST[MAXVL-1:128] (Unmodified) 


VPSRAD (EVEX versions, imm8) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN DEST[i+31:i] = ARITHMETIC_RIGHT_SHIFT_DWORDS1(SRC1 [31:0], imm8) 
ELSE DEST[i+31:i] := ARITHMETIC_RIGHT_SHIFT_DWORDS1(SRC1[i+31:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRAD (EVEX versions, xmm/m128) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF VL= 128 
TMP_DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS_128b(SRC1[1 27:0], SRC2) 
Fl; 
IF VL = 256 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 
Fl; 
IF VL=512 
TMP_DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[511:256] := ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC1[51 1:256], SRC2) 
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Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRAD (ymm, ymm, xmm/m1 28) - VEX 
DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPSRAD (ymm, imm8) - VEX 
DEST[255:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0 


VPSRAD (xmm, xmm, xmm/m1 28) - VEX 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSRAD (xmm, imm8) - VEX 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 


PSRAD (xmm, xmm, xmm/m128) 
DEST[1 27:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSRAD (xmm, imm8) 
DEST[127:0] := ARITHMETIC_RIGHT_SHIFT_DWORDS(DEST, imm8) 
DEST[MAXVL-1:128] (Unmodified) 


VPSRAQ (EVEX versions, imm8) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST[i+63:i] = ARITHMETIC_RIGHT_SHIFT_QWORDS1(SRC1[63:0], imm8) 
ELSE DEST[i+63:i] := ARITHMETIC_RIGHT_SHIFT_QWORDS 1 (SRC1[i+63:i], imm8) 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 


DEST[i+63:i] := 0 
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Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPSRAQ (EVEX versions, xmm/m1 28) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
TMP_DEST[VL-1:0] := ARITHMETIC_RIGHT_SHIFT_QWORDS(SRC1[VL-1:0], SRC2, VL) 


FOR j :=OTO7 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 

VPSRAD __m512i_mm512_srai_epi32(__m512i a, unsigned int imm); 
VPSRAD __m512i_mm512_mask_srai_epi32(__m512is,__ mmask16 k,__m512i a, unsigned int imm); 
VPSRAD __m512i_mm512_maskz_srai_epi32(__mmask16 k,___m512i a, unsigned int imm); 
VPSRAD __m256i __mm256_mask_srai_epi32(__m256i s,___ mmask8 k, __ m256i a, unsigned int imm); 
VPSRAD __m256i__mm256_maskz_srai_epi32(__mmask8 k, __m256i a, unsigned int imm); 

VPSRAD __m128i__mm_mask_srai_epi32(__m128i s,__ mmask8 k, __m128i a, unsigned int imm); 
VPSRAD __m128i __mm_maskz_srai_epi32(__mmask8 k, __m128i a, unsigned int imm); 

VPSRAD __m512i_mm512_sra_epi32(__m512i a, __m128i cnt); 

VPSRAD __m512i_mm512_mask_sra_epi32(__m512is,__ mmask16 k,__m512ia,__m128i cnt); 
VPSRAD __m512i_mm512_maskz_sra_epi32(__mmask16 k,__m512i a,__m128i cnt); 

VPSRAD __m256i__mm256_mask_sra_epi32(__m256is,__ mmask8 k,___ m256i a, ___m128i cnt); 
VPSRAD __m256i__mm256_maskz_sra_epi32(__mmask8 k,__ m256i a, ___m128i cnt); 

VPSRAD __m128i__mm_mask_sra_epi32(__m128i s,___ mmask8 k,___m128i a, __m128i cnt); 
VPSRAD __m128i__mm_maskz_sra_epi32(__mmask8 k,__m128i a,__m128i cnt); 

VPSRAQ __m512i_mm512_srai_epi64(__m512i a, unsigned int imm); 

VPSRAQ __m512i__mm512_mask_srai_epi64(__m512i s, __ mmask8 k, __m512i a, unsigned int imm) 
VPSRAQ __m512i__mm512_maskz_srai_epi64(_mmask8 k, __m512i a, unsigned int imm) 

VPSRAQ __m256i _mm256_mask_srai_epi64(__m256i s, __ mmask8 k, __m256i a, unsigned int imm); 
VPSRAQ __m256i _mm256_maskz_srai_epi64(__mmask8 k, __m256i a, unsigned int imm); 

VPSRAQ __m128i __mm_mask_srai_epi64(__m128i s, __mmask8 k, __m128i a, unsigned int imm); 
VPSRAQ __m128i __mm_maskz_srai_epi64(__mmask8 k, __m128i a, unsigned int imm); 

VPSRAQ __m512i_mm512_sra_epi64(__m512i a, __m128i cnt); 

VPSRAQ __m512i__mm512_mask_sra_epi64(__m512is, __ mmask8 k, __m512i a,__m128i cnt) 
VPSRAQ __m512i_mm512_maskz_sra_epi64(__mmask8 k, __m512i a,__m128i cnt) 

VPSRAQ __m256i _mm256_mask_sra_epi64(__m256i s,___ mmask8 k, __m256i a, __m128i cnt); 
VPSRAQ __m256i _mm256_maskz_sra_epi64(__mmask8 k, __m256i a, __m128i cnt); 

VPSRAQ __m128i __mm_mask_sra_epi64(__m128i s, __mmask8 k, __m128i a, __m128i cnt); 
VPSRAQ __m128i __mm_maskz_sra_epi64(__mmask8 k, __m128i a, ___m128i cnt); 

VPSRAW __m512i_mm512_srai_epi16(__m512i a, unsigned int imm); 
VPSRAW __m512i_mm512_mask_srai_epi16(__m512is,___ mmask32 k, 


m512i a, unsigned int imm); 
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VPSRAW __m512i_mm512_maskz_srai_epi16(__mmask32 k, __m512i a, unsigned int imm); 


VPSRAW __m256i __mm256_mask_srai_epi16(__m256i s, 


mmask16 k, __m256i a, unsigned int imm); 


VPSRAW __m256i__mm256_maskz_srai_epi16(__mmask16 k, __m256i a, unsigned int imm); 


VPSRAW __m128i __mm_mask_srai_epi16(__m128is, 


mmask8 k, __m128i a, unsigned int imm); 


VPSRAW __m128i__mm_maskz_srai_epi16(__mmask8 k, 


m1 28i a, unsigned int imm); 


VPSRAW __m512i_mm512_sra_epi16( 
VPSRAW __m512i_mm512_mask_sra_epi16(__m512is, 


m512ia,__m128i cnt); 


mmask16 k,__m512ia,__m128i cnt); 


VPSRAW __m512i_mm512_maskz_sra_epi16(__mmask16 k,___m512i a,__m128i cnt); 


VPSRAW __m256i__mm256_mask_sra_epi16(__m256is, 


mmask8 k,__ m256i a,__m128i cnt); 


VPSRAW __m256i__mm256_maskz_sra_epi16(__mmask8 k,___ m256i a,__m128i cnt); 


VPSRAW __m128i__mm_mask_sra_epi1 6( 


m128is,__mmask8 k,___m128i a,__m128i cnt); 


VPSRAW __m128i __mm_maskz_sra_epi16(__mmask8 k, 


m128i a,__m128i cnt); 


PSRAW:__m64 _mm_srai_pi16 (__m64 m, int count) 


PSRAW:__m64 _mm_sra_pi16 (__m64 m, 


m64 count) 


(V)PSRAW:__m128i __mm_srai_epi16( 


(V)PSRAW:__m128i __mm_sra_epi16( 


m128i m, int count) 
m128i m, ___m128i count) 


VPSRAW:__m256i __mm256_srai_epi16 (__m256i m, int count) 


VPSRAW:__m256i __mm256_sra_epi16 ( 


m256i m, __m128i count) 


PSRAD:__m64 _mm_srai_pi32 (__m64 m, int count) 


PSRAD:__m64 _mm_sra_pi32 (__m64 m, 
(V)PSRAD:__m128i __mm_srai_epi32 ( 


(V)PSRAD:__m128i __mm_sra_epi32 ( 


VPSRAD:__m256i __mm256_srai_epi32 ( 


m64 count) 


m128i m, int count) 
m128i m, 


m1 28i count) 
m256i m, int count) 


VPSRAD:__m256i __mm256_sra_epi32 ( 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
VEX-encoded instructions: 


m256i m, __m128i count) 


Syntax with RM/RVM operand encoding (A/C in the operand encoding table), see Table 2-21, “Type 4 Class 


Exception Conditions”. 


Syntax with MI/VMI operand encoding (B/D in the operand encoding table), see Table 2-24, “Type 7 Class 


Exception Conditions”. 


EVEX-encoded VPSRAW (E in the operand encoding table), see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF 


Class Exception Conditions”. 


EVEX-encoded VPSRAD/Q: 


Syntax with Memi28 tuple type (G in the operand encoding table), see Exceptions Type E4NF.nb in 
Table 2-50, “Type E4NF Class Exception Conditions”. 


Syntax with Full tuple type (F in the operand encoding table), see Table 2-49, “Type E4 Class Exception Condi- 


tions”. 
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Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
66 OF 73 /3 ib A VIV SSE2 Shift xmm7 right by imm8 while shifting in Os. 
PSRLDQ xmm17, imm8 
VEX.128.66.0F.WIG 73 /3 ib B VN AVX Shift xmm2 right by imm8 bytes while shifting in 
VPSRLDQ xmm1, xmm2, imm8 Os. 
VEX.256.66.0F.WIG 73 /3 ib B VN AVX2 Shift ymm7 right by imm8 bytes while shifting in 
VPSRLDQ ymm1, ymm2, imm8 Os. 
EVEX.128.66.0F.WIG 73 /3 ib C VN AVX512VL_ | Shift xmm2/m128 right by imm8 bytes while 
VPSRLDQ xmm1, xmm2/m1 28, imm8 AVX512BW | shifting in Os and store result in xmm1. 
EVEX.256.66.0F.WIG 73 /3 ib C VN AVX512VL_ | Shift ymnm2/m256 right by imm8 bytes while 
VPSRLDQ ymm1, ymm2/m256, imm8 AVX512BW | shifting in Os and store result in ymm1. 
EVEX.512.66.0F.WIG 73 /3 ib C VIN AVX512BW | Shift zmm2/m512 right by imm8 bytes while 
VPSRLDQ zmm1, zmm2/m512, imm8 shifting in Os and store result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (r, w) imm8s NA NA 
B NA VEX.vvvv (w) ModRM:r/m (r) imm8 NA 
C Full Mem EVEX.vvvv (w) ModRM:r/m (R) Imm8 NA 
Description 


Shifts the destination operand (first operand) to the right by the number of bytes specified in the count operand 
(second operand). The empty high-order bytes are cleared (set to all Os). If the value specified by the count 
operand is greater than 15, the destination operand is set to all Os. The count operand is an 8-bit immediate. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


128-bit Legacy SSE version: The source and destination operands are the same. Bits (MAXVL-1:128) of the corre- 
sponding YMM destination register remain unchanged. 


VEX.128 encoded version: The source and destination operands are XMM registers. Bits (MAXVL-1:128) of the 
destination YMM register are zeroed. 


VEX.256 encoded version: The source operand is a YMM register. The destination operand is a YMM register. The 
count operand applies to both the low and high 128-bit lanes. 


VEX.256 encoded version: The source operand is YMM register. The destination operand is an YMM register. Bits 
(MAXVL-1:256) of the corresponding ZMM register are zeroed. The count operand applies to both the low and high 
128-bit lanes. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operand is a ZMM/YMM/XMM register. The count operand applies to each 128-bit lanes. 


Note: VEX.vvvv/EVEX.vvvv encodes the destination register. 
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Operation 

VPSRLDQ (EVEX.512 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; FI 
DEST[127:0] := SRC[127:0] >> (TEMP * 8) 
DEST[255:128] := SRC[255:128] >> (TEMP * 8) 
DEST[383:256] := SRC[383:256] >> (TEMP * 8) 
DEST[511:384] := SRC[511:384] >> (TEMP * 8) 
DEST[MAXVL-1:512] := 0; 


VPSRLDQ (VEX.256 and EVEX.256 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; FI 

DEST[127:0] := SRC[127:0] >> (TEMP * 8) 
DEST[255:128] := SRC[255:128] >> (TEMP * 8) 
DEST[MAXVL-1:256] := 0; 


VPSRLDQ (VEX.128 and EVEX.128 encoded version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; FI 

DEST := SRC >> (TEMP * 8) 

DEST[MAXVL-1:128] := 0; 


PSRLDQ(128-bit Legacy SSE version) 
TEMP := COUNT 

IF (TEMP > 15) THEN TEMP := 16; Fl 
DEST := DEST >> (TEMP * 8) 
DEST[MAXVL- 1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalents 


(V)PSRLDQ __m128i _mm_srli_si128 (__m128i a, int imm) 
VPSRLDQ __m256i__mm256_bsrli_epi128 (__m256i, const int) 
VPSRLDQ __m512i__mm512_bsrli_epi128 (__m512i, int) 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-24, “Type 7 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF D1 /r' A VIV MMX Shift words in mmright by amount specified in 
PSRLW mm, mm/m64 mm/m64 while shifting in Os. 
66 OF D1 /r A VIV SSE2 Shift words in xmm7 right by amount 
PSRLW xmm1, xmm2/m128 specified in xmm2/m1 28 while shifting in Os. 
NP OF 71 /2 ib! B VIV MMX Shift words in mmright by imm8 while shifting 
PSRLW mm, imm8 in Os. 
66 OF 71 /2 ib B VIV SSE2 Shift words in xmm7 right by imm8 while 
PSRLW xmm1, imm8 shifting in Os. 
NP OF D2 /r' A VV MMX Shift doublewords in mm right by amount 
PSRLD mm, mm/m64 specified in mm/m64 while shifting in Os. 
66 OF D2 /r A VIV SSE2 Shift doublewords in xmm7 right by amount 
PSRLD xmm1, xmm2/m128 specified in xmm2 /m128 while shifting in Os. 
NP OF 72/2 ib! B VIV MMX Shift doublewords in mm right by imm8 while 
PSRLD mm, imm8 shifting in Os. 
66 OF 72 /2 ib B VIV SSE2 Shift doublewords in xmm7 right by imm8 
PSRLD xmm1, imm8 while shifting in Os. 
NP OF D3 /r' A VN MMX Shift mm right by amount specified in 
PSRLQ mm, mm/m64 mm/m64 while shifting in Os. 
66 OF D3 /r A VV SSE2 Shift quadwords in xmm7 right by amount 
PSRLO xmm1, xmm2/m128 specified in xmm2/m128 while shifting in Os. 
NP OF 73/2 ib! B VIV MMX Shift mm right by imm8 while shifting in Os. 
PSRLOQ mm, imm8 
66 OF 73 /2 ib B VIV SSE2 Shift quadwords in xmm7 right by imm8 while 
PSRLO xmm1, imm8 shifting in Os. 
VEX.128.66.0F.WIG D1 /r C VV AVX Shift words in xmm2 right by amount 
VPSRLW xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 71 /2 ib D VV AVX Shift words in xmm_2 right by imm8 while 
VPSRLW xmm1, xmm2, imm8 shifting in Os. 
VEX.128.66.0F.WIG D2 /r C VV AVX Shift doublewords in xmm2 right by amount 
VPSRLD xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 72 /2 ib D VIV AVX Shift doublewords in xmm2 right by imm8 
VPSRLD xmm1, xmm2, imm8 while shifting in Os. 
VEX.128.66.0F.WIG D3 /r C VIV AVX Shift quadwords in xmm2 right by amount 
VPSRLO xmm1, xmm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 
VEX.128.66.0F.WIG 73 /2 ib D VIV AVX Shift quadwords in xmm2 right by imm8 while 
VPSRLQ xmm1, xmm2z, imm8 shifting in Os. 
VEX.256.66.0F.WIG D1 /r C VIN AVX2 Shift words in ymm2 right by amount specified 
VPSRLW ymm 1, ymm2, xmm3/m128 in xmm3/m128 while shifting in Os. 
VEX.256.66.0F.WIG 71 /2 ib D VV AVX2 Shift words in ymme2 right by imm8 while 


VPSRLW ymm7, ymm2, imm8 


shifting in Os. 
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VEX.256.66.0F.WIG D2 /r VIV AVX2 Shift doublewords in ymm2 right by amount 

VPSRLD ymm1, ymm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 

VEX.256.66.0F.WIG 72 /2 ib VV AVX2 Shift doublewords in ymm2 right by imm8 

VPSRLD ymm1, ymm2, imm8 while shifting in Os. 

VEX.256.66.0F.WIG D3 /r VIV AVX2 Shift quadwords in ymm2 right by amount 

VPSRLO ymm1, ymm2, xmm3/m128 specified in xmm3/m128 while shifting in Os. 

VEX.256.66.0F.WIG 73 /2 ib VV AVX2 Shift quadwords in ymm2 right by imm8 while 

VPSRLO ymm1, ymm2, imm8 shifting in Os. 

EVEX.128.66.0F.WIG D1 /r VIV AVX512VL | Shift words in xmm2 right by amount specified 

VPSRLW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | in xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.256.66.0F.WIG D1 /r VIV AVX512VL | Shift words in ymm2 right by amount specified 

VPSRLW ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512BW | in xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.512.66.0F.WIG D1 /r VIV AVX512BW | Shift words in zmm2 right by amount specified 

VPSRLW zmm1 {k1}{z}, zmm2, xmm3/m128 in xmm3/m128 while shifting in Os using 
writemask k1. 

EVEX.128.66.0F.WIG 71 /2 ib VV AVX512VL_ | Shift words in xmm2/m128 right by imm8 

VPSRLW xmm1 {k1}{z}, xmm2/m128, imm8 AVX512BW | while shifting in Os using writemask k1. 

EVEX.256.66.0F.WIG 71 /2 ib VV AVX512VL | Shift words in ymm2/m256 right by imm8 

VPSRLW ymm1 {k1}{z}, ynm2/m256, imm8 AVX512BW | while shifting in Os using writemask k1. 

EVEX.512.66.0F.WIG 71 /2 ib VV AVX512BW | Shift words in zmm2/m512 right by imm8 

VPSRLW zmm1 {k1}{z}, zmm2/m51 2, imm8 while shifting in Os using writemask k1. 

EVEX.128.66.0F.WO D2 /r VIV AVX512VL | Shift doublewords in xmm_2 right by amount 

VPSRLD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F specified in xmm3/m128 while shifting in Os 
using writemask k1. 

EVEX.256.66.0F.WO D2 /r VIV AVX512VL | Shift doublewords in ymm_2 right by amount 

VPSRLD ymm1 {k1}{z}, ynm2, xmm3/m128 AVX512F specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 

EVEX.512.66.0F.WO D2 /r VIV AVX512F Shift doublewords in zmm2 right by amount 

VPSRLD zmm1 {k1}{z}, zmm2, xmm3/m128 specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 

EVEX.128.66.0F.WO 72 /2 ib VV AVX512VL_ | Shift doublewords in xmm2/m128/m32bcst 

VPSRLD xmm1 {k1}{z}, xmm2/m1 28/m32bcst, AVX512F right by imm8 while shifting in Os using 

imm8 writemask k1. 

EVEX.256.66.0F.WO 72 /2 ib VV AVX512VL_ | Shift doublewords in ynm2/m256/m32bcst 

VPSRLD ymm1 {k1}{z}, ynm2/m256/m32bcst, AVX512F right by imm8 while shifting in Os using 

imm8 writemask k1. 

EVEX.512.66.0F,.WO 72 /2 ib VV AVX512F Shift doublewords in zmm2/m512/m32bcst 

VPSRLD zmm1 {k1}{z}, zmm2/m512/m32bcst, right by imm8 while shifting in Os using 

imm8 writemask k1. 

EVEX.128.66.0F.W1 D3 /r VIV AVX512VL | Shift quadwords in xmm2 right by amount 

VPSRLQ xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512F specified in xmm3/m128 while shifting in Os 
using writemask k1. 

EVEX.256.66.0F.W1 D3 /r VIN AVX512VL | Shift quadwords in ymme right by amount 

VPSRLQ ymm1 {k1}{z}, ymm2, xmm3/m128 AVX512F specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 

EVEX.512.66.0F.W1 D3 /r VIV AVX512F Shift quadwords in zmm2 right by amount 


VPSRLQ zmm1 {k1}{z}, zmm2, xmm3/m1 28 


specified in xmm3/m1 28 while shifting in Os 
using writemask k1. 
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EVEX.128.66.0F.W1 73 /2 ib F VV AVX512VL | Shift quadwords in xmm2/m128/m64bcst 
VPSRLQ xmm1 {k1}{z}, xmm2/m128/m64bcst, AVX512F right by imm8 while shifting in Os using 
imm8 writemask k1. 

EVEX.256.66.0F.W1 73 /2 ib F VV AVX512VL | Shift quadwords in ynm2/m256/m64bcst 
VPSRLQ ymm1 {k1}{z}, ymnm2/m256/m64bcst, AVX512F right by imm8 while shifting in Os using 
imm8 writemask k1. 

EVEX.512.66.0F.W1 73 /2 ib F VV AVX512F Shift quadwords in zmm2/m512/m64bcst 
VPSRLQ zmm1 {k1}{z}, zmm2/m512/m64bcst, right by imm8 while shifting in Os using 
imm8 writemask k1. 

NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:r/m (r, w) imm8 NA NA 
C NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
D NA VEX.vvvv (w) ModRM:r/m (r) imm8 NA 
E Full Mem EVEX.vvvv (w) ModRM:r/m (R) Imm8s NA 
F Full EVEX.vvvv (w) ModRM:r/m (R) Imm8s NA 
G Mem128 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Shifts the bits in the individual data elements (words, doublewords, or quadword) in the destination operand (first 
operand) to the right by the number of bits specified in the count operand (second operand). As the bits in the data 
elements are shifted right, the empty high-order bits are cleared (set to 0). If the value specified by the count 
operand is greater than 15 (for words), 31 (for doublewords), or 63 (for a quadword), then the destination operand 
is set to all Os. Figure 4-19 gives an example of shifting words in a 64-bit operand. 


Note that only the low 64-bits of a 128-bit count operand are checked to compute the count. 


oe x3 x2 x1 x0 
Shift Right | 
with Zero 
Extension | | 
ers X3 >> COUNT | X2 >> COUNT | X1 >> COUNT | X0 >> COUNT 


Figure 4-19. PSRLW, PSRLD, and PSRLQ Instruction Operation Using 64-bit Operand 


The (V)PSRLW instruction shifts each of the words in the destination operand to the right by the number of bits 
specified in the count operand; the (V)PSRLD instruction shifts each of the doublewords in the destination operand; 
and the PSRLQ instruction shifts the quadword (or quadwords) in the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instruction 64-bit operand: The destination operand is an MMX technology register; the count operand 
can be either an MMX technology register or an 64-bit memory location. 
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128-bit Legacy SSE version: The destination operand is an XMM register; the count operand can be either an XMM 
register or a 128-bit memory location, or an 8-bit immediate. If the count operand is a memory address, 128 bits 
are loaded but the upper 64 bits are ignored. Bits (MAXVL-1:128) of the corresponding YMM destination register 
remain unchanged. 

VEX.128 encoded version: The destination operand is an XMM register; the count operand can be either an XMM 
register or a 128-bit memory location, or an 8-bit immediate. If the count operand is a memory address, 128 bits 
are loaded but the upper 64 bits are ignored. Bits (MAXVL-1:128) of the destination YMM register are zeroed. 
VEX.256 encoded version: The destination operand is a YMM register. The source operand is a YMM register or a 
memory location. The count operand can come either from an XMM register or a memory location or an 8-bit imme- 
diate. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 

EVEX encoded versions: The destination operand is a ZMM register updated according to the writemask. The count 
operand is either an 8-bit immediate (the immediate count version) or an 8-bit value from an XMM register or a 
memory location (the variable count version). For the immediate count version, the source operand (the second 
operand) can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32/64-bit 
memory location. For the variable count version, the first source operand (the second operand) is a ZMM register, 
the second source operand (the third operand, 8-bit variable count) can be an XMM register or a memory location. 
Note: In VEX/EVEX encoded versions of shifts with an immediate count, vvvv of VEX/EVEX encode the destination 
register, and VEX.B/EVEX.B + ModRM.r/m encodes the source register. 


Note: For shifts with an immediate count (VEX.128.66.0F 71-73 /2, or EVEX.128.66.0F 71-73 /2), 
VEX.vvvv/EVEX.vvvv encodes the destination register. 


Operation 


PSRLW (with 64-bit operand) 
IF (COUNT > 15) 
THEN 
DEST[64:0] := OOOOOOOD00000000H 
ELSE 
DEST[15:0] := ZeroExtend(DEST[1 5:0] >> COUNT); 
(* Repeat shift operation for 2nd and 3rd words *) 
DEST[63:48] := ZeroExtend(DEST[63:48] >> COUNT); 
Fl; 


PSRLD (with 64-bit operand) 

IF (COUNT > 31) 

THEN 
DEST[64:0] := QOOOOOOO00000000H 

ELSE 
DEST[31:0] := ZeroExtend(DEST[31:0] >> COUNT); 
DEST[63:32] := ZeroExtend(DEST[63:32] >> COUNT); 

Fl; 


PSRLQ (with 64-bit operand) 
IF (COUNT > 63) 
THEN 
DEST[64:0] := OOOOOD0D00000000H 
ELSE 
DEST := ZeroExtend(DEST >> COUNT); 
Fl; 
LOGICAL_RIGHT_SHIFT_DWORDS1(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[31:0] := 0 
ELSE 
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DEST[31:0] := ZeroExtend(SRC[31:0] >> COUNT); 
Fl; 


LOGICAL_RIGHT_SHIFT_QWORDS1(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 
DEST[63:0] := 0 
ELSE 
DEST[63:0] := ZeroExtend(SRC[63:0] >> COUNT); 
Fl; 
LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 15) 
THEN 
DEST[255:0] := 0 
ELSE 
DEST[15:0] := ZeroExtend(SRC[1 5:0] >> COUNT); 
(* Repeat shift operation for 2nd through 15th words *) 
DEST[255:240] := ZeroExtend(SRC[255:240] >> COUNT); 


Fl; 


LOGICAL_RIGHT_SHIFT_WORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 15) 
THEN 
DEST[127:0] := OOOOOOOODDDD00000000000000000000H 
ELSE 
DEST[15:0] := ZeroExtend(SRC[1 5:0] >> COUNT); 
(* Repeat shift operation for 2nd through 7th words *) 
DEST[127:1 12] := ZeroExtend(SRC[127:112] >> COUNT); 
Fl; 


LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[255:0] := 0 
ELSE 
DEST[31:0] := ZeroExtend(SRC[31:0] >> COUNT); 
(* Repeat shift operation for 2nd through 3rd words *) 
DEST[255:224] := ZeroExtend(SRC[255:224] >> COUNT); 
Fl; 


LOGICAL_RIGHT_SHIFT_DWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 31) 
THEN 
DEST[127:0] := OOOOOOOODDDD00000000000000000000H 
ELSE 
DEST[31:0] := ZeroExtend(SRC[31:0] >> COUNT); 
(* Repeat shift operation for 2nd through 3rd words *) 
DEST[1 27:96] := ZeroExtend(SRC[127:96] >> COUNT); 
Fl; 
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LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 
IF (COUNT > 63) 
THEN 
DEST[255:0] := 0 
ELSE 
DEST[63:0] := ZeroExtend(SRC[63:0] >> COUNT); 
DEST[127:64] := ZeroExtend(SRC[1 27:64] >> COUNT); 
DEST[191:128] := ZeroExtend(SRC[191:128] >> COUNT); 
DEST[255:192] := ZeroExtend(SRC[255:192] >> COUNT); 
Fl; 


LOGICAL_RIGHT_SHIFT_QWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC[63:0]; 

IF (COUNT > 63) 

THEN 


DEST[127:0] := OOOOOOODDDDD00000000000000000000H 


ELSE 
DEST[63:0] := ZeroExtend(SRC[63:0] >> COUNT); 
DEST[127:64] := ZeroExtend(SRC[1 27:64] >> COUNT); 
Fl; 


VPSRLW (EVEX versions, xmm/m1 28) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


IF VL= 128 
TMP_DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS_128b(SRC1[127:0], SRC2) 
Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 
Fl; 
IFVL=512 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[51 1:256] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[511:256], SRC2) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] := TMP_DEST[i+1 5:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+1 5:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPSRLW (EVEX versions, imm8) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
TMP_DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS_128b(SRC1[127:0], imm8) 


Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 


Fl; 

IF VL=512 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[255:0], imm8) 
TMP_DEST[51 1:256] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1[511:256], imm8) 


Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRLW (ymm, ymm, xmm/m1 28) - VEX.256 encoding 
DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSRLW (ymm, imm8) - VEX.256 encoding 
DEST[255:0] := LOGICAL_RIGHT_SHIFT_WORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 


VPSRLW (xmm, xmm, xmm/m128) - VEX.128 encoding 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSRLW (xmm, imm8) - VEX.128 encoding 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 


PSRLW (xmm, xmm, xmm/m128) 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSRLW (xmm, imm8) 


DEST[127:0] := LOGICAL_RIGHT_SHIFT_WORDS(DEST, imms) 
DEST[MAXVL-1:1 28] (Unmodified) 
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VPSRLD (EVEX versions, xmm/m128) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF VL= 128 
TMP_DEST[127:0] := LOGICAL_RIGHT_SHIFT_DWORDS_128b(SRC1[127:0], SRC2) 
Fl; 
IF VL = 256 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 
Fl; 
IF VL=512 
TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[51 1:256] := LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC1[51 1:256], SRC2) 
Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRLD (EVEX versions, imm8) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST[i+31:i] = LOGICAL_RIGHT_SHIFT_DWORDS1(SRC1[31:0], imm8) 
ELSE DEST[i+31:i] := LOGICAL_RIGHT_SHIFT_DWORDS1(SRC1[i+31:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRLD (ymm, ymm, xmm/m128) - VEX.256 encoding 
DEST[255:0] := LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSRLD (ymm, imm8) - VEX.256 encoding 


DEST[255:0] := LOGICAL_RIGHT_SHIFT_DWORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 
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VPSRLD (xmm, xmm, xmm/m1 28) - VEX.128 encoding 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_DWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSRLD (xmm, imm8) - VEX.128 encoding 
DEST[1 27:0] := LOGICAL_RIGHT_SHIFT_DWORDS(SRC1, imms) 
DEST[MAXVL-1:128] := 0 


PSRLD (xmm, xmm, xmm/m128) 
DEST[1 27:0] := LOGICAL_RIGHT_SHIFT_DWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSRLD (xmm, imm8) 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_DWORDS(DEST, imms) 
DEST[MAXVL-1:128] (Unmodified) 


VPSRLQ (EVEX versions, xmm/m128) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1[255:0], SRC2) 
TMP_DEST[511:256] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1[51 1:256], SRC2) 


IF VL= 128 

TMP_DEST[127:0] := LOGICAL_RIGHT_SHIFT_QWORDS_128b(SRC1[127:0], SRC2) 
Fl; 
IF VL = 256 

TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1[255:0], SRC2) 
Fl; 
IF VL=512 

TMP_DEST[255:0] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1[255:0], SRC2) 

TMP_DEST[51 1:256] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1[511:256], SRC2) 
Fl; 
FOR j := 0 TO KL-1 

i:=j* 64 

IF k1[j] OR *no writemask* 

THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 

Fl; 

ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPSRLQ (EVEX versions, imm8) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST[i+63:i] = LOGICAL_RIGHT_SHIFT_QWORDS1(SRC1[63:0], imm8) 
ELSE DEST[i+63:i] := LOGICAL_RIGHT_SHIFT_QWORDS1(SRC1[i+63:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSRLQ (ymm, ymm, xmm/m1 28) - VEX.256 encoding 
DEST[255:0] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0; 


VPSRLQ (ymm, imm8) - VEX.256 encoding 

DEST[255:0] := LOGICAL_RIGHT_SHIFT_QWORDS_256b(SRC1, imm8) 
DEST[MAXVL-1:256] := 0; 

VPSRLQ (xmm, xmm, xmm/m1 28) - VEX.128 encoding 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_QWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPSRLQ (xmm, imm8) - VEX.128 encoding 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_QWORDS(SRC1, imm8) 
DEST[MAXVL-1:128] := 0 


PSRLQ (xmm, xmm, xmm/m128) 
DEST[1 27:0] := LOGICAL_RIGHT_SHIFT_QWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


PSRLQ (xmm, imm8) 
DEST[127:0] := LOGICAL_RIGHT_SHIFT_QWORDS(DEST, imm8) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalents 

VPSRLD __m512i__mm512_srli_epi32(__m512i a, unsigned int imm); 

VPSRLD __m512i__mm512_mask_srli_epi32(__m512i s,__ mmask16 k,___m512i a, unsigned int imm); 
VPSRLD __m512i__mm512_maskz_srli_epi32(__mmask16 k, __m512i a, unsigned int imm); 
VPSRLD __m256i __mm256_mask_srli_epi32(__m256i s,___ mmask8 k, __ m256i a, unsigned int imm); 
VPSRLD __m256i _mm256_maskz_srli_epi32(__mmask8 k, __m256i a, unsigned int imm); 

VPSRLD __m128i _mm_mask_srli_epi32(__m128i s,___ mmask8 k, __m128i a, unsigned int imm); 
VPSRLD __m128i _mm_maskz_srli_epi32(__mmask8 k, __m128i a, unsigned int imm); 

VPSRLD __m512i_mm512_srl_epi32(__m512i a, ___m128i cnt); 

VPSRLD __m512i_mm512_mask_srl_epi32(__m512is,__ mmask16 k,__m512ia,__m128i cnt); 
VPSRLD __m512i__mm512_maskz_srl_epi32(__mmask16 k,__m512i a, ___m128i cnt); 

VPSRLD __m256i __mm256_mask_srl_epi32(__m256i s,__ mmask8 k,___ m256i a, __m128i cnt); 
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VPSRLD __m256i __mm256_maskz_srl_epi32(__mmask8 k,__ m256i a, 
mmask8 k,___m128i a,__m128i cnt); 


VPSRLD __m128i _mm_mask_srl_epi32(__m128is, 
VPSRLD __m128i __mm_maskz_srl_epi32(__mmask8 k, 


m128i a, 


VPSRLQ __m512i_mm512_srli_epi64(__m512i a, unsigned int imm); 
VPSRLQ ___m512i__mm512_mask_srli_epi64(__m512is, __ mmask8 k, 
VPSRLQ ___m512i__mm512_mask_srli_epi64(__mmask8 k, __m512i a, unsigned int imm); 
VPSRLQ ___m256i __mm256_mask_srli_epi64(__m256i s,___ mmask8 k, 
VPSRLQ __m256i _mm256_maskz_srli_epi64(___mmask8 k, __m256i a, unsigned int imm); 

m1 28i a, unsigned int imm); 
m1 28i a, unsigned int imm); 


VPSRLQ ___m128i__mm_mask_srli_epi64(__m128i s,__mmask8 k, 
VPSRLQ __m128i__mm_maskz_srli_epi64(__mmask8 k, 
VPSRLQ__m512i_mm512_srl_epi64(__m512i a, __m128i cnt); 


VPSRLQ ___m512i__mm512_mask_srl_epi64(__m512i s,___mmask8 k, __m512i a, ___m128i cnt); 
VPSRLQ___m512i_mm512_mask_srl_epi64(__mmask8 k,__m512i a, 
VPSRLQ ___m256i _mm256_mask_srl_epi64(__m256i s,___mmask8 k, __m256i a, ___m128i cnt); 
m256i a, 
VPSRLQ ___m128i __mm_mask_srl_epi64(__m128i s, __mmask8 k, __m128i a, __m128i cnt); 


VPSRLQ __m256i __mm256_maskz_srl_epi64(__mmask8 k, 


VPSRLQ __m128i __mm_maskz_srl_epi64(__mmask8 k, __m128i a, 


VPSRLW __m512i__mm512_srli_epi16(__m512i a, unsigned int imm); 

VPSRLW __m512i__mm512_mask_srli_epi16(__m512i s,__ mmask32 k,___m512i a, unsigned int imm); 
VPSRLW __m512i __mm512_maskz_srli_epi16(__mmask32 k,__m512i a, unsigned int imm); 
VPSRLW __m256i _mm256_mask_srli_epi16(__m256i s,__ mmask16 k, __ m256i a, unsigned int imm); 
m256i a, unsigned int imm); 

m1 28i a, unsigned int imm); 
VPSRLW __m128i _mm_maskz_srli_epi16(__mmask8 k, __m128i a, unsigned int imm); 


VPSRLW __m256i _mm256_maskz_srli_epi16(__mmask16 k, 
VPSRLW __m128i __mm_mask_srli_epi16(__m128i s, 


mmask8 k, 


VPSRLW __m512i__mm512_srl_epi16(__m512ia,__m128i cnt); 


VPSRLW __m512i__mm512_mask_srl_epi16(__m512is,__ mmask32 k,__m512i a, _m128i cnt); 
m512i a, 
VPSRLW __m256i __mm256_mask_srl_epi16(__m256i s,__ mmask16 k,___ m256i a, __m128i cnt); 
mmask16 a, 
mmask8 k,__m128i a, __m128i cnt); 
m128i a,__m128i cnt); 


VPSRLW __m512i__mm512_maskz_srl_epi16(__mmask32 k, 


VPSRLW __m256i __mm256_maskz_srl_epi16(__mmask8 k, 
VPSRLW __m128i _mm_mask_srl_epi16(__m128i s, 
VPSRLW __m128i _mm_maskz_srl_epi16(___mmask8 k, 
PSRLW:__m64 _mm_srli_pi16(__m64 m, int count) 
PSRLW:__m64 _mm_srl_pi16 (__m64 m, __m64 count) 
(V)PSRLW:__m128i __mm_srli_epi16 (__m128i m, int count) 
(V)PSRLW:__m128i __mm_srl_epi16 (__m128i m, __m128i count) 
VPSRLW:__m256i __mm256_srli_epi16 (__m256i m, int count) 
VPSRLW:__m256i__mm256_srl_epi16 (__m256i m, __m128i count) 
PSRLD:__m64 _mm_srli_pi32 (__m64 m, int count) 

PSRLD:__m64 _mm_srl_pi32 (__m64 m, __m64 count) 
(V)PSRLD:__m128i __mm_srli_epi32 (__m128i m, int count) 
(V)PSRLD:__m128i __mm_srl_epi32 (__m128i m,___m128i count) 
VPSRLD:__m256i__mm256_srli_epi32 (__m256i m, int count) 
VPSRLD:__m256i__mm256_srl_epi32 (__m256i m,___m128i count) 
PSRLQ:__m64 _mm_srli_si64 (__m64 m, int count) 

PSRLQ:__m64 _mm_srl_si64 (__m64 m, __m64 count) 
(V)PSRLQ:__m128i _mm_srli_epi64 (__m128i m, int count) 
(V)PSRLQ:__m128i _mm_srl_epi64 (__m128i m, __m128i count) 
VPSRLQ:__m256i _mm256_srli_epi64 (__m256i m, int count) 
VPSRLQ:__m256i _mm256_srl_epi64 (__m256i m, __m128i count) 


Flags Affected 
None. 
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m512i a, unsigned int imm); 


m256i a, unsigned int imm); 
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Numeric Exceptions 


None. 


Other Exceptions 
VEX-encoded instructions: 


Syntax with RM/RVM operand encoding (A/C in the operand encoding table), see Table 2-21, “Type 4 Class Excep- 
tion Conditions”. 


Syntax with MI/VMI operand encoding (B/D in the operand encoding table), see Table 2-24, “Type 7 Class Excep- 
tion Conditions”. 


EVEX-encoded VPSRLW (E in the operand encoding table), see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF 
Class Exception Conditions”. 


EVEX-encoded VPSRLD/Q: 


Syntax with Mem128 tuple type (G in the operand encoding table), see Exceptions Type E4NF.nb in Table 2-50, 
“Type E4NF Class Exception Conditions”. 


Syntax with Full tuple type (F in the operand encoding table), see Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

NP OF F8 /r' A VIV MMX Subtract packed byte integers in mm/m64 

PSUBB mm, mm/m64 from packed byte integers in mm. 

66 OF F8 /r A VIV SSE2 Subtract packed byte integers in xmm2/m128 

PSUBB xmm1, xmm2/m128 from packed byte integers in xmm1. 

NP OF F9 /r' A VIV MMX Subtract packed word integers in mm/m64 

PSUBW mm, mm/m64 from packed word integers in mm. 

66 OF F9 /r A VIV SSE2 Subtract packed word integers in 

PSUBW xmm1, xmm2/m128 xmm2/m128 from packed word integers in 
xmm1. 

NP OF FA /r' A VIV MMX Subtract packed doubleword integers in 

PSUBD mm, mm/m64 mm/m64 from packed doubleword integers in 
mm. 

66 OF FA /r A VIV SSE2 Subtract packed doubleword integers in 

PSUBD xmm1, xmm2/m128 xmm2/mem128 from packed doubleword 
integers in xmm1. 

VEX.128.66.0F.WIG F8 /r B VIV AVX Subtract packed byte integers in xmm3/m128 

VPSUBB xmm1, xmm2, xmm3/m128 from xmm2. 

VEX.128.66.0F.WIG F9 /r B VIV AVX Subtract packed word integers in 

VPSUBW xmm1, xmm2, xmm3/m128 xmm3/m128 from xmm2. 

VEX.128.66.0F.WIG FA /r B VIV AVX Subtract packed doubleword integers in 

VPSUBD xmm1, xmm2, xmm3/m128 xmm3/m128 from xmme2. 

VEX.256.66.0F.WIG F8 /r B VIV AVX2 Subtract packed byte integers in ymm3/m256 

VPSUBB ymm17, ymm2, ymm3/m256 from ymm2. 

VEX.256.66.0F.WIG F9 /r B VIV AVX2 Subtract packed word integers in 

VPSUBW ymm1, ymm2, ymm3/m256 ymm3/m256 from ymm2. 

VEX.256.66.0F.WIG FA /r B VIV AVX2 Subtract packed doubleword integers in 

VPSUBD ymm17, ymm2, ymm3/m256 ymm3/m256 from ymm2. 

EVEX.128.66.0F.WIG F8 /r C VIV AVX512VL_ | Subtract packed byte integers in xmm3/m128 

VPSUBB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | from xmm2 and store in xmm1 using 
writemask k1. 

EVEX.256.66.0F.WIG F8 /r Cc VIV AVX512VL_ | Subtract packed byte integers in ymm3/m256 

VPSUBB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | from ymm2 and store in ymm1 using 
writemask k1. 

EVEX.512.66.0F.WIG F8 /r C VIV AVX512BW | Subtract packed byte integers in zmm3/m512 

VPSUBB zmm1 {k1}{z}, zmm2, zmm3/m512 from zmm2 and store in zmm1 using 
writemask k1. 

EVEX.128.66.0F.WIG F9 /r a VIV AVX512VL_ | Subtract packed word integers in 

VPSUBW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 from xmmz and store in xmm1 
using writemask k1. 

EVEX.256.66.0F.WIG F9 /r C VIV AVX512VL_ | Subtract packed word integers in 

VPSUBW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 from ymm2 and store in ymm1 
using writemask k1. 

EVEX.512.66.0F.WIG F9 /r C VIN AVX512BW | Subtract packed word integers in 


VPSUBW zmm1 {k1}{z}, zmm2, zmm3/m512 


zmm3/m512 from zmm2 and store in zmm1 
using writemask k1. 
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EVEX.128.66.0F.WO FA /r D VIV AVX512VL_ | Subtract packed doubleword integers in 

VPSUBD xmm1 {k1}{z}, xmm2, xmm3/m1 28/m32bcst AVX512F — | xmm3/m128/m32bcst from xmm2 and store 
in xmm1 using writemask k1. 

EVEX.256.66.0F.WO FA /r D VIV AVX512VL_ | Subtract packed doubleword integers in 

VPSUBD ymm1 {k1}{z}, ymm2, ymm3/m256/m32bcst AVX512F — | ymm3/m256/m32bcst from ymm2 and store 
in ymm1 using writemask k1. 

EVEX.512.66.0F.WO FA /r D VIV AVX512F — | Subtract packed doubleword integers in 

VPSUBD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst zmm3/m512/m32bcst from zmm_2 and store 
in zmm1 using writemask k1 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” in 
the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD subtract of the packed integers of the source operand (second operand) from the packed integers 
of the destination operand (first operand), and stores the packed integer results in the destination operand. See 
Figure 9-4 in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a 
SIMD operation. Overflow is handled with wraparound, as described in the following paragraphs. 


The (V)PSUBB instruction subtracts packed byte integers. When an individual result is too large or too small to be 
represented in a byte, the result is wrapped around and the low 8 bits are written to the destination element. 


The (V)PSUBW instruction subtracts packed word integers. When an individual result is too large or too small to be 
represented in a word, the result is wrapped around and the low 16 bits are written to the destination element. 


The (V)PSUBD instruction subtracts packed doubleword integers. When an individual result is too large or too small 
to be represented in a doubleword, the result is wrapped around and the low 32 bits are written to the destination 
element. 


Note that the (V)PSUBB, (V)PSUBW, and (V)PSUBD instructions can operate on either unsigned or signed (two's 
complement notation) packed integers; however, it does not set bits in the EFLAGS register to indicate overflow 
and/or a carry. To prevent undetected overflow conditions, software must control the ranges of values upon which 
it operates. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The destination operand must be an MMX technology register and the source 
operand can be either an MMX technology register or a 64-bit memory location. 
128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 


source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM desti- 
nation register remain unchanged. 


VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 
are zeroed. 
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VEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding ZMM 
register are zeroed. 

EVEX encoded VPSUBD: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. The first source operand and 
destination operands are ZMM/YMM/XMM registers. The destination is conditionally updated with writemask k1. 
EVEX encoded VPSUBB/W: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory 
location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination is condi- 
tionally updated with writemask k1. 


Operation 


PSUBB (with 64-bit operands) 
DEST[7:0] := DEST[7:0] — SRC[7:0]; 
(* Repeat subtract operation for 2nd through 7th byte *) 
DEST[63:56] := DEST[63:56] — SRC[63:56]; 


PSUBW (with 64-bit operands) 
DEST[15:0] := DEST[15:0] — SRC[15:0]; 
(* Repeat subtract operation for 2nd and 3rd word *) 
DEST[63:48] := DEST[63:48] — SRC[63:48]; 


PSUBD (with 64-bit operands) 
DEST[31:0] := DEST[31:0] — SRC[31:0]; 
DEST[63:32] := DEST[63:32] — SRC[63:32]; 


PSUBD (with 128-bit operands) 
DEST[31:0] := DEST[31:0] — SRC[31:0]; 
(* Repeat subtract operation for 2nd and 3rd doubleword *) 
DEST[127:96] := DEST[127:96] — SRC[1 27:96]; 


VPSUBB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = SRC1[i+7:i] - SRC2[i+7:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPSUBW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SRC1[i+15:i] - SRC2[i+15:i] 
ELSE 
IF *merging-masking* ; merging-masking 
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THEN *DEST[i+15:i] remains unchanged* 
; zeroing-masking 


ELSE *zeroing-masking* 
DEST[i+15:i] = 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


VPSUBD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 

i:=j* 32 

IF k1[j] OR *no writemask* THEN 


IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] := SRC1[i+31:i] - SRC2[31:0] 
ELSE DEST[i+31:i] = SRC1[i+31:i] - SRC2[i+31:i] 


Fl; 
ELSE 
IF *merging-masking* 


ELSE *zeroing-masking* 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


VPSUBB (VEX.256 encoded version) 

DEST[7:0] := SRC1[7:0]-SRC2[7:0] 

DEST[15:8] := SRC1[15:8]-SRC2[1 5:8] 
DEST[23:16] := SRC1[23:16]-SRC2[23:16] 
DEST[31:24] := SRC1[31:24]-SRC2[31:24] 
DEST[39:32] := SRC1[39:32]-SRC2[39:32] 
DEST[47:40] := SRC1[47:40]-SRC2[47:40] 
DEST[55:48] := SRC1[55:48]-SRC2[55:48] 
DEST[63:56] := SRC1[63:56]-SRC2[63:56] 
DEST[7 1:64] := SRC1[71:64]-SRC2[7 1:64] 
DEST[79:72] := SRC1[79:72]-SRC2[79:72] 
DEST[87:80] := SRC1[87:80]-SRC2[87:80] 
DEST[95:88] := SRC1[95:88]-SRC2[95:88] 
DEST[103:96] := SRC1[103:96]-SRC2[103:96] 
DEST[111:104] := SRC1[111:104]-SRC2[111:104] 
DEST[119:112] := SRC1[119:112]-SRC2[119:112] 
DEST[127:120] := SRC1[127:120]-SRC2[127:120] 
DEST[135:128] := SRC1[135:128]-SRC2[1 35:1 28] 
DEST[143:136] := SRC1[143:136]-SRC2[1 43:1 36] 
DEST[151:144] := SRC1[151:144]-SRC2[151:144] 
DEST[159:152] := SRC1[159:152]-SRC2[159:152] 
DEST[167:160] := SRC1[167:160]-SRC2[167:160] 
DEST[175:168] := SRC1[175:168]-SRC2[175:168] 
DEST[183:1 76] := SRC1[183:176]-SRC2[1 83:1 76] 
DEST[191:184] := SRC1[191:184]-SRC2[191:184] 
DEST[199:192] := SRC1[199:192]-SRC2[199:192] 
DEST[207:200] := SRC1[207:200]-SRC2[207:200] 
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; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
; zeroing-masking 
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DEST[215:208] := SRC1[215:208]-SRC2[215:208] 
DEST[223:216] = SRC1[223:216]-SRC2[223:216] 
DEST[231:224] := SRC1[231:224]-SRC2[231:224] 
DEST[239:232] := SRC1[239:232]-SRC2[239:232] 
DEST[247:240] := SRC1[247:240]-SRC2[247:240] 
DEST[255:248] := SRC1[255:248]-SRC2[255:248] 
DEST[MAXVL-1:256] := 0 


VPSUBB (VEX.128 encoded version) 

DEST[7:0] := SRC1[7:0]-SRC2[7:0] 

DEST[15:8] := SRC1[15:8]-SRC2[1 5:8] 
DEST[23:16] := SRC1[23:16]-SRC2[23:16] 
DEST[31:24] := SRC1[31:24]-SRC2[31:24] 
DEST[39:32] := SRC1[39:32]-SRC2[39:32] 
DEST[47:40] := SRC1[47:40]-SRC2[47:40] 
DEST[55:48] := SRC1[55:48]-SRC2[55:48] 
DEST[63:56] := SRC1[63:56]-SRC2[63:56] 
DEST[7 1:64] := SRC1[71:64]-SRC2[7 1:64] 
DEST[79:72] := SRC1[79:72]-SRC2[79:72] 
DEST[87:80] := SRC1[87:80]-SRC2[87:80] 
DEST[95:88] := SRC1[95:88]-SRC2[95:88] 
DEST[103:96] := SRC1[103:96]-SRC2[103:96] 
DEST[111:104] := SRC1[111:104]-SRC2[111:104] 
DEST[119:112] := SRC1[119:112]-SRC2[119:112] 
DEST[127:120] := SRC1[1 27:1 20]-SRC2[1 27:1 20] 
DEST[MAXVL-1:128] := 0 


PSUBB (128-bit Legacy SSE version) 
DEST[7:0] := DEST[7:0]-SRC[7:0] 

DEST[15:8] := DEST[15:8]-SRC[1 5:8] 
DEST[23:16] := DEST[23:16]-SRC[23:16] 
DEST[31:24] := DEST[31:24]-SRC[31:24] 
DEST[39:32] := DEST[39:32]-SRC[39:32] 
DEST[47:40] := DEST[47:40]-SRC[47:40] 
DEST[55:48] := DEST[55:48]-SRC[55:48] 
DEST[63:56] := DEST[63:56]-SRC[63:56] 
DEST[7 1:64] := DEST[71:64]-SRC[7 1:64] 
DEST[79:7 2] := DEST[79:72]-SRC[79:72] 
DEST[87:80] := DEST[87:80]-SRC[87:80] 
DEST[95:88] := DEST[95:88]-SRC[95:88] 
DEST[103:96] := DEST[103:96]-SRC[103:96] 
DEST[111:104] := DEST[111:104]-SRC[111:104] 
DEST[119:112] := DEST[119:112]-SRC[119:112] 
DEST[127:120] := DEST[127:120]-SRC[127:120] 
DEST[MAXVL-1:128] (Unmodified) 


VPSUBW (VEX.256 encoded version) 
DEST[15:0] := SRC1[15:0]-SRC2[1 5:0] 
DEST[31:16] := SRC1[31:16]-SRC2[31:16] 
DEST[47:32] := SRC1[47:32]-SRC2[47:32] 
DEST[63:48] := SRC1[63:48]-SRC2[63:48] 
DEST[79:64] := SRC1[79:64]-SRC2[79:64] 
DEST[95:80] := SRC1[95:80]-SRC2[95:80] 
DEST[1 11:96] := SRC1[111:96]-SRC2[1 11:96] 
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DEST[127:112] = SRC1[127:112]-SRC2[127:112] 
DEST[143:128] = SRC1[143:128]-SRC2[143:128] 
DEST[159:144] := SRC1[159:144]-SRC2[159:144] 
DEST[175:160] = SRC1[175:160]-SRC2[175:160] 
DEST[191:176] = SRC1[191:176]-SRC2[191:176] 
DEST[207:192] := SRC1207:192]-SRC2[207:192] 
DEST[223:208] := SRC1[223:208]-SRC2[223:208] 
DEST[239:224] := SRC1[239:224]-SRC2[239:224] 
DEST[255:240] := SRC1[255:240]-SRC2[255:240] 
DEST[MAXVL-1:256] := 0 


VPSUBW (VEX.128 encoded version) 
DEST[15:0] := SRC1[15:0]-SRC2[15:0] 
DEST[31:16] := SRC1[31:16]-SRC2[31:16] 
DEST[47:32] := SRC1[47:32]-SRC2[47:32] 
DEST[63:48] := SRC1[63:48]-SRC2[63:48] 
DEST[79:64] := SRC1[79:64]-SRC2[79:64] 
DEST[95:80] := SRC1[95:80]-SRC2[95:80] 

DEST[1 11:96] := SRC1[111:96]-SRC2[1 11:96] 
DEST[127:112] := SRC1[127:112]-SRC2[127:112] 
DEST[MAXVL-1:128] := 0 


PSUBW (128-bit Legacy SSE version) 
DEST[15:0] := DEST[15:0]-SRC[1 5:0] 
DEST[31:16] := DEST[31:16]-SRC[31:16] 
DEST[47:32] := DEST[47:32]-SRC[47:32] 
DEST[63:48] := DEST[63:48]-SRC[63:48] 
DEST[79:64] := DEST[79:64]-SRC[79:64] 
DEST[95:80] := DEST[95:80]-SRC[95:80] 
DEST[111:96] := DEST[111:96]-SRC[1 11:96] 
DEST[127:112] := DEST[127:112]-SRC[127:112] 
DEST[MAXVL-1:128] (Unmodified) 


VPSUBD (VEX.256 encoded version) 
DEST[31:0] := SRC1[31:0]-SRC2[31:0] 
DEST[63:32] := SRC1[63:32]-SRC2[63:32] 
DEST[95:64] := SRC1[95:64]-SRC2[95:64] 
DEST[127:96] := SRC1[127:96]-SRC2[1 27:96] 
DEST[159:128] := SRC1[159:128]-SRC2[159:128] 
DEST[191:160] := SRC1[191:160]-SRC2[191:160] 
DEST[223:192] := SRC1[223:192]-SRC2[223:192] 
DEST[255:224] := SRC1[255:224]-SRC2[255:224] 
DEST[MAXVL-1:256] := 0 


VPSUBD (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0]-SRC2[31:0] 
DEST[63:32] := SRC1[63:32]-SRC2[63:32] 
DEST[95:64] := SRC1[95:64]-SRC2[95:64] 
DEST[127:96] := SRC1[127:96]-SRC2[1 27:96] 
DEST[MAXVL-1:128] := 0 


PSUBD (128-bit Legacy SSE version) 


DEST[31:0] := DEST[31:0]-SRC[31:0] 
DEST[63:32] = DEST[63:32]-SRC[63:32] 
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DEST[95:64] := DEST[95:64]-SRC[95:64] 
DEST[127:96] := DEST[127:96]-SRC[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalents 
VPSUBB __m512i_mm512_sub_epi8(__m512i a,__m512i b); 


VPSUBB __m512i_mm512_mask_sub_epi8(__m512is,__ mmask64 k,___m512i a,__m512i b); 
VPSUBB __m512i_mm512_maskz_sub_epi8(__mmask64 k,__m512ia,__m512i b); 
VPSUBB __m256i __mm256_mask_sub_epi8(__m256i s,___ mmask32 k,___m256i a, __m256i b); 


VPSUBB __m256i__mm256_maskz_sub_epi8(__mmask32 k,___ m256i a, __ m256i b); 

VPSUBB __m128i _mm_mask_sub_epi8(__m128i s,__ mmask16 k,___m128i a,__m128i b); 
VPSUBB __m128i __mm_maskz_sub_epi8(__mmask16 k,__m128i a, __m128i b); 

VPSUBW __m512i_mm512_sub_epi16(__m512i a,__m512i b); 

VPSUBW __m512i_mm512_mask_sub_epi16(__m512is,___mmask32 k,__m512ia,__m512i b); 


VPSUBW __m512i_mm512_maskz_sub_epi16(__mmask32 k,__m512i a,__m512ib); 
VPSUBW __m256i __mm256_mask_sub_epi16(__m256is,__ mmask16 k,___ m256i a, __m256i b); 
VPSUBW __m256i __mm256_maskz_sub_epi16(__mmask16 k,__ m256i a, ___m256i b); 


VPSUBW __m128i__mm_mask_sub_epi16(__m128is,___ mmask8 k,___m128i a,__m128i b); 
VPSUBW __m128i __mm_maskz_sub_epi16(__mmask8 k, __m128i a,__m128i b); 
VPSUBD __m512i_mm512_sub_epi32(__m512i a, ___m512i b); 


VPSUBD __m512i_mm512_mask_sub_epi32(__m512is,__ mmask16 k,__m512i a, ___m512i b); 
VPSUBD __m512i_mm512_maskz_sub_epi32(__mmask16 k,__m512i a, __m512i b); 
VPSUBD __m256i __mm256_mask_sub_epi32(__m256i s,___ mmask8 k,__ m256i a, __ m256i b); 


VPSUBD __m256i__mm256_maskz_sub_epi32(__mmask8 k,__ m256i a, __m256i b); 
VPSUBD __m128i __mm_mask_sub_epi32(__m128i s,___ mmask8 k,__m128i a,__m128i b); 
VPSUBD __m128i __mm_maskz_sub_epi32(__mmask8 k,___m128i a,__m128i b); 
PSUBB:__m64 _mm_sub_pi8(__m64 m1,__m64 m2) 

(V)PSUBB:__m128i __mm_sub_epi8 (__m128i a, ___m128i b) 

VPSUBB:__m256i __mm256_sub_epi8 (__m256i a,__m256i b) 
PSUBW:__m64__mm_sub_pi16(__m64 m1,__ m64 m2) 

(V)PSUBW:__m128i __mm_sub_epi16 (__m128i a,__m128i b) 

VPSUBW:__m256i _mm256_sub_epi16 (__m256i a, __m256i b) 

PSUBD:__m64 _mm_sub_pi32(__m64 m1,__m64 m2) 

(V)PSUBD:__m128i __mm_sub_epi32 (__m128i a,__m128i b) 

VPSUBD:__m256i _mm256_sub_epi32 (__m256i a, __m256i b) 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 

EVEX-encoded VPSUBD, see Table 2-49, “Type E4 Class Exception Conditions”. 

EVEX-encoded VPSUBB/W, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PSUBQ—Subtract Packed Quadword Integers 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF FB /r' A VIV SSE2 Subtract quadword integer in mm7 from mm2 
PSUBQ mm1, mm2/m64 /m64. 
66 OF FB /r A VIV SSE2 Subtract packed quadword integers in xmm17 
PSUBQ xmm1, xmm2/m128 from xmmé /m128. 
VEX.128.66.0F.WIG FB/r B VIV AVX Subtract packed quadword integers in 
VPSUBQ xmm1, xmm2, xmm3/m128 xmm3/m128 from xmme. 
VEX.256.66.0F.WIG FB /r B VIV AVX2 Subtract packed quadword integers in 
VPSUBQ ymm1, ymm2, ymm3/m256 ymm3/m256 from ymm2. 
EVEX.128.66.0F.W1 FB /r C VIV AVX512VL | Subtract packed quadword integers in 
VPSUBQ xmm1 {k1}{z}, xmm2, xmm3/m128/m64bcst AVX512F | xmm3/m128/m64bcst from xmm2z and store 
in xmm1 using writemask k1. 
EVEX.256.66.0F.W1 FB /r C VIV AVX512VL | Subtract packed quadword integers in 
VPSUBQ ymm1 {k1}{z}, ymm2, ymm3/m256/m64bcst AVX512F | ymm3/m256/m64bcst from ymm2 and store 
in ymm1 using writemask k1. 
EVEX.512.66.0F.W1 FB/r C VIV AVX512F | Subtract packed quadword integers in 
VPSUBQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst zmm3/m512/m64bcst from zmm_2 and store 
in zmm1 using writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Subtracts the second operand (source operand) from the first operand (destination operand) and stores the result 
in the destination operand. When packed quadword operands are used, a SIMD subtract is performed. When a 
quadword result is too large to be represented in 64 bits (overflow), the result is wrapped around and the low 64 
bits are written to the destination element (that is, the carry is ignored). 


Note that the (V)PSUBQ instruction can operate on either unsigned or signed (two’s complement notation) inte- 
gers; however, it does not set bits in the EFLAGS register to indicate overflow and/or a carry. To prevent undetected 
overflow conditions, software must control the ranges of the values upon which it operates. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The source operand can be a quadword integer stored in an MMX technology 
register or a 64-bit memory location. 


128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM desti- 
nation register remain unchanged. 
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VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 


are zeroed. 


VEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding ZMM 


register are zeroed. 


EVEX encoded VPSUBQ: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. The first source operand and 
destination operands are ZMM/YMM/XMM registers. The destination is conditionally updated with writemask k1. 


Operation 


PSUBQ (with 64-Bit operands) 
DEST[63:0] := DEST[63:0] — SRC[63:0]; 


PSUBQ (with 128-Bit operands) 
DEST[63:0] := DEST[63:0] — SRC[63:0]; 
DEST[127:64] := DEST[127:64] — SRC[127:64]; 


VPSUBQ (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0]-SRC2[63:0] 
DEST[127:64] := SRC1[127:64]-SRC2[1 27:64] 
DEST[MAXVL-1:128] := 0 


VPSUBQ (VEX.256 encoded version) 
DEST[63:0] := SRC1[63:0]-SRC2[63:0] 
DEST[127:64] := SRC1[127:64]-SRC2[1 27:64] 
DEST[191:128] := SRC1[191:128]-SRC2[191:128] 
DEST[255:192] := SRC1[255:192]-SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VPSUBQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] := SRC1[i+63:i] - SRC2[63:0] 
ELSE DEST[i+63:i] := SRC1[i+63:i] - SRC2[i+63:i] 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalents 

VPSUBQ __m512i __mm512_sub_epi64(__m512i a,__m512i b); 
VPSUBQ __m512i __mm512_mask_sub_epi64(__m512i s,___mmask8 k, 
VPSUBQ __m512i __mm512_maskz_sub_epi64(__mmask8 k, __m512i a, 
VPSUBQ __m256i _mm256_mask_sub_epi64(__m256i s,___mmask8 k, 
VPSUBQ __m256i _mm256_maskz_sub_epi64(__mmask8 k, __m256i a, 
VPSUBQ __m128i _mm_mask_sub_epi64(__m128i s, ___mmask8 k, 
VPSUBQ __m128i _mm_maskz_sub_epi64(__mmask8 k,__m128i a, 
PSUBQ:__m64 _mm_sub_si64(__m64 m1, __m64 m2) 
(V)PSUBQ:__m128i _mm_sub_epi64(__m128i m1,_m128i m2) 
VPSUBQ:__m256i __mm256_sub_epi64(__m256i m1,__m256i m2) 


m512ia,__m512i b); 
m512i b); 

m256i a,__m256i b); 
m256i b); 

m128i a,__m128i b); 

m1 28i b); 


Flags Affected 
None. 


Numeric Exceptions 


None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPSUBQ, see Table 2-49, “Type E4 Class Exception Conditions”. 
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PSUBSB/PSUBSW-—Subtract Packed Signed Integers with Signed Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF €8 /r' A VIV MMX Subtract signed packed bytes in mm/m64 from 
PSUBSB mm, mm/m64 signed packed bytes in mm and saturate results. 
66 OF E8 /r A VIV SSE2 Subtract packed signed byte integers in 
PSUBSB xmm1, xmm2/m128 xmm_2/m1 28 from packed signed byte integers 
in xmm1 and saturate results. 
NP OF €9 /r' A VIV MMX Subtract signed packed words in mm/m64 from 
PSUBSW mm, mm/m64 signed packed words in mm and saturate 
results. 
66 OF E9 /r A VIV SSE2 Subtract packed signed word integers in 
PSUBSW xmm1, xmm2/m128 xmm2/m128 from packed signed word integers 
in xmm1 and saturate results. 
VEX.128.66.0F.WIG E8 /r B VIV AVX Subtract packed signed byte integers in 
VPSUBSB xmm1, xmm2, xmm3/m128 xmm3/m128 from packed signed byte integers 
in xmm2 and saturate results. 
VEX.128.66.0F.WIG E9 /r B VIV AVX Subtract packed signed word integers in 
VPSUBSW xmm1, xmm2, xmm3/m128 xmm3/m1 28 from packed signed word integers 
in xmm2 and saturate results. 
VEX.256.66.0F.WIG E8 /r B VIV AVX2 Subtract packed signed byte integers in 
VPSUBSB ymm1, ymm2, ymm3/m256 ymm3/m256 from packed signed byte integers 
in ymm2 and saturate results. 
VEX.256.66.0F.WIG E9 /r B VIV AVX2 Subtract packed signed word integers in 
VPSUBSW ymm1, ymm2, ymm3/m256 ymm3/m256 from packed signed word integers 
in ymm2 and saturate results. 
EVEX.128.66.0F.WIG E8 /r C VIV AVX512VL | Subtract packed signed byte integers in 
VPSUBSB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 from packed signed byte integers 
in xmm2 and saturate results and store in 
xmm1 using writemask k1. 
EVEX.256.66.0F.WIG E8 /r C VIV AVX512VL | Subtract packed signed byte integers in 
VPSUBSB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 from packed signed byte integers 
in ymme2 and saturate results and store in 
ymm1 using writemask k1. 
EVEX.512.66.0F.WIG E8 /r C VIV AVX512BW | Subtract packed signed byte integers in 
VPSUBSB zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 from packed signed byte integers 
in zmm2 and saturate results and store inzmm1 
using writemask k1. 
EVEX.128.66.0F.WIG E9 /r C VIN AVX512VL | Subtract packed signed word integers in 
VPSUBSW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 from packed signed word integers 
in xmm2 and saturate results and store in 
xmm1 using writemask k1. 
EVEX.256.66.0F.WIG E9 /r C VIV AVX512VL | Subtract packed signed word integers in 
VPSUBSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 from packed signed word integers 


in ymme2 and saturate results and store in 
ymm1 using writemask k1. 
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EVEX.512.66.0F.WIG E9 /r Cc VIV AVX512BW | Subtract packed signed word integers in 
VPSUBSW zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 from packed signed word integers 
inzmm2 and saturate results and store inzmm1 
using writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD subtract of the packed signed integers of the source operand (second operand) from the packed 
signed integers of the destination operand (first operand), and stores the packed integer results in the destination 
operand. See Figure 9-4 in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for an 
illustration of a SIMD operation. Overflow is handled with signed saturation, as described in the following para- 
graphs. 


The (V)PSUBSB instruction subtracts packed signed byte integers. When an individual byte result is beyond the 
range of a signed byte integer (that is, greater than 7FH or less than 80H), the saturated value of 7FH or 80H, 
respectively, is written to the destination operand. 


The (V)PSUBSW instruction subtracts packed signed word integers. When an individual word result is beyond the 
range of a signed word integer (that is, greater than 7FFFH or less than 8000H), the saturated value of 7FFFH or 
8000H, respectively, is written to the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The destination operand must be an MMX technology register and the source 
operand can be either an MMX technology register or a 64-bit memory location. 

128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM desti- 
nation register remain unchanged. 

VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 
are zeroed. 

VEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding ZMM 
register are zeroed. 

EVEX encoded version: The second source operand is an ZMM/YMM/XMM register or an 512/256/128-bit memory 


location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination is condi- 
tionally updated with writemask k1. 


Operation 

PSUBSB (with 64-bit operands) 
DEST[7:0] := SaturateToSignedByte (DEST[7:0] — SRC (7:0); 
(* Repeat subtract operation for 2nd through 7th bytes *) 
DEST[63:56] := SaturateToSignedByte (DEST[63:56] — SRC[63:56] ); 
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PSUBSW (with 64-bit operands) 
DEST[15:0] := SaturateToSignedword (DEST[1 5:0] — SRC[15:0] ); 
(* Repeat subtract operation for 2nd and 7th words *) 
DEST[63:48] := SaturateToSignedword (DEST[63:48] — SRC[63:48] ); 


VPSUBSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8; 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateToSignedByte (SRC1[i+7:i] - SRC2[i+7:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0; 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VPSUBSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SaturateToSignedWord (SRC1[i+15:i] - SRC2[i+1 5:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0; 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 


VPSUBSB (VEX.256 encoded version) 

DEST[7:0] := SaturateToSignedByte (SRC1[7:0] - SRC2[7:0)); 

(* Repeat subtract operation for 2nd through 31th bytes *) 

DEST[255:248] := SaturateToSignedByte (SRC1[255:248] - SRC2[255:248}); 
DEST[MAXVL-1:256] := 0; 


VPSUBSB (VEX.128 encoded version) 

DEST[7:0] := SaturateToSignedByte (SRC1[7:0] - SRC2[7:0)); 

(* Repeat subtract operation for 2nd through 14th bytes *) 

DEST[127:120] := SaturateToSignedByte (SRC1[127:120] - SRC2[127:120}); 
DEST[MAXVL-1:1 28] := 0; 


PSUBSB (128-bit Legacy SSE Version) 

DEST[7:0] := SaturateToSignedByte (DEST[7:0] - SRC[7:0)); 

(* Repeat subtract operation for 2nd through 14th bytes *) 
DEST[127:120] := SaturateToSignedByte (DEST[127:120] - SRC[127:120)); 
DEST[MAXVL-1:128] (Unmodified); 
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VPSUBSW (VEX.256 encoded version) 

DEST[15:0] := SaturateToSignedword (SRC1[15:0] - SRC2[15:0}); 

(* Repeat subtract operation for 2nd through 15th words *) 

DEST[255:240] := SaturateToSignedWord (SRC1[255:240] - SRC2[255:240)); 
DEST[MAXVL-1:256] := 0; 


VPSUBSW (VEX.128 encoded version) 

DEST[15:0] := SaturateToSignedword (SRC1[15:0] - SRC2[15:0}); 

(* Repeat subtract operation for 2nd through 7th words *) 

DEST[127:112] := SaturateToSignedWord (SRC1[127:112] - SRC2[127:112)]); 
DEST[MAXVL-1:1 28] := 0; 


PSUBSW (128-bit Legacy SSE Version) 

DEST[15:0] := SaturateToSignedword (DEST[1 5:0] - SRC[15:0]); 

(* Repeat subtract operation for 2nd through 7th words *) 

DEST[127:112] := SaturateToSignedWord (DEST[127:112] - SRC[127:112]); 
DEST[MAXVL-1:128] (Unmodified); 


Intel C/C++ Compiler Intrinsic Equivalents 
VPSUBSB __m512i_mm512_subs_epi8(__m512i a,__m512i b); 
VPSUBSB __m512i_mm512_mask_subs_epi8(__m512is,__mmask64 k,___m512ia,__m512i b); 


VPSUBSB __m512i_mm512_maskz_subs_epi8(__mmask64 k,__m512i a,__m512i b); 
VPSUBSB __m256i__mm256_mask_subs_epi8(__m256is,__ mmask32 k,___m256i a, ___ m256i b); 
VPSUBSB __m256i__mm256_maskz_subs_epi8(__ mmask32 k,__ m256i a, ___m256i b); 


VPSUBSB __m128i__mm_mask_subs_epi8(__m128i s,__ mmask16 k,__m128i a, ___m128i b); 
VPSUBSB __m128i __mm_maskz_subs_epi8(__mmask16 k,__m128i a,___m128i b); 
VPSUBSW __m512i_mm512_subs_epi16(__m512i a,__m512i b); 

VPSUBSW __m512i_mm512_mask_subs_epi16(__m512is,__ mmask32 k,__m512ia, 
VPSUBSW __m512i_mm512_maskz_subs_epi16(__mmask32 k,__m512ia,__m512i b); 
VPSUBSW __m256i__mm256_mask_subs_epi16(__m256i s,__ mmask16 k,___ m256i a, 
VPSUBSW __m256i __mm256_maskz_subs_epi16(__ mmask16 k,__ m256i a, ___m256i b); 
VPSUBSW __m128i __mm_mask_subs_epi16(__m128is,__ mmask8 k, __m128i a,__m128i b); 
VPSUBSW __m128i __mm_maskz_subs_epi16(__mmask8 k, __m128i a,__m128i b); 
PSUBSB:__m64 _mm_subs_pi8(__m64 m1,__m64 m2) 
(V)PSUBSB:__m128i__mm_subs_epi8(__m128i m1,__m128i m2) 

VPSUBSB:__m256i __mm256_subs_epi8(__m256i m1, __ m256i m2) 

PSUBSW:__m64 _mm_subs_pi16(__m64 m1, ___ m64 m2) 

(V)PSUBSW:__m128i __mm_subs_epi16(__m128i m1,__m128i m2) 

VPSUBSW:__m256i __mm256_subs_epi16(__m256i m1,__ m256i m2) 


m512i b); 


m256i b); 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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PSUBUSB/PSUBUSW-—Subtract Packed Unsigned Integers with Unsigned Saturation 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF D8 /r' A VIV MMX Subtract unsigned packed bytes in mm/m64 
PSUBUSB mm, mm/m64 from unsigned packed bytes in mm and 
saturate result. 
66 OF D8 /r A VIV SSE2 Subtract packed unsigned byte integers in 
PSUBUSB xmm1, xmm2/m128 xmm2/m128 from packed unsigned byte 
integers in xmm1 and saturate result. 
NP OF D9 /r' A VIV MMX Subtract unsigned packed words in mm/m64 
PSUBUSW mm, mm/m64 from unsigned packed words in mm and 
saturate result. 
66 OF D9 /r A VIV SSE2 Subtract packed unsigned word integers in 
PSUBUSW xmm1, xmm2/m128 xmm2/m128 from packed unsigned word 
integers in xmm17 and saturate result. 
VEX.128.66.0F.WIG D8 /r B VIV AVX Subtract packed unsigned byte integers in 
VPSUBUSB xmm1, xmm2, xmm3/m128 xmm3/m128 from packed unsigned byte 
integers in xmm2 and saturate result. 
VEX.128.66.0F.WIG D9 /r B VIV AVX Subtract packed unsigned word integers in 
VPSUBUSW xmm1, xmm2, xmm3/m128 xmm3/m128 from packed unsigned word 
integers in xmm2 and saturate result. 
VEX.256.66.0F.WIG D8 /r B VIV AVX2 Subtract packed unsigned byte integers in 
VPSUBUSB ymm1, ymm2, ymm3/m256 ymm3/m256 from packed unsigned byte 
integers in ymm2 and saturate result. 
VEX.256.66.0F.WIG D9 /r B VIV AVX2 Subtract packed unsigned word integers in 
VPSUBUSW ymm1, ymm2, ymm3/m256 ymm3/m256 from packed unsigned word 
integers in ymm2 and saturate result. 
EVEX.128.66.0F.WIG D8 /r C VIV AVX512VL | Subtract packed unsigned byte integers in 
VPSUBUSB xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 from packed unsigned byte 
integers in xmm2, saturate results and store 
in xmm1 using writemask k1. 
EVEX.256.66.0F.WIG D8 /r C VIV AVX512VL | Subtract packed unsigned byte integers in 
VPSUBUSB ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 from packed unsigned byte 
integers in ymm2, saturate results and store 
in ymm1 using writemask k1. 
EVEX.512.66.0F.WIG D8 /r C VIV AVX512BW | Subtract packed unsigned byte integers in 
VPSUBUSB zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 from packed unsigned byte 
integers in zmm2, saturate results and store 
in zmm1 using writemask k1. 
EVEX.128.66.0F.WIG D9 /r C VIV AVX512VL | Subtract packed unsigned word integers in 
VPSUBUSW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 from packed unsigned word 
integers in xmme2 and saturate results and 
store in xmm1 using writemask k1. 
EVEX.256.66.0F.WIG D9 /r C VV AVX512VL | Subtract packed unsigned word integers in 
VPSUBUSW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 from packed unsigned word 


integers in ymm2, saturate results and store 
in ymm1 using writemask k1. 
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EVEX.512.66.0F.WIG D9 /r C VIV AVX512BW | Subtract packed unsigned word integers in 
VPSUBUSW zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 from packed unsigned word 
integers in zmm2, saturate results and store 
in zmm1 using writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD subtract of the packed unsigned integers of the source operand (second operand) from the 
packed unsigned integers of the destination operand (first operand), and stores the packed unsigned integer 
results in the destination operand. See Figure 9-4 in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, for an illustration of a SIMD operation. Overflow is handled with unsigned saturation, as 
described in the following paragraphs. 


These instructions can operate on either 64-bit or 128-bit operands. 


The (V)PSUBUSB instruction subtracts packed unsigned byte integers. When an individual byte result is less than 
zero, the saturated value of OOH is written to the destination operand. 


The (V)PSUBUSW instruction subtracts packed unsigned word integers. When an individual word result is less than 
zero, the saturated value of OOOOH is written to the destination operand. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE version 64-bit operand: The destination operand must be an MMX technology register and the source 
operand can be either an MMX technology register or a 64-bit memory location. 

128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM desti- 
nation register remain unchanged. 

VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 


source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 
are zeroed. 


VEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding ZMM 
register are zeroed. 

EVEX encoded version: The second source operand is an ZMM/YMM/XMM register or an 512/256/128-bit memory 


location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination is condi- 
tionally updated with writemask k1. 


Operation 
PSUBUSB (with 64-bit operands) 
DEST[7:0] := SaturateToUnsignedByte (DEST[7:0] — SRC (7:0] ); 
(* Repeat add operation for 2nd through 7th bytes *) 
DEST[63:56] := SaturateToUnsignedByte (DEST[63:56] — SRC[63:56]; 
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PSUBUSW (with 64-bit operands) 
DEST[15:0] := SaturateToUnsignedWord (DEST[15:0] — SRC[15:0] ); 
(* Repeat add operation for 2nd and 3rd words *) 
DEST[63:48] := SaturateToUnsignedWord (DEST[63:48] — SRC[63:48] ); 


VPSUBUSB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8; 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = SaturateToUnsignedByte (SRC1[i+7:i] - SRC2[i+7:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0; 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 


VPSUBUSW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j* 16; 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] = SaturateToUnsignedWord (SRC1[i+15:i] - SRC2[i+15:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0; 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 


VPSUBUSB (VEX.256 encoded version) 

DEST[7:0] := SaturateToUnsignedByte (SRC1[7:0] - SRC2[7:0)); 

(* Repeat subtract operation for 2nd through 31st bytes *) 

DEST[255:148] := SaturateToUnsignedByte (SRC1[255:248] - SRC2[255:248)); 
DEST[MAXVL-1:256] := 0; 


VPSUBUSB (VEX.128 encoded version) 

DEST[7:0] := SaturateToUnsignedByte (SRC1[7:0] - SRC2[7:0)); 

(* Repeat subtract operation for 2nd through 14th bytes *) 

DEST[127:120] := SaturateToUnsignedByte (SRC1[127:120] - SRC2[127:120)); 
DEST[MAXVL-1:128] := 0 


PSUBUSB (128-bit Legacy SSE Version) 

DEST[7:0] := SaturateToUnsignedByte (DEST[7:0] - SRC[7:0]); 

(* Repeat subtract operation for 2nd through 14th bytes *) 

DEST[1 27:1 20] := SaturateToUnsignedByte (DEST[127:120] - SRC[127:120)); 
DEST[MAXVL-1:128] (Unmodified) 
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VPSUBUSW (VEX.256 encoded version) 

DEST[15:0] := SaturateToUnsignedWord (SRC1[15:0] - SRC2[15:0)); 

(* Repeat subtract operation for 2nd through 15th words *) 

DEST[255:240] := SaturateToUnsignedword (SRC1[255:240] - SRC2[255:240)); 
DEST[MAXVL-1:256] := 0; 


VPSUBUSW (VEX.128 encoded version) 

DEST[15:0] := SaturateToUnsignedwWord (SRC1[15:0] - SRC2[15:0)); 

(* Repeat subtract operation for 2nd through 7th words *) 

DEST[127:112] := SaturateToUnsignedword (SRC1[127:112] - SRC2[127:112]); 
DEST[MAXVL-1:128] := 0 


PSUBUSW (128-bit Legacy SSE Version) 

DEST[15:0] := SaturateToUnsignedword (DEST[1 5:0] - SRC[15:0)); 

(* Repeat subtract operation for 2nd through 7th words *) 

DEST[127:112] := SaturateToUnsignedword (DEST[127:1 12] - SRC[127:112]); 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalents 

VPSUBUSB __m512i__mm512_subs_epu8(__m512i a,__m512ib); 

VPSUBUSB __m512i__mm512_mask_subs_epu8(__m512is,__ mmask64 k,___m512i a,__m512i b); 
VPSUBUSB __m512i_mm512_maskz_subs_epu8(__mmask64 k,__m512i a,__m512i b); 
VPSUBUSB __m256i __mm256_mask_subs_epu8(__m256i s,__ mmask32 k,___ m256i a, __ m256i b); 
VPSUBUSB __m256i __mm256_maskz_subs_epu8(__mmask32 k,___ m256i a, __ m256i b); 
VPSUBUSB __m128i__mm_mask_subs_epu8(__m128i s,___mmask16 k,__m128i a,__m128i b); 
VPSUBUSB __m128i __mm_maskz_subs_epu8(__mmask16 k,___m128i a,__m128i b); 
VPSUBUSW __m512i_mm512_subs_epu16(__m512i a,__m512i b); 

VPSUBUSW __m512i__mm512_mask_subs_epu16(__m512is,__ mmask32 k,__m512i a, 
VPSUBUSW __m512i__mm512_maskz_subs_epu16(__mmask32 k,__m512i a, __m512i b); 
VPSUBUSW __m256i _mm256_mask_subs_epu16(__m256is,__ mmask16 k,___m256i a, 
VPSUBUSW __m256i __mm256_maskz_subs_epu16(___mmask16 k,___ m256i a, __m256i b); 
VPSUBUSW __m128i __mm_mask_subs_epu16(__m128is,__ mmask8 k,___m128i a,__m128i b); 
VPSUBUSW __m128i __mm_maskz_subs_epu16(_mmask8 k,___m128i a,__m128i b); 
PSUBUSB:__m64 _mm_subs_pu8(__m64 m1,_m64 m2) 

(V)PSUBUSB:__m128i __mm_subs_epu8(__m128i m1,_m128i m2) 
VPSUBUSB:__m256i__mm256_subs_epu8(__m256i m1,__ m256i m2) 
PSUBUSW:__m64__mm_subs_pu16(__m64 m1,__m64 m2) 

(V)PSUBUSW:__m128i __mm_subs_epu16(__m128im1,__m128i m2) 
VPSUBUSW:__m256i__mm256_subs_epu16(__m256i m1,__ m256i m2) 


m512i b); 


m256i b); 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 38 17 /r RM | V/V SSE4_1 Set ZF if xmm2/m128 AND xmm1 result is all 
PTEST xmm1, xmm2/m128 Os. Set CF if xmm2/m128 AND NOT xmm1 
result is all Os. 
VEX.128.66.0F38.WIG 17 /r RM |V/V AVX Set ZF and CF depending on bitwise AND and 
VPTEST xmm1, xmm2/m128 ANDN of sources. 
VEX.256.66.0F38.WIG 17 /r RM | V/V AVX Set ZF and CF depending on bitwise AND and 
VPTEST ymm1, ymm2/m256 ANDN of sources. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


PTEST and VPTEST set the ZF flag if all bits in the result are O of the bitwise AND of the first source operand (first 
operand) and the second source operand (second operand). VPTEST sets the CF flag if all bits in the result are 0 of 
the bitwise AND of the second source operand (second operand) and the logical NOT of the destination operand. 


The first source register is specified by the ModR/M reg field. 


128-bit versions: The first source register is an XMM register. The second source register can be an XMM register 
or a 128-bit memory location. The destination register is not modified. 


VEX.256 encoded version: The first source register is a YMM register. The second source register can be a YMM 
register or a 256-bit memory location. The destination register is not modified. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


(V)PTEST (128-bit version) 

IF (SRC[127:0] BITWISE AND DEST[127:0] = 0) 
THEN ZF := 1; 
ELSE ZF := 0; 

IF (SRC[127:0] BITWISE AND NOT DEST[127:0] = 0) 
THEN CF := 1; 
ELSE CF := 0; 

DEST (unmodified) 

AF := OF := PF := SF := 0; 


VPTEST (VEX.256 encoded version) 

IF (SRC[255:0] BITWISE AND DEST[255:0] = 0) THEN ZF := 1; 
ELSE ZF := 0; 

IF (SRC[255:0] BITWISE AND NOT DEST[255:0] = 0) THEN CF := 1; 
ELSE CF := 0; 

DEST (unmodified) 

AF := OF := PF := SF := 0; 
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Intel C/C++ Compiler Intrinsic Equivalent 


PTEST 
int__mm_testz_si128 (__m128is1,__m128is2); 
int__mm_testc_si128 (__m128is1,__m128i s2); 


int__mm_testnzc_sil128 (__m128is1,__m128i s2); 
VPTEST 

int_mm256_testz_si256 (__m256i s1,__ m256i s2); 
int_mm256_testc_si256 (__m256is1,___m256i s2); 


int_mm256_testnzc_si256 (__m256is1,___m256i s2); 
int_mm_testz_sil128 (__m128is1,__m128i s2); 

m1 28i s2); 

m1 28i s2); 


int__mm_testc_si1 28 (__m128i s1, 


int__mm_testnzc_si128 (__m128i s1, 


Flags Affected 


The OF, AF, PF, SF flags are cleared and the ZF, CF flags are set according to the operation. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv # 1111B. 
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PTWRITE - Write Data to a Processor Trace Packet 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 REX.W OF AE /4 RM |V/N.E Reads the data from r64/m64 to encode into a 
PTWRITE r64/m64 PTW packet if dependencies are met (see 
details below). 
F3 OF AE /4 RM | V/V Reads the data from r32/m32 to encode into a 
PTWRITE r32/m32 PTW packet if dependencies are met (see 
details below). 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:rm (r) NA NA NA 
Description 


This instruction reads data in the source operand and sends it to the Intel Processor Trace hardware to be encoded 
in a PTW packet if TriggerEn, ContextEn, FilterEn, and PTWEn are all set to 1. For more details on these values, see 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C, Section 31.2.2, “Software Trace 
Instrumentation with PTWRITE”. The size of data is 64-bit if using REX.W in 64-bit mode, otherwise 32-bits of data 
are copied from the source operand. 


Note: The instruction will #UD if prefix 66H is used. 


Operation 
IF (IA32_RTIT_STATUS.TriggerEn & IA32_RTIT_STATUS.Context€n & IA32_RTIT_STATUS.FilterEn & IA32_RTIT_CTL.PTWEn) = 1 
PTW.PayloadBytes := Encoded payload size; 
PTW.IP := IA32_RTIT_CTL.FUPonPTW 
IF IA32_RTIT_CTL.FUPonPTW = 1 
Insert FUP packet with IP of PTWRITE; 
Fl; 
Fl; 


Flags Affected 
None. 


Other Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS or GS segments. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF (fault-code) For a page fault. 

#AC(0) If an unaligned memory reference is made while the current privilege level is 3 and alignment 
checking is enabled. 

#UD If CPUID.(EAX=14H, ECX=0):EBX.PTWRITE [Bit 4] = 0. 


If LOCK prefix is used. 
If 66H prefix is used. 
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Real-Address Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#UD If CPUID.(EAX=14H, ECX=0):EBX.PTWRITE [Bit 4] = 0. 


If LOCK prefix is used. 
If 66H prefix is used. 


Virtual 8086 Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF (fault-code) For a page fault. 

#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 

#UD If CPUID.(EAX=14H, ECX=0):EBX.PTWRITE [Bit 4] = 0. 


If LOCK prefix is used. 
If 66H prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in Protected Mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If CPUID.(EAX=14H, ECX=0):EBX.PTWRITE [Bit 4] = 0. 


If LOCK prefix is used. 
If 66H prefix is used. 
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PUNPCKHBW/PUNPCKHWD/PUNPCKHDQ/PUNPCKHQDQ— Unpack High Data 


xmm3/m128/m64bcst 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 68 /r' A VV MMX Unpack and interleave high-order bytes from 
PUNPCKHBW mm, mm/m64 mm and mm/m64 into mm. 
66 OF 68 /r A VIV SSE2 Unpack and interleave high-order bytes from 
PUNPCKHBW xmm1, xmm2/m128 xmm1 and xmm2/m128 into xmm1. 
NP OF 69 /r' A VIV MMX Unpack and interleave high-order words from 
PUNPCKHWD mm, mm/m64 mm and mm/m64 into mm. 
66 OF 69 /r A VIV SSE2 Unpack and interleave high-order words from 
PUNPCKHWD xmm1, xmm2/m128 xmm1 and xmm2/m128 into xmm1. 
NP OF 6A /r' A VIV MMX Unpack and interleave high-order 
PUNPCKHDQ mm, mm/m64 doublewords from mm and mm/m64 into mm. 
66 OF 6A /r A VIV SSE2 Unpack and interleave high-order 
PUNPCKHDQ xmm1, xmm2/m128 doublewords from xmm1 and xmm2/m128 
into xmm1. 
66 OF 6D /r A VIV SSE2 Unpack and interleave high-order quadwords 
PUNPCKHQDQ xmm1, xmm2/m128 from xmm17 and xmm2/m128 into xmm1. 
VEX.128.66.0F.WIG 68/r B VIV AVX Interleave high-order bytes from xmm2 and 
VPUNPCKHBW xmm1,xmm2, xmm3/m128 xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 69/r B VV AVX Interleave high-order words from xmm2 and 
VPUNPCKHWD xmm1,xmm2, xmm3/m128 xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 6A/r B VIV AVX Interleave high-order doublewords from 
VPUNPCKHDQ xmm1, xmm2, xmm3/m128 xmmeé and xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 6D/r B VIV AVX Interleave high-order quadword from xmm2 
VPUNPCKHQDQ xmm7, xmm2, xmm3/m128 and xmm3/m128 into xmm1 register. 
VEX.256.66.0F.WIG 68 /r B VIV AVX2 Interleave high-order bytes from ymm2 and 
VPUNPCKHBW ymm1, ymm2, ymm3/m256 ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 69 /r B VN AVX2 Interleave high-order words from ymm2 and 
VPUNPCKHWD ymm17, ymm2, ymm3/m256 ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 6A /r B VV AVX2 Interleave high-order doublewords from 
VPUNPCKHDQ ymm7, ymm2, ynm3/m256 ymme2 and ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 6D /r B VIN AVX2 Interleave high-order quadword from ymm2 
VPUNPCKHQDQ ymm1, ymm2, ymm3/m256 and ymm3/m256 into ymm1 register. 
EVEX.128.66.0F.WIG 68 /r C VIN AVX512VL | Interleave high-order bytes from xmm2 and 
VPUNPCKHBW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 into xmm1 register using k1 
write mask. 
EVEX.128.66.0F.WIG 69 /r C VIN AVX512VL | Interleave high-order words from xmme2 and 
VPUNPCKHWD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 into xmm1 register using k1 
write mask. 
EVEX.128.66.0F.WO 6A /r D VIV AVX512VL | Interleave high-order doublewords from 
VPUNPCKHDQ xmm1 {k1}{z}, xmm2, AVX512F = | xmm2 and xmm3/m128/m32bcst into xmm1 
xmm3/m128/m32bcst register using k1 write mask. 
EVEX.128.66.0F.W1 6D /r D VIN AVX512VL | Interleave high-order quadword from xmm2 
VPUNPCKHQDQ xmm1 {k1}{z}, xmm2, AVX512F | and xmm3/m128/m64bcst into xmm1 


register using k1 write mask. 
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EVEX.256.66.0F.WIG 68 /r VIV AVX512VL | Interleave high-order bytes from ymm2 and 
VPUNPCKHBW ymm1 {k1}{z}, ynm2, ymm3/m256 AVX512BW | ymm3/m256 into ymm1 register using k1 
write mask. 
EVEX.256.66.0F.WIG 69 /r VIV AVX512VL | Interleave high-order words from ymm2 and 
VPUNPCKHWD ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 into ymm1 register using k1 
write mask. 
EVEX.256.66.0F.WO 6A /r VIV AVX512VL | Interleave high-order doublewords from 
VPUNPCKHDQ ymm1 {k1}{z}, ymm2, AVX512F = | ymm2 and ymm3/m256/m32bcst into ymm1 
ymm3/m256/m32bcst register using k1 write mask. 
EVEX.256.66.0F.W1 6D /r VV AVX512VL | Interleave high-order quadword from ymm2 
VPUNPCKHQDQ ymm1 {k1}{z}, ymm2, AVX512F — | and ymm3/m256/m64bcst into ymm1 
ymm3/m256/m64bcst register using k1 write mask. 
EVEX.512.66.0F.WIG 68/r VIV AVX512BW | Interleave high-order bytes from zmm2 and 
VPUNPCKHBW zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 into zmm1 register. 
EVEX.512.66.0F.WIG 69/r VIV AVX512BW | Interleave high-order words from zmm2 and 
VPUNPCKHWD zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 into zmm1 register. 
EVEX.512.66.0F.WO 6A /r VIV AVX512F | Interleave high-order doublewords from 
VPUNPCKHDQ zmm1 {k1}{z}, zmm2, zmm2 and zmm3/m512/m32bcst into zmm1 
zmm3/m512/m32bcst register using k1 write mask. 
EVEX.512.66.0F.W1 6D /r VIV AVX512F | Interleave high-order quadword from zmm2 
VPUNPCKHQDQ zmm1 {k1}{z}, zmm2, and zmm3/m51 2/m64bcst into zmm1 register 
zmm3/m512/m64bcst using k1 write mask. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Unpacks and interleaves the high-order data elements (bytes, words, doublewords, or quadwords) of the destina- 
tion operand (first operand) and source operand (second operand) into the destination operand. Figure 4-20 shows 
the unpack operation for bytes in 64-bit operands. The low-order data elements are ignored. 
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SRC} Y7 | Y6 | Y5| Y4 | Y3 | Y2 | Y1| YO X7 | X6 | X5| X4 | X3 | X2 | X1 | XO | DEST 


DEST] Y7 | X7 | Y6 | X6| Y5 | X5 | Y4 | X4 


Figure 4-20. PUNPCKHBW Instruction Operation Using 64-bit Operands 


255 31 0 255 31 0 


SRC] Y7 | Y6 | Y5| Y4 | Y3 | Y2 | Y1 | YO X7 | X6 | XS} X4 | X3 | X2 | X1 | XO 


5 oS 4 
y—~ {™~ i> 
ces rDev ef ve fe 


Figure 4-21. 256-bit VPUNPCKHDQ Instruction Operation 


When the source data comes from a 64-bit memory operand, the full 64-bit operand is accessed from memory, but 
the instruction uses only the high-order 32 bits. When the source data comes from a 128-bit memory operand, an 
implementation may fetch only the appropriate 64 bits; however, alignment to a 16-byte boundary and normal 
segment checking will still be enforced. 


The (V)PUNPCKHBW instruction interleaves the high-order bytes of the source and destination operands, the 
(V)PUNPCKHWD instruction interleaves the high-order words of the source and destination operands, the 
(V)PUNPCKHDQ instruction interleaves the high-order doubleword (or doublewords) of the source and destination 
operands, and the (V)PUNPCKHQDQ instruction interleaves the high-order quadwords of the source and destina- 
tion operands. 


These instructions can be used to convert bytes to words, words to doublewords, doublewords to quadwords, and 
quadwords to double quadwords, respectively, by placing all Os in the source operand. Here, if the source operand 
contains all Os, the result (stored in the destination operand) contains zero extensions of the high-order data 
elements from the original value in the destination operand. For example, with the (V)PUNPCKHBW instruction the 
high-order bytes are zero extended (that is, unpacked into unsigned word integers), and with the (V)PUNPCKHWD 
instruction, the high-order words are zero extended (unpacked into unsigned doubleword integers). 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE versions 64-bit operand: The source operand can be an MMX technology register or a 64-bit memory 
location. The destination operand is an MMX technology register. 


128-bit Legacy SSE versions: The second source operand is an XMM register or a 128-bit memory location. The 
first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 
destination register remain unchanged. 


VEX.128 encoded versions: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 
are zeroed. 


VEX.256 encoded version: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. 
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EVEX encoded VPUNPCKHDQ/QDQ: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. The first source 
operand and destination operands are ZMM/YMM/XMM registers. The destination is conditionally updated with 


writemask k1. 


EVEX encoded VPUNPCKHWD/BW: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination 


is conditionally updated with writemask k1. 


Operation 


PUNPCKHBW instruction with 64-bit operands: 


DEST[7:0] := DEST[39:32]; 
DEST[15:8] := SRC[39:32]; 
DEST[23:16] := DEST[47:40]; 
DEST[31:24] := SRC[47:40]; 
DEST[39:32] := DEST[55:48]; 
DEST[47:40] := SRC[55:48]; 
DEST[55:48] := DEST[63:56]; 
DEST[63:56] := SRC[63:56]; 


PUNPCKHW instruction with 64-bit operands: 


DEST[15:0] := DEST[47:32]; 
DEST[31:16] := SRC[47:32]; 
DEST[47:32] := DEST[63:48]; 
DEST[63:48] := SRC[63:48]; 


PUNPCKHDQ instruction with 64-bit operands: 


DEST[31:0] := DEST[63:32]; 
DEST[63:32] := SRC[63:32]; 


INTERLEAVE_HIGH_BYTES_512b (SRC1, SRC2) 


TMP_DEST[255:0] := INTERLEAVE_HIGH_BYTES_256b(SRC1[255:0], SRC[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_HIGH_BYTES_256b(SRC1[51 1:256], SRC[511:256]) 


INTERLEAVE_HIGH_BYTES_256b (SRC1, SRC2) 


DEST[7:0] = SRC1[71:64] 
DEST[15:8] := SRC2[71:64] 
DEST[23:16] = SRC1[79:72] 
DEST[31:24] = SRC2[79:72] 
DEST[39:32] = SRC1[87:80] 
DEST[47:40] = SRC2[87:80] 
DEST[55:48] = SRC1[95:88] 
DEST[63:56] = SRC2[95:88] 
DEST[71:64] := SRC1[103:96] 
DEST[79:72] := SRC2[103:96] 


DEST[87:80] = SRC1[111:104] 
DEST[95:88] = SRC2[111:104] 
DEST[103:96] := SRC1[119:112] 
DEST[111:104] := SRC2[119:112] 
DEST[119:112] = SRC1[127:120] 
DEST[127:120] := SRC2[127:120] 
DEST[135:128] = SRC1[199:192] 
DEST[143:136] := SRC2[199:192] 
DEST[151:144] := SRC1[207:200] 
DEST[159:152] := SRC2[207:200] 
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DEST[167:160] := SRC1[215:208] 
DEST[175:168] := SRC2[215:208] 
DEST[183:176] := SRC1[223:216] 
DEST[191:184] := SRC2[223:216] 
DEST[199:192] := SRC1[231:224] 
DEST[207:200] := SRC2[231:224] 
DEST[215:208] := SRC1[239:232] 
DEST[223:216] := SRC2[239:232] 
DEST[231:224] := SRC1[247:240] 
DEST[239:232] := SRC2[247:240] 
DEST[247:240] := SRC1[255:248] 
DEST[255:248] := SRC2[255:248] 


INTERLEAVE_HIGH_BYTES (SRC1, SRC2) 
DEST[7:0] = SRC1[71:64] 
DEST[15:8] := SRC2[71:64] 
DEST[23:16] = SRC1[79:72] 
DEST[31:24] = SRC2[79:72] 
DEST[39:32] := SRC1[87:80] 
DEST[47:40] := SRC2[87:80] 
DEST[55:48] := SRC1[95:88] 
DEST[63:56] = SRC2[95:88] 
DEST[71:64] := SRC1[103:96] 
DEST[79:72] := SRC2[103:96] 
DEST[87:80] := SRC1[111:104] 
DEST[95:88] = SRC2[111:104] 
DEST[103:96] := SRC1[119:112] 
DEST[111:104] := SRC2[119:112] 
DEST[119:112] := SRC1[127:120] 
DEST[127:120] := SRC2[127:120] 


INTERLEAVE_HIGH_WORDS_512b (SRC1, SRC2) 
TMP_DEST[255:0] := INTERLEAVE_HIGH_WORDS_256b(SRC1[255:0], SRC[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_HIGH_WORDS_256b(SRC1[511:256], SRC[511:256]) 


INTERLEAVE_HIGH_WORDS_256b(SRC1, SRC2) 
DEST[15:0] := SRC1[79:64] 
DEST[31:16] = SRC2[79:64] 
DEST[47:32] = SRC1[95:80] 
DEST[63:48] = SRC2[95:80] 
DEST[79:64] := SRC1[111:96] 
DEST[95:80] := SRC2[111:96] 
DEST[111:96] := SRC1[127:112] 
DEST[127:112] = SRC2[127:112] 
DEST[143:128] := SRC1[207:192] 
DEST[159:144] := SRC2[207:192] 
DEST[175:160] := SRC1[223:208] 
DEST[191:176] := SRC2[223:208] 
DEST[207:192] := SRC1[239:224] 
DEST[223:208] := SRC2[239:224] 
DEST[239:224] := SRC1[255:240] 
DEST[255:240] := SRC2[255:240] 


INTERLEAVE_HIGH_WORDS (SRC1, SRC2) 
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DEST[15:0] := SRC1[79:64] 
DEST[31:16] = SRC2[79:64] 
DEST[47:32] = SRC1[95:80] 
DEST[63:48] = SRC2[95:80] 
DEST[79:64] := SRC1[111:96] 
DEST[95:80] := SRC2[111:96] 
DEST[111:96] := SRC1[127:112] 
DEST[127:112] := SRC2[127:112] 


INTERLEAVE_HIGH_DWORDS_512b (SRC1, SRC2) 
TMP_DEST[255:0] := INTERLEAVE_HIGH_DWORDS_256b(SRC1[255:0], SRC2[255:0)]) 
TMP_DEST[51 1:256] := INTERLEAVE_HIGH_DWORDS_256b(SRC1[51 1:256], SRC2[511:256]) 


INTERLEAVE_HIGH_DWORDS_256D(SRC1, SRC2) 
DEST[31:0] := SRC1[95:64] 

DEST[63:32] = SRC2[95:64] 

DEST[95:64] := SRC1[127:96] 

DEST[127:96] := SRC2[127:96] 

DEST[159:128] := SRC1[223:192] 
DEST[191:160] := SRC2[223:192] 
DEST[223:192] := SRC1[255:224] 
DEST[255:224] := SRC2[255:224] 


INTERLEAVE_HIGH_DWORDS(SRC1, SRC2) 
DEST[31:0] := SRC1[95:64] 

DEST[63:32] = SRC2[95:64] 

DEST[95:64] := SRC1[127:96] 
DEST[127:96] := SRC2[127:96] 


INTERLEAVE_HIGH_QWORDS_51 2b (SRC1, SRC2) 
TMP_DEST[255:0] := INTERLEAVE_HIGH_QWORDS_256b(SRC1[255:0], SRC2[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_HIGH_QWORDS_256b(SRC1[511:256], SRC2[511:256]) 


INTERLEAVE_HIGH_QWORDS_256b(SRC1, SRC2) 
DEST[63:0] := SRC1[127:64] 

DEST[127:64] := SRC2[127:64] 

DEST[191:128] = SRC1[255:192] 
DEST[255:192] := SRC2[255:192] 


INTERLEAVE_HIGH_QWORDS(SRC1, SRC2) 
DEST[63:0] := SRC1[127:64] 
DEST[127:64] := SRC2[127:64] 


PUNPCKHBW (128-bit Legacy SSE Version) 
DEST[127:0] := INTERLEAVE_HIGH_BYTES(DEST, SRC) 
DEST[255:127] (Unmodified) 


VPUNPCKHBW (VEX.128 encoded version) 
DEST[127:0] := INTERLEAVE_HIGH_BYTES(SRC1, SRC2) 
DEST[MAXVL-1:127] := 0 


VPUNPCKHBW (VEX.256 encoded version) 


DEST[255:0] := INTERLEAVE_HIGH_BYTES_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 
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VPUNPCKHBW (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_BYTES(SRC1[VL-1:0], SRC2[VL-1:0]) 


Fl; 
IF VL = 256 

TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_BYTES_256b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 
IFVL=512 

TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_BYTES_51 2b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TMP_DEST[i+7:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


PUNPCKHWD (128-bit Legacy SSE Version) 
DEST[127:0] := INTERLEAVE_HIGH_WORDS(DEST, SRC) 
DEST[255:127] (Unmodified) 


VPUNPCKHWD (VEX.128 encoded version) 
DEST[127:0] := INTERLEAVE_HIGH_WORDS(SRC1, SRC2) 
DEST[MAXVL-1:127] := 0 


VPUNPCKHWD (VEX.256 encoded version) 
DEST[255:0] := INTERLEAVE_HIGH_WORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKHWD (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL = 128 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_WORDS(SRC1[VL-1:0], SRC2[VL-1:0]) 


Fl; 
IF VL = 256 

TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_WORDS_256b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 
IF VL=512 

TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_WORDS_512b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
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THEN DEST[i+15:i] = TMP_DEST[i+1 5:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


PUNPCKHDQ (128-bit Legacy SSE Version) 
DEST[127:0] := INTERLEAVE_HIGH_DWORDS(DEST, SRC) 
DEST[255:127] (Unmodified) 


VPUNPCKHDQ (VEX.128 encoded version) 
DEST[127:0] := INTERLEAVE_HIGH_DWORDS(SRC1, SRC2) 
DEST[MAXVL-1:127] := 0 


VPUNPCKHDQ (VEX.256 encoded version) 
DEST[255:0] := INTERLEAVE_HIGH_DWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKHDQ (EVEX.512 encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_DWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL = 256 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_DWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL=512 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_DWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] := TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
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DEST[MAXVL-1:VL] := 0 


PUNPCKHQDQ (128-bit Legacy SSE Version) 
DEST[127:0] := INTERLEAVE_HIGH_QWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


VPUNPCKHQDQ (VEX.128 encoded version) 
DEST[1 27:0] := INTERLEAVE_HIGH_QWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPUNPCKHQDQ (VEX.256 encoded version) 
DEST[255:0] := INTERLEAVE_HIGH_QWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKHQDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:= 0 TO KL-1 
i:=j*64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2[i+63:i] := SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_QWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL = 256 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_QWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL=512 
TMP_DEST[VL-1:0] := INTERLEAVE_HIGH_QWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 
VPUNPCKHBW __m512i_mm512_unpackhi_epi8(__m512i a, 
VPUNPCKHBW __m512i__mm512_mask_unpackhi_epi8(__m512is,__ mmask64 k,__m512i a, ___m512i b); 
VPUNPCKHBW __m512i_mm512_maskz_unpackhi_epi8(___ mmask64 k,__m512i a, __m512i b); 
VPUNPCKHBW __m256i __mm256_mask_unpackhi_epi8(__m256i s,__ mmask32 k,_ m256i a, __m256i b); 
VPUNPCKHBW __m256i__mm256_maskz_unpackhi_epi8(___mmask32 k,__ m256i a, __m256i b); 
VPUNPCKHBW __m128i __mm_mask_unpackhi_epi8(v s,__ mmask16 k,___m128i a, ___m128i b); 


m512i b); 


PUNPCKHBW/PUNPCKHWD/PUNPCKHDQ/PUNPCKHQDQ— Unpack High Data Vol.2B 4-509 


INSTRUCTION SET REFERENCE, M-U 


VPUNPCKHBW __m128i __mm_maskz_unpackhi_epi8(__mmask16 k, __m128i a, 
VPUNPCKHWD __m512i_mm512_unpackhi_epi16(__m512i a,__m512i b); 
VPUNPCKHWD __m512i_mm512_mask_unpackhi_epi16(__m512i s,__ mmask32 k, 
VPUNPCKHWD __m512i_mm512_maskz_unpackhi_epi16(__mmask32 k,___m512i a, 
VPUNPCKHWD __m256i__mm256_mask_unpackhi_epi16(__m256i s,__ mmask16 k,__ m256i a, 
VPUNPCKHWD __m256i __mm256_maskz_unpackhi_epi16(__mmask16 k,__ m256i a, __m256i b); 
VPUNPCKHWD __m128i__mm_mask_unpackhi_epi16(v s,__ mmask8 k,__m128i a, ___m128i b); 
VPUNPCKHWD __m128i__mm_maskz_unpackhi_epi16(__mmask8 k, __m128i a,__m128i b); 
VPUNPCKHDQ __m512i_mm512_unpackhi_epi32(__m512i a, ___m512i b); 

VPUNPCKHDQ __m512i__mm512_mask_unpackhi_epi32(__m512i s,___mmask16 k,__m512i a, ___m512i b); 
VPUNPCKHDQ __m512i __mm512_maskz_unpackhi_epi32(__mmask16 k, __m512i a, __m512i b); 
VPUNPCKHDQ __m256i__mm256_mask_unpackhi_epi32(__m512i s,___mmask8 k, __m512i a, __m512i b); 
VPUNPCKHDQ __m256i __mm256_maskz_unpackhi_epi32(_mmask8 k, __m512i a, _m512i b); 
VPUNPCKHDQ __m128i __mm_mask_unpackhi_epi32(__m512i s,___mmask8 k,__m512i a, ___m512i b); 
VPUNPCKHDQ __m128i __mm_maskz_unpackhi_epi32(__mmask8 k, __m512i a, ___m512i b); 
VPUNPCKHQDQ __m512i__mm512_unpackhi_epi64(__m512i a, __m512i b); 


m128i b); 


m512ia, 
m512i b); 


m512i b); 


m256i b); 


VPUNPCKHQDQ __m512i__mm512_mask_unpackhi_epi64(__m512i s, __mmask8 k,___m512i a, __m512i b); 
VPUNPCKHQDQ __m512i__mm512_maskz_unpackhi_epi64(_mmask8 k,___m512i a, ___m512i b); 
VPUNPCKHQDQ __m256i _mm256_mask_unpackhi_epi64(__m512i s, _ mmask8 k,___m512i a, ___m512i b); 


VPUNPCKHQDQ __m256i _mm256_maskz_unpackhi_epi64(__mmask8 k, __m512i a, __m512i b); 
VPUNPCKHQDQ __m128i _mm_mask_unpackhi_epi64(__m512i s,___mmask8 k, __m512i a,__m512i b); 
VPUNPCKHQDQ __m128i _mm_maskz_unpackhi_epi64(__mmask8 k, __m512i a, ___m512i b); 
PUNPCKHBW:__m64 _mm_unpackhi_pi8(__m64 m1, ___ m64 m2) 

(V)PUNPCKHBW:__m128i _mm_unpackhi_epi8(__m128i m1, ___m128i m2) 
VPUNPCKHBW:__m256i_mm256_unpackhi_epi8(__m256i m1, ___ m256i m2) 
PUNPCKHWD:__m64 _mm_unpackhi_pi16(__m64 m1,__m64 m2) 

(V)PUNPCKHWD:__m128i __mm_unpackhi_epi16(__m128i m1,__m128i m2) 
VPUNPCKHWD:__m256i _mm256_unpackhi_epi16(__m256i m1,__m256i m2) 
PUNPCKHDQ:__m64 _mm_unpackhi_pi32(__m64 m1, ___m64 m2) 

(V)PUNPCKHDQ:__m128i _mm_unpackhi_epi32(__m128i m1, ___m128i m2) 
VPUNPCKHDQ:__m256i _mm256_unpackhi_epi32(__m256i m1, ___m256i m2) 
(V)PUNPCKHQDQ:__m128i _mm_unpackhi_epi64 (__m128i a, __m128i b) 
VPUNPCKHQDQ:__m256i __mm256_unpackhi_epi64 (__m256i a, __m256i b) 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPUNPCKHQDQ/QDQ, see Table 2-50, “Type E4NF Class Exception Conditions”. 


EVEX-encoded VPUNPCKHBW/WD, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Condi- 
tions”. 
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PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PUNPCKLQDQ—Unpack Low Data 


xmm3/m128/m64bcst 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 60 /r’ A VV MMX Interleave low-order bytes from mm and 
PUNPCKLBW mm, mm/m32 mm/m32 into mm. 
66 OF 60 /r A VV SSE2 Interleave low-order bytes from xmm7 and 
PUNPCKLBW xmm1, xmm2/m128 xmme/m128 into xmm1. 
NP OF 61 /r' A VV MMX Interleave low-order words from mm and 
PUNPCKLWD mm, mm/m32 mm/m32 into mm. 
66 OF 61 /r A VV SSE2 Interleave low-order words from xmm7 and 
PUNPCKLWD xmm1, xmm2/m128 xmm2/m128 into xmm1. 
NP OF 62 /r' A VV MMX Interleave low-order doublewords from mm 
PUNPCKLDQ mm, mm/m32 and mm/m32 into mm. 
66 OF 62 /r A VIN SSE2 Interleave low-order doublewords from xmm1 
PUNPCKLDQ xmm1, xmm2/m128 and xmm2/m128 into xmm1. 
66 OF 6C /r A VIV SSE2 Interleave low-order quadword from xmm1 
PUNPCKLOQDQ xmm1, xmm2/m128 and xmm2/m128 into xmm1 register. 
VEX.128.66.0F.WIG 60/r B VIV AVX Interleave low-order bytes from xmm2 and 
VPUNPCKLBW xmm1,xmm2, xmm3/m128 xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 61/r B VN AVX Interleave low-order words from xmm2 and 
VPUNPCKLWD xmm1.xmm2, xmm3/m128 xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 62/r B VV AVX Interleave low-order doublewords from xmm2 
VPUNPCKLDQ xmm1, xmm2, xmm3/m128 and xmm3/m128 into xmm1. 
VEX.128.66.0F.WIG 6C/r B VIV AVX Interleave low-order quadword from xmm2 
VPUNPCKLQDQ xmm1, xmm2, xmm3/m128 and xmm3/m128 into xmm1 register. 
VEX.256.66.0F.WIG 60 /r B VIV AVX2 Interleave low-order bytes from ymm2 and 
VPUNPCKLBW ymm1, ymm2, ymm3/m256 ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 61 /r B VIV AVX2 Interleave low-order words from ymm2 and 
VPUNPCKLWD ymm1, ymm2, ymm3/m256 ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 62 /r B VIV AVX2 Interleave low-order doublewords from ymm2 
VPUNPCKLDQ ymm1, ymm2, ymm3/m256 and ymm3/m256 into ymm1 register. 
VEX.256.66.0F.WIG 6C /r B VV AVX2 Interleave low-order quadword from ymm2 
VPUNPCKLQDQ ymm1, ymm2, ymm3/m256 and ymm3/m256 into ymm1 register. 
EVEX.128.66.0F.WIG 60 /r C VIV AVX512VL | Interleave low-order bytes from xmm2 and 
VPUNPCKLBW xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 into xmm1 register subject to 
write mask k1. 
EVEX.128.66.0F.WIG 61 /r c VIN AVX512VL | Interleave low-order words from xmm2 and 
VPUNPCKLWD xmm1 {k1}{z}, xmm2, xmm3/m128 AVX512BW | xmm3/m128 into xmm1 register subject to 
write mask k1. 
EVEX.128.66.0F.W0 62 /r D VIN AVX512VL | Interleave low-order doublewords from xmm2 
VPUNPCKLDQ xmm1 {k1}{z}, xmm2, AVX512F | and xmm3/m128/m32bcst into xmm1 
xmm3/m128/m32bcst register subject to write mask k1. 
EVEX.128.66.0F.W1 6C /r D VIV AVX512VL | Interleave low-order quadword from zmm2 
VPUNPCKLQDQ xmm1 {k1}{z}, xmm2, AVX512F | and zmm3/m512/m64bcst into zmm1 


register subject to write mask k1. 
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EVEX.256.66.0F.WIG 60 /r VIV AVX512VL | Interleave low-order bytes from ymm2 and 
VPUNPCKLBW ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 into ymm1 register subject to 
write mask k1. 
EVEX.256.66.0F.WIG 61 /r VIV AVX512VL | Interleave low-order words from ymm2 and 
VPUNPCKLWD ymm1 {k1}{z}, ymm2, ymm3/m256 AVX512BW | ymm3/m256 into ymm1 register subject to 
write mask k1. 
EVEX.256.66.0F.WO 62 /r VIV AVX512VL | Interleave low-order doublewords from ymm2 
VPUNPCKLDQ ymm1 {k1}{z}, ymm2, AVX512F | and ymm3/m256/m32bcst into ymm1 
ymm3/m256/m32bcst register subject to write mask k1. 
EVEX.256.66.0F.W1 6C /r VIV AVX512VL | Interleave low-order quadword from ymm2 
VPUNPCKLQDQ ymm1 {k1}{z}, ymm2, AVX512F | and ymm3/m256/m64bcst into ymm1 
ymm3/m256/m64bcst register subject to write mask k1. 
EVEX.512.66.0F.WIG 60/r VV AVX512BW | Interleave low-order bytes from zmm2 and 
VPUNPCKLBW zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 into zmm1 register subject to 
write mask k1. 
EVEX.512.66.0F.WIG 61/r VV AVX512BW | Interleave low-order words from zmm2 and 
VPUNPCKLWD zmm1 {k1}{z}, zmm2, zmm3/m512 zmm3/m512 into zmm1 register subject to 
write mask k1. 
EVEX.512.66.0F.W0 62 /r VV AVX512F | Interleave low-order doublewords from zmm2 
VPUNPCKLDQ zmm1 {k1}{z}, zmm2, and zmm3/m51 2/m32bcst into zmm1 
zmm3/m512/m32bcst register subject to write mask k1. 
EVEX.512.66.0F.W1 6C /r VIV AVX512F _ | Interleave low-order quadword from zmm2 
VPUNPCKLQDQ zmm1 {k1}{z}, zmm2, and zmm3/m512/m64bcst into zmm1 
zmm3/m512/m64bcst register subject to write mask k1. 
NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Unpacks and interleaves the low-order data elements (bytes, words, doublewords, and quadwords) of the destina- 
tion operand (first operand) and source operand (second operand) into the destination operand. (Figure 4-22 
shows the unpack operation for bytes in 64-bit operands.). The high-order data elements are ignored. 
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SRC} Y7 | Y6 | Y5| Y4 | Y3 | Y2 | Y1 | YO X7 | X6 | X5| X4 | X3 | X2 | X1 | XO | DEST 


DEST] Y3 | X3 | Y2 | X2| Y1 | X1 | YO | XO 


Figure 4-22. PUNPCKLBW Instruction Operation Using 64-bit Operands 


255 310 255 31 0 
SRC} Y7 | Y6 | Y5| Y4 | Y3 | Y2 | Y1 | Yo X7 | X6 | X5| X4 | X3 | X2 | X1 | XO 
55 0 


DEST] Y5 | X5 | Y4 | X4] Y1 | X1 | YO | XO 


Figure 4-23. 256-bit VPUNPCKLDQ Instruction Operation 


When the source data comes from a 128-bit memory operand, an implementation may fetch only the appropriate 
64 bits; however, alignment to a 16-byte boundary and normal segment checking will still be enforced. 


The (V)PUNPCKLBW instruction interleaves the low-order bytes of the source and destination operands, the 
(V)PUNPCKLWD instruction interleaves the low-order words of the source and destination operands, the 
(V)PUNPCKLDQ instruction interleaves the low-order doubleword (or doublewords) of the source and destination 
operands, and the (V)PUNPCKLQDQ instruction interleaves the low-order quadwords of the source and destination 
operands. 


These instructions can be used to convert bytes to words, words to doublewords, doublewords to quadwords, and 
quadwords to double quadwords, respectively, by placing all Os in the source operand. Here, if the source operand 
contains all Os, the result (stored in the destination operand) contains zero extensions of the high-order data 
elements from the original value in the destination operand. For example, with the (V)PUNPCKLBW instruction the 
high-order bytes are zero extended (that is, unpacked into unsigned word integers), and with the (V)PUNPCKLWD 
instruction, the high-order words are zero extended (unpacked into unsigned doubleword integers). 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE versions 64-bit operand: The source operand can be an MMX technology register or a 32-bit memory 
location. The destination operand is an MMX technology register. 


128-bit Legacy SSE versions: The second source operand is an XMM register or a 128-bit memory location. The 
first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM 
destination register remain unchanged. 


VEX.128 encoded versions: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 
are zeroed. 


VEX.256 encoded version: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corresponding ZMM 
register are zeroed. 
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EVEX encoded VPUNPCKLDQ/QDQ: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. The first source 
operand and destination operands are ZMM/YMM/XMM registers. The destination is conditionally updated with 


writemask k1. 


EVEX encoded VPUNPCKLWD/BW: The second source operand is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location. The first source operand and destination operands are ZMM/YMM/XMM registers. The destination 


is conditionally updated with writemask k1. 


Operation 


PUNPCKLBW instruction with 64-bit operands: 
DEST[63:56] := SRC[31:24]; 
DEST[55:48] := DEST[31:24]; 
DEST[47:40] := SRC[23:16]; 
DEST[39:32] := DEST[23:16]; 
DEST[31:24] := SRC[15:8]; 
DEST[23:16] := DEST[15:8); 
DEST[15:8] := SRC[7:0]; 
DEST[7:0] := DEST[7:0]; 


PUNPCKLWD instruction with 64-bit operands: 
DEST[63:48] := SRC[31:16]; 
DEST[47:32] := DEST[31:16]; 
DEST[31:16] := SRC[15:0); 
DEST[15:0] := DEST[15:0); 


PUNPCKLDQ instruction with 64-bit operands: 
DEST[63:32] := SRC[31:0]; 
DEST[31:0] := DEST[3 1:0); 
INTERLEAVE_BYTES_512b (SRC1, SRC2) 
TMP_DEST[255:0] := INTERLEAVE_BYTES_256b(SRC1[255:0], SRC[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_BYTES_256b(SRC1[51 1:256], SRC[511:256]) 


INTERLEAVE_BYTES_256b (SRC1, SRC2) 
DEST[7:0] = SRC1[7:0] 
DEST[15:8] := SRC2[7:0] 
DEST[23:16] = SRC1[15:8] 
DEST[31:24] = SRC2[15:8] 
DEST[39:32] = SRC1[23:16] 
DEST[47:40] := SRC2[23:16] 
DEST[55:48] = SRC1[31:24] 
DEST[63:56] = SRC2[31:24] 
DEST[7 1:64] = SRC1[39:32] 
DEST[79:72] := SRC2[39:32] 
DEST[87:80] = SRC1[47:40] 
DEST[95:88] = SRC2[47:40] 
DEST[103:96] := SRC1[55:48] 
DEST[111:104] := SRC2[55:48] 
DEST[119:112] = SRC1[63:56] 
DEST[127:120] := SRC2[63:56] 
DEST[135:128] := SRC1[135:128] 
DEST[143:136] := SRC2[135:128] 
DEST[151:144] := SRC1[143:136] 
DEST[159:152] := SRC2[143:136] 
DEST[167:160] := SRC1[151:144] 
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DEST[175:168] := SRC2[151:144] 
DEST[183:176] := SRC1[159:152] 
DEST[191:184] := SRC2[159:152] 
DEST[199:192] := SRC1[167:160] 
DEST[207:200] := SRC2[167:160] 
DEST[215:208] := SRC1[175:168] 
DEST[223:216] := SRC2[175:168] 
DEST[231:224] := SRC1[183:176] 
DEST[239:232] := SRC2[183:176] 
DEST[247:240] := SRC1[191:184] 
DEST[255:248] := SRC2[191:184] 


INTERLEAVE_BYTES (SRC1, SRC2) 
DEST[7:0] = SRC1[7:0] 
DEST[15:8] := SRC2[7:0] 
DEST[23:16] := SRC1[15:8] 
DEST[31:24] := SRC2[15:8] 
DEST[39:32] = SRC1[23:16] 
DEST[47:40] = SRC2[23:16] 
DEST[55:48] := SRC1[31:24] 
DEST[63:56] = SRC2[31:24] 
DEST[7 1:64] := SRC1[39:32] 
DEST[79:72] := SRC2[39:32] 
DEST[87:80] = SRC1[47:40] 
DEST[95:88] = SRC2[47:40] 
DEST[103:96] := SRC1[55:48] 
DEST[111:104] := SRC2[55:48] 
DEST[119:112] := SRC1[63:56] 
DEST[127:120] := SRC2[63:56] 


INTERLEAVE_WORDS_512b (SRC1, SRC2) 


TMP_DEST[255:0] := INTERLEAVE_WORDS_256b(SRC1[255:0], SRC[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_WORDS_256b(SRC1[51 1:256], SRC[51 1:256]) 


INTERLEAVE_WORDS_256b(SRC1, SRC2) 
DEST[15:0] := SRC1[15:0] 
DEST[31:16] = SRC2[15:0] 
DEST[47:32] = SRC1[31:16] 
DEST[63:48] = SRC2[31:16] 
DEST[79:64] := SRC1[47:32] 
DEST[95:80] := SRC2[47:32] 
DEST[111:96] := SRC1[63:48] 
DEST[127:112] := SRC2[63:48] 
DEST[143:128] := SRC1[143:128] 
DEST[159:144] := SRC2[143:128] 
DEST[175:160] := SRC1[159:144] 
DEST[191:176] := SRC2[159:144] 
DEST[207:192] := SRC1[175:160] 
DEST[223:208] := SRC2[175:160] 
DEST[239:224] := SRC1[191:176] 
DEST[255:240] := SRC2[191:176] 


INTERLEAVE_WORDS (SRC1, SRC2) 
DEST[15:0] := SRC1[15:0] 
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DEST[31:16] = SRC2[15:0] 
DEST[47:32] = SRC1[31:16] 
DEST[63:48] = SRC2[31:16] 
DEST[79:64] = SRC1[47:32] 
DEST[95:80] = SRC2[47:32] 
DEST[111:96] := SRC1[63:48] 
DEST[127:112] = SRC2[63:48] 


INTERLEAVE_DWORDS_51 2b (SRC1, SRC2) 
TMP_DEST[255:0] := INTERLEAVE_DWORDS_256b(SRC1[255:0], SRC2[255:0]) 
TMP_DEST[51 1:256] := INTERLEAVE_DWORDS_256b(SRC1[511:256], SRC2[511:256]) 


INTERLEAVE_DWORDS_256b(SRC1, SRC2) 
DEST[31:0] := SRC1[31:0] 

DEST[63:32] = SRC2[31:0] 

DEST[95:64] := SRC1[63:32] 
DEST[127:96] := SRC2[63:32] 
DEST[159:128] := SRC1[159:128] 
DEST[191:160] := SRC2[159:128] 
DEST[223:192] := SRC1[191:160] 
DEST[255:224] := SRC2[191:160] 


INTERLEAVE_DWORDS(SRC1, SRC2) 
DEST[31:0] := SRC1[31:0] 

DEST[63:32] = SRC2[31:0] 

DEST[95:64] := SRC1[63:32] 

DEST[127:96] := SRC2[63:32] 

INTERLEAVE_QWORDS_512b (SRC1, SRC2) 

TMP_DEST[255:0] := INTERLEAVE_QWORDS_256b(SRC1[255:0], SRC2[255:0]) 
TMP_DEST[511:256] := INTERLEAVE_QWORDS_256b(SRC1[511:256], SRC2[511:256]) 


INTERLEAVE_QWORDS_256b(SRC1, SRC2) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[191:128] = SRC1[191:128] 
DEST[255:192] := SRC2[191:128] 


INTERLEAVE_QWORDS(SRC1, SRC2) 
DEST[63:0] := SRC1[63:0] 
DEST[127:64] := SRC2[63:0] 


PUNPCKLBW 
DEST[127:0] := INTERLEAVE_BYTES(DEST, SRC) 
DEST[255:127] (Unmodified) 


VPUNPCKLBW (VEX.128 encoded instruction) 
DEST[127:0] := INTERLEAVE_BYTES(SRC1, SRC2) 
DEST[MAXVL-1:127] := 0 


VPUNPCKLBW (VEX.256 encoded instruction) 


DEST[255:0] := INTERLEAVE_BYTES_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 
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VPUNPCKLBW (EVEX.512 encoded instruction) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_BYTES(SRC1[VL-1:0], SRC2[VL-1:0]) 


Fl; 
IF VL = 256 

TMP_DEST[VL-1:0] := INTERLEAVE_BYTES_256b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 
IFVL=512 

TMP_DEST[VL-1:0] := INTERLEAVE_BYTES_512b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TMP_DEST[i+7:i] 


ELSE 

IF *merging-masking* ; mMerging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
DEST[51 1:0] := INTERLEAVE_BYTES_512b(SRC1, SRC2) 


PUNPCKLWD 
DEST[127:0] := INTERLEAVE_WORDS(DEST, SRC) 
DEST[255:127] (Unmodified) 


VPUNPCKLWD (VEX.128 encoded instruction) 
DEST[127:0] := INTERLEAVE_WORDS(SRC1, SRC2) 
DEST[MAXVL-1:127] := 0 


VPUNPCKLWD (VEX.256 encoded instruction) 
DEST[255:0] := INTERLEAVE_WORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKLWD (EVEX.512 encoded instruction) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_WORDS(SRC1[VL-1:0], SRC2[VL-1:0]) 


Fl; 
IF VL = 256 

TMP_DEST[VL-1:0] := INTERLEAVE_WORDS_256b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 
IF VL=512 

TMP_DEST[VL-1:0] := INTERLEAVE_WORDS_512b(SRC1[VL-1:0], SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
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THEN DEST[i+15:i] = TMP_DEST[i+1 5:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
DEST[51 1:0] := INTERLEAVE_WORDS_512b(SRC1, SRC2) 


PUNPCKLDQ 
DEST[127:0] := INTERLEAVE_DWORDS(DEST, SRC) 
DEST[MAXVL-1:128] (Unmodified) 


VPUNPCKLDQ (VEX.128 encoded instruction) 
DEST[127:0] := INTERLEAVE_DWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPUNPCKLDQ (VEX.256 encoded instruction) 
DEST[255:0] := INTERLEAVE_DWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKLDQ (EVEX encoded instructions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL= 128 


TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 


Fl; 
IF VL = 256 


TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 


Fl; 
IF VL=512 


TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 


Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] := TMP_DEST[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 


Fl; 
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ENDFOR 
DEST51 1:0] := INTERLEAVE_DWORDS_512b(SRC1, SRC2) 
DEST[MAXVL-1:VL] := 0 


PUNPCKLQDQ 
DEST[127:0] := INTERLEAVE_QWORDS(DEST, SRC) 
DEST[MAXVL-1:1 28] (Unmodified) 


VPUNPCKLQDQ (VEX.128 encoded instruction) 
DEST[1 27:0] := INTERLEAVE_QWORDS(SRC1, SRC2) 
DEST[MAXVL-1:128] := 0 


VPUNPCKLQDQ (VEX.256 encoded instruction) 
DEST[255:0] := INTERLEAVE_QWORDS_256b(SRC1, SRC2) 
DEST[MAXVL-1:256] := 0 


VPUNPCKLQDQ (EVEX encoded instructions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:= 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2[i+63:i] := SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL= 128 
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL = 256 
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 
IF VL=512 
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0]) 
Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 

VPUNPCKLBW __m512i_mm512_unpacklo_epi8(__m512i a,__m512ib); 
VPUNPCKLBW __m512i_mm512_mask_unpacklo_epi8(__m512is,__mmask64 k,___m512i a,__m512i b); 
VPUNPCKLBW __m512i_mm512_maskz_unpacklo_epi8(__mmask64 k,__m512i a,__m512ib); 
VPUNPCKLBW __m256i__mm256_mask_unpacklo_epi8(__m256i s,__ mmask32 k,__ m256i a, 


m256i b); 
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VPUNPCKLBW __m256i__mm256_maskz_unpacklo_epi8(__mmask32 k,__ m256i a, ___m256i b); 
VPUNPCKLBW __m128i __mm_mask_unpacklo_epi8(v s,__ mmask16 k, __m128i a,__m128i b); 
VPUNPCKLBW __m128i __mm_maskz_unpacklo_epi8(__mmask16 k,___m128i a,__m128i b); 
VPUNPCKLWD __m512i_mm512_unpacklo_epi16(__m512i a,__m512i b); 

VPUNPCKLWD __m512i_mm512_mask_unpacklo_epi16(__m512is,__mmask32 k,__m512i a, 
VPUNPCKLWD __m512i__mm512_maskz_unpacklo_epi16(__ mmask32 k,___m512i a,__m512i b); 
VPUNPCKLWD __m256i__mm256_mask_unpacklo_epi16(__m256is,__ mmask16 k, __ m256i a, 
VPUNPCKLWD __m256i _mm256_maskz_unpacklo_epi16(__mmask16 k,___ m256i a, __ m256i b); 
VPUNPCKLWD __m128i_mm_mask_unpacklo_epi16(v s,__ mmask8 k, __m128i a,__m128i b); 
VPUNPCKLWD __m128i _mm_maskz_unpacklo_epi16(__mmask8 k, __m128i a, ___m128i b); 
VPUNPCKLDQ __m512i__mm512_unpacklo_epi32(__m512i a, ___m512i b); 

VPUNPCKLDQ __m512i__mm512_mask_unpacklo_epi32(__m512is, __mmask16 k,__m512ia,_m512i b); 


m512i b); 


m256i b); 


VPUNPCKLDQ __m512i__mm512_maskz_unpacklo_epi32(__mmask16 k,___m512i a, _m512i b); 
VPUNPCKLDQ __m256i _mm256_mask_unpacklo_epi32(__m256i s, __mmask8 k, __m256i a, __m256i b); 
VPUNPCKLDQ __m256i _mm256_maskz_unpacklo_epi32(__mmask8 k, __m256i a, __m256i b); 


VPUNPCKLDQ __m128i __mm_mask_unpacklo_epi32(v s,___mmask8 k, __m128i a, ___m128i b); 
VPUNPCKLDQ __m128i __mm_maskz_unpacklo_epi32(__mmask8 k, __m128i a, __m128i b); 
VPUNPCKLQDQ __m512i__mm512_unpacklo_epi64(__m512i a, __m512i b); 

VPUNPCKLQDQ __m512i_mm512_mask_unpacklo_epi64(__m512is,__mmask8 k,__m512i a, 
VPUNPCKLQDQ __m512i__mm512_maskz_unpacklo_epi64(_mmask8 k, __m512i a, __m512i b); 
VPUNPCKLQDQ __m256i __mm256_mask_unpacklo_epi64(__m256is,___ mmask8 k, __ m256i a, 
VPUNPCKLQDQ __m256i _mm256_maskz_unpacklo_epi64(__mmask8 k, __m256i a, __m256i b); 
VPUNPCKLQDQ __m128i _mm_mask_unpacklo_epi64(__m128i s, __mmask8 k, __m128i a, ___m128i b); 
VPUNPCKLQDQ __m128i _mm_maskz_unpacklo_epi64(__mmask8 k, __m128i a, __m128i b); 
PUNPCKLBW:__m64 _mm_unpacklo_pi8 (__m64 m1,__m64 m2) 

(V)PUNPCKLBW:__m1 28i __mm_unpacklo_epi8 (__m128i m1,__m128i m2) 

VPUNPCKLBW:__m256i _mm256_unpacklo_epi8 (__m256i m1,___ m256i m2) 

PUNPCKLWD:__m64 _mm_unpacklo_pi16 (__m64 m1,__m64 m2) 

(V)PUNPCKLWD:__m128i __mm_unpacklo_epi16 (__m128i m1,__m128i m2) 

VPUNPCKLWD:__m256i __mm256_unpacklo_epi16 (__m256i m1,__ m256i m2) 

PUNPCKLDQ:__m64 _mm_unpacklo_pi32 (__m64 m1,_m64 m2) 

(V)PUNPCKLDQ:__m128i _mm_unpacklo_epi32 (__m128i m1, __m128i m2) 

VPUNPCKLDQ:__m256i __mm256_unpacklo_epi32 (__m256i m1, ___m256i m2) 
(V)PUNPCKLQDQ:__m128i _mm_unpacklo_epi64 (__m128i m1,_m128i m2) 
VPUNPCKLQDQ:__m256i _mm256_unpacklo_epi64 (__m256i m1, __m256i m2) 


m512i b); 


m256i b); 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPUNPCKLDQ/QDQ, see Table 2-50, “Type E4NF Class Exception Conditions”. 


EVEX-encoded VPUNPCKLBW/WD, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Condi- 
tions”. 
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Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

FF /6 PUSH r/m16 M Valid Valid Push r/m76. 

FF /6 PUSH r/m32 M N.E. Valid Push r/m32. 

FF /6 PUSH r/m64 M Valid N.E. Push r/m64. 

50+rw PUSH r76 O Valid Valid Push r76. 

50+rd PUSH r32 6) N.E. Valid Push r32. 

50+rd PUSH r64 6) Valid N.E. Push r64. 

6A ib PUSH imm8 | Valid Valid Push immé. 

68 iw PUSH imm16 | Valid Valid Push imm16. 

68 id PUSH imm32 | Valid Valid Push imm32. 

OE PUSH CS ZO | Invalid Valid Push CS. 

16 PUSH SS ZO | Invalid Valid Push SS. 

1E PUSH DS ZO | Invalid Valid Push DS. 

06 PUSH ES ZO | Invalid Valid Push ES. 

OF AO PUSH FS ZO | Valid Valid Push FS. 

OF A8 PUSH GS ZO_ | Valid Valid Push GS. 

NOTES: 

* See IA-32 Architecture Compatibility section below. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
O opcode + rd (r) NA NA NA 
| imm8/16/32 NA NA NA 
ZO NA NA NA NA 
Description 


Decrements the stack pointer and then stores the source operand on the top of the stack. Address and operand 
sizes are determined and used as follows: 


PUSH—Push Word, Doubleword or Quadword Onto the Stack 


Address size. The D flag in the current code-segment descriptor determines the default address size; it may be 
overridden by an instruction prefix (67H). 


The address size is used only when referencing a source operand in memory. 


Operand size. The D flag in the current code-segment descriptor determines the default operand size; it may 
be overridden by instruction prefixes (66H or REX.W). 


The operand size (16, 32, or 64 bits) determines the amount by which the stack pointer is decremented (2, 4 
or 8). 


If the source operand is an immediate of size less than the operand size, a sign-extended value is pushed on 
the stack. If the source operand is a segment register (16 bits) and the operand size is 64-bits, a zero- 
extended value is pushed on the stack; if the operand size is 32-bits, either a zero-extended value is pushed 
on the stack or the segment selector is written on the stack using a 16-bit move. For the last case, all recent 
Core and Atom processors perform a 16-bit move, leaving the upper portion of the stack location unmodified. 


Stack-address size. Outside of 64-bit mode, the B flag in the current stack-segment descriptor determines the 
size of the stack pointer (16 or 32 bits); in 64-bit mode, the size of the stack pointer is always 64 bits. 
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The stack-address size determines the width of the stack pointer when writing to the stack in memory and 
when decrementing the stack pointer. (As stated above, the amount by which the stack pointer is 
decremented is determined by the operand size.) 


If the operand size is less than the stack-address size, the PUSH instruction may result in a misaligned stack 
pointer (a stack pointer that is not aligned on a doubleword or quadword boundary). 


The PUSH ESP instruction pushes the value of the ESP register as it existed before the instruction was executed. If 
a PUSH instruction uses a memory operand in which the ESP register is used for computing the operand address, 
the address of the operand is computed before the ESP register is decremented. 


If the ESP or SP register is 1 when the PUSH instruction is executed in real-address mode, a stack-fault exception 
(#SS) is generated (because the limit of the stack segment is violated). Its delivery encounters a second stack- 
fault exception (for the same reason), causing generation of a double-fault exception (#DF). Delivery of the 
double-fault exception encounters a third stack-fault exception, and the logical processor enters shutdown mode. 
See the discussion of the double-fault exception in Chapter 6 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A. 


IA-32 Architecture Compatibility 


For IA-32 processors from the Intel 286 on, the PUSH ESP instruction pushes the value of the ESP register as it 
existed before the instruction was executed. (This is also true for Intel 64 architecture, real-address and virtual- 
8086 modes of IA-32 architecture.) For the Intel® 8086 processor, the PUSH SP instruction pushes the new value 
of the SP register (that is the value after it has been decremented by 2). 


Operation 


(* See Description section for possible sign-extension or zero-extension of source operand and for *) 
(* a case in which the size of the memory store may be smaller than the instruction’s operand size *) 
IF StackAddrSize = 64 
THEN 
IF OperandSize = 64 
THEN 
RSP := RSP - 8; 
Memory[SS:RSP] := SRC; (* push quadword *) 
ELSE IF OperandSize = 32 
THEN 
RSP := RSP - 4; 
Memory[SS:RSP] := SRC; (* push dword *) 
ELSE (* OperandSize = 16 *) 
RSP := RSP - 2; 
Memory[SS:RSP] := SRC; (* push word *) 
Fl; 


ELSE IF StackAddrSize = 32 
THEN 
IF OperandSize = 64 
THEN 
ESP := ESP - 8; 
Memory[SS:€SP] := SRC; (* push quadword *) 
ELSE IF OperandSize = 32 
THEN 
ESP := ESP - 4; 
Memory[SS:€SP] := SRC; (* push dword *) 
ELSE (* OperandSize = 16 *) 
ESP := ESP - 2; 
Memory[SS:€SP] := SRC; (* push word *) 
Fl; 
ELSE (* StackAddrSize = 16 *) 
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IF OperandSize = 32 


THEN 
SP := SP - 4; 
Memory[SS:SP] := SRC; (* push dword *) 
ELSE (* OperandSize = 16 *) 
SP := SP - 2; 
Memory[SS:SP] := SRC; (* push word *) 
Fl; 
FI; 
Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 

If the new value of the SP or ESP register is outside the stack segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If the stack address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


If the PUSH is of CS, SS, DS, or ES. 
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PUSHA/PUSHAD—Push All General-Purpose Registers 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
60 PUSHA ZO | Invalid Valid Push AX, CX, DX, BX, original SP, BP, SI, and DI. 
60 PUSHAD ZO | Invalid Valid Push EAX, ECX, EDX, EBX, original ESP, EBP, 
ESI, and EDI. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Pushes the contents of the general-purpose registers onto the stack. The registers are stored on the stack in the 
following order: EAX, ECX, EDX, EBX, ESP (original value), EBP, ESI, and EDI (if the current operand-size attribute 
is 32) and AX, CX, DX, BX, SP (original value), BP, SI, and DI (if the operand-size attribute is 16). These instruc- 
tions perform the reverse operation of the POPA/POPAD instructions. The value pushed for the ESP or SP register is 
its value before prior to pushing the first register (see the “Operation” section below). 


The PUSHA (push all) and PUSHAD (push all double) mnemonics reference the same opcode. The PUSHA instruc- 
tion is intended for use when the operand-size attribute is 16 and the PUSHAD instruction for when the operand- 
size attribute is 32. Some assemblers may force the operand size to 16 when PUSHA is used and to 32 when 
PUSHAD is used. Others may treat these mnemonics as synonyms (PUSHA/PUSHAD) and use the current setting 
of the operand-size attribute to determine the size of values to be pushed from the stack, regardless of the 
mnemonic used. 


In the real-address mode, if the ESP or SP register is 1, 3, or 5 when PUSHA/PUSHAD executes: an #SS exception 
is generated but not delivered (the stack error reported prevents #SS delivery). Next, the processor generates a 
#DF exception and enters a shutdown state as described in the #DF discussion in Chapter 6 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A. 


This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode. 


Operation 
IF 64-bit Mode 


THEN #UD 
Fl; 


IF OperandSize = 32 (* PUSHAD instruction *) 
THEN 
Temp := (ESP); 
Push(EAX); 


Push(EDI); 
ELSE (* OperandSize = 16, PUSHA instruction *) 
Temp := (SP); 
Push(AX); 
Push(CX); 
Push(DX); 
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Push(BX); 
Push(Temp); 
Push(BP); 
Push(Sl); 
Push(Dl); 

FI; 

Flags Affected 

None. 


Protected Mode Exceptions 


#SS(0) If the starting or ending stack address is outside the stack segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while the current privilege level is 3 and alignment 
checking is enabled. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If the ESP or SP register contains 7, 9, 11, 13, or 15. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If the ESP or SP register contains 7, 9, 11, 13, or 15. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#UD If in 64-bit mode. 
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PUSHF/PUSHFD/PUSHFQ—Push EFLAGS Register onto the Stack 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
9C PUSHF ZO | Valid Valid Push lower 16 bits of EFLAGS. 
9C PUSHFD ZO |N.E. Valid Push EFLAGS. 
9C PUSHFQ ZO | Valid N.E. Push RFLAGS. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Decrements the stack pointer by 4 (if the current operand-size attribute is 32) and pushes the entire contents of 
the EFLAGS register onto the stack, or decrements the stack pointer by 2 (if the operand-size attribute is 16) and 
pushes the lower 16 bits of the EFLAGS register (that is, the FLAGS register) onto the stack. These instructions 
reverse the operation of the POPF/POPFD instructions. 


When copying the entire EFLAGS register to the stack, the VM and RF flags (bits 16 and 17) are not copied; instead, 
the values for these flags are cleared in the EFLAGS image stored on the stack. See Chapter 3 of the Intel® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for more information about the EFLAGS register. 


The PUSHF (push flags) and PUSHFD (push flags double) mnemonics reference the same opcode. The PUSHF 
instruction is intended for use when the operand-size attribute is 16 and the PUSHFD instruction for when the 
operand-size attribute is 32. Some assemblers may force the operand size to 16 when PUSHF is used and to 32 
when PUSHFD is used. Others may treat these mnemonics as synonyms (PUSHF/PUSHFD) and use the current 
setting of the operand-size attribute to determine the size of values to be pushed from the stack, regardless of the 
mnemonic used. 


In 64-bit mode, the instruction’s default operation is to decrement the stack pointer (RSP) by 8 and pushes RFLAGS 
on the stack. 16-bit operation is supported using the operand size override prefix 66H. 32-bit operand size cannot 
be encoded in this mode. When copying RFLAGS to the stack, the VM and RF flags (bits 16 and 17) are not copied; 
instead, values for these flags are cleared in the RFLAGS image stored on the stack. 


When operating in virtual-8086 mode (EFLAGS.VM = 1) without the virtual-8086 mode extensions (CR4.VME = 0), 
the PUSHF/PUSHFD instructions can be used only if IOPL = 3; otherwise, a general-protection exception (#GP) 
occurs. If the virtual-8086 mode extensions are enabled (CR4.VME = 1), PUSHF (but not PUSHFD) can be executed 
in virtual-8086 mode with IOPL < 3. 


(The protected-mode virtual-interrupt feature — enabled by setting CR4.PVI — affects the CLI and STI instructions 
in the same manner as the virtual-8086 mode extensions. PUSHF, however, is not affected by CR4.PVI.) 


In the real-address mode, if the ESP or SP register is 1 when PUSHF/PUSHFD instruction executes: an #SS excep- 
tion is generated but not delivered (the stack error reported prevents #SS delivery). Next, the processor generates 
a #DF exception and enters a shutdown state as described in the #DF discussion in Chapter 6 of the Intel® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Operation 


IF (PE = 0) or (PE = 1 and ((VM = 0) or (VM= 1 and IOPL = 3))) 
(* Real-Address Mode, Protected mode, or Virtual-8086 mode with IOPL equal to 3 *) 
THEN 
IF OperandSize = 32 
THEN 
push (EFLAGS AND OOFCFFFFH); 
(* VM and RF bits are cleared in image stored on the stack *) 
ELSE 
push (EFLAGS); (* Lower 16 bits only *) 
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Fl; 


ELSE IF 64-bit MODE (* In 64-bit Mode *) 
IF OperandSize = 64 
THEN 
push (RFLAGS AND 00000000_OOFCFFFFH); 
(* VM and RF bits are cleared in image stored on the stack; *) 
ELSE 
push (EFLAGS); (* Lower 16 bits only *) 
Fl; 


ELSE (* In Virtual-8086 Mode with IOPL less than 3 *) 
IF (CR4.VME = 0) OR (OperandSize = 32) 
THEN #GP(0); (* Trap to virtual-8086 monitor *) 
ELSE 
tempFLAGS = EFLAGS[1 5:0]; 
tempFLAGS[9] = tempFLAGS[1 9]; (* VIF replaces IF *) 
tempFlags[1 3:12] = 3; (* IOPL is set to 3 in image stored on the stack *) 
push (tempFLAGS); 
Fl; 
Fl; 


Flags Affected 
None. 


Protected Mode Exceptions 


#SS(0) If the new value of the ESP register is outside the stack segment boundary. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while CPL = 3 and alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If the I/O privilege level is less than 3. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while alignment checking is enabled. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If the stack address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If an unaligned memory reference is made while CPL = 3 and alignment checking is enabled. 
#UD If the LOCK prefix is used. 
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PXOR—Logical Exclusive OR 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF EF /r! A VV MMX Bitwise XOR of mm/m64 and mm. 
PXOR mm, mm/m64 
66 OF EF /r A VIN SSE2 Bitwise XOR of xmm2/m128 and xmm1. 
PXOR xmm1, xmm2/m128 
VEX.128.66.0F.WIG EF /r B VV AVX Bitwise XOR of xmm3/m128 and xmm2. 
VPXOR xmm1, xmm2, xmm3/m128 
VEX.256.66.0F.WIG EF /r B VV AVX2 Bitwise XOR of ymm3/m256 and ymm2. 
VPXOR ymm1, ymm2, ymm3/m256 
EVEX.128.66.0F.WO EF /r C VIV AVX512VL | Bitwise XOR of packed doubleword integers in 
VPXORD xmm1 {k1}{z}, xmm2, xmm3/m128/m32bcst AVX512F | xmme and xmm3/m128 using writemask k1. 
EVEX.256.66.0F.WO EF /r C VIV AVX512VL | Bitwise XOR of packed doubleword integers in 
VPXORD ymm1 {k1}{z}, ymm2, ymm3/m256/m32bcst AVX512F | ymme and ymm3/m256 using writemask k1. 
EVEX.512.66.0F.WO EF /r C VIV AVX512F | Bitwise XOR of packed doubleword integers in 


VPXORD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst zmme2 and zmm3/m512/m32bcst using 


writemask k1. 


EVEX.128.66.0F.W1 EF /r C VIV AVX512VL | Bitwise XOR of packed quadword integers in 
VPXORQ xmm1 {k1}{z}, xmm2, AVX512F | xmm2 and xmm3/m128 using writemask k1. 
xmm3/m128/m64bcst 

EVEX.256.66.0F.W1 EF /r C VIV AVX512VL | Bitwise XOR of packed quadword integers in 
VPXORQ ymm1 {k1}{z}, ymm2, ymm3/m256/m64bcst AVX512F | ymme and ymm3/m256 using writemask k1. 
EVEX.512.66.0F.W1 EF /r C VIV AVX512F | Bitwise XOR of packed quadword integers in 


VPXORQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst zmm2 and zmm3/m512/m64bcst using 


writemask k1. 


NOTES: 


1. See note in Section 2.4, “AVX and SSE Instruction Exception Specification” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2A and Section 21.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical exclusive-OR (XOR) operation on the source operand (second operand) and the destina- 
tion operand (first operand) and stores the result in the destination operand. Each bit of the result is 1 if the corre- 
sponding bits of the two operands are different; each bit is 0 if the corresponding bits of the operands are the same. 


In 64-bit mode and not encoded with VEX/EVEX, using a REX prefix in the form of REX.R permits this instruction to 
access additional registers (XMM8-XMM15). 


Legacy SSE instructions 64-bit operand: The source operand can be an MMX technology register or a 64-bit 
memory location. The destination operand is an MMX technology register. 
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128-bit Legacy SSE version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM desti- 


nation register remain unchanged. 


VEX.128 encoded version: The second source operand is an XMM register or a 128-bit memory location. The first 
source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the destination YMM register 


are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the 


corresponding register destination are zeroed. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32/64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with 


writemask k1. 


Operation 


PXOR (64-bit operand) 
DEST := DEST XOR SRC 


PXOR (128-bit Legacy SSE version) 
DEST := DEST XOR SRC 
DEST[MAXVL-1:128] (Unmodified) 


VPXOR (VEX.128 encoded version) 
DEST := SRC1 XOR SRC2 
DEST[MAXVL-1:128] := 0 


VPXOR (VEX.256 encoded version) 
DEST := SRC1 XOR SRC2 
DEST[MAXVL-1:256] := 0 


VPXORD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST{i+31:i] = SRC1[i+31:i] BITWISE XOR SRC2[31:0] 
ELSE DEST[i+31:i] := SRC1[i+31:i] BITWISE XOR SRC2[i+31:i] 


Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VPXORQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+63:i] := SRC1[i+63:i] BITWISE XOR SRC2[63:0] 
ELSE DEST[i+63:i] := SRC1[i+63:i] BITWISE XOR SRC2[i+63:i] 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VPXORD __m512i_mm512_xor_epi32(__m512ia,__m512ib) 

VPXORD __m512i_mm512_mask_xor_epi32(__m512i s,__ mmask16 m, ___m512i a,__m512ib) 
VPXORD __m512i_mm512_maskz_xor_epi32(__mmask16 m,_m512ia,__m512i b) 
VPXORD __m256i__mm256_xor_epi32(__m256i a, ___m256i b) 

VPXORD __m256i__mm256_mask_xor_epi32(__m256i s,___ mmask8 m, __m256i a, 
VPXORD __m256i__mm256_maskz_xor_epi32(__mmask8 m,___m256i a,___ m256i b) 
VPXORD __m128i__mm_xor_epi32(__m128i a,___m128i b) 

VPXORD __m128i__mm_mask_xor_epi32(__m128is,__ mmask8 m, ___m128i a,__m128i b) 


m256i b) 


VPXORD __m128i__mm_maskz_xor_epi32(__mmask16 m, __m128i a,__m128i b) 
VPXORQ __m512i__mm512_xor_epi64(__m512i a, __m512i b); 
VPXORQ __m512i__mm512_mask_xor_epi64(__m512is, __mmask8 m,_m512ia,__m512i b); 


VPXORQ __m512i__mm512_maskz_xor_epi64(__mmask8 m, __m512i a,__m512i b); 

VPXORQ __m256i __mm256_xor_epi64(__m256i a, __m256i b); 

VPXORQ __m256i _mm256_mask_xor_epi64(__m256i s, __ mmask8 m, __m256i a, __m256i b); 
VPXORQ __m256i _mm256_maskz_xor_epi64(__mmask8 m, __m256i a,__m256i b); 

VPXORQ __m128i __mm_xor_epi64(__m128i a, __m128i b); 
VPXORQ __m128i _mm_mask_xor_epi64(__m128i s,___mmask8 m, 
VPXORQ __m128i _mm_maskz_xor_epi64(__mmask8 m, ___m128i a, 
PXOR:__m64 __mm_xor_si64 (__m64 m1,__m64 m2) 
(V)PXOR:__m128i __mm_xor_si128 (__m128i a,__m128i b) 
VPXOR:__m256i __mm256_xor_si256 (__m256i a,__ m256i b) 


m128i a,__m128i b); 
m128i b); 


Flags Affected 
None. 


Numeric Exceptions 
None. 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode** Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

DO /2 RCL r/m&, 1 M1 | Valid Valid Rotate 9 bits (CF, r/m8) left once. 

REX + DO /2 RCL r/m8*, 1 M1 | Valid N.E. Rotate 9 bits (CF, r/m8) left once. 

D2 /2 RCL r/m8, CL MC | Valid Valid Rotate 9 bits (CF, r/m8) left CL times. 

REX + D2 /2 RCL r/m8*, CL MC | Valid N.E. Rotate 9 bits (CF, r/m8) left CL times. 

CO /2 ib RCL r/m8, imm8 MI | Valid Valid Rotate 9 bits (CF, r/m8) left imm8 times. 

REX + CO /2 ib RCL r/m8*, imm8 MI | Valid N.E. Rotate 9 bits (CF, r/m8) left imm8 times. 

D1 /2 RCL r/m16, 1 M1 | Valid Valid Rotate 17 bits (CF, r/m76) left once. 

D3 /2 RCL r/m76, CL MC | Valid Valid Rotate 17 bits (CF, r/m76) left CL times. 

C1 /2 ib RCL r/m16, imm8 MI | Valid Valid Rotate 17 bits (CF, r/m76) left imm8 times. 

D1 /2 RCL r/m32, 1 M1 | Valid Valid Rotate 33 bits (CF, r/m32) left once. 

REX.W + D1 /2 RCL r/m64, 1 M1 | Valid N.E. Rotate 65 bits (CF, r/m64) left once. Uses a 6 
bit count. 

D3 /2 RCL r/m32, CL MC | Valid Valid Rotate 33 bits (CF, r/m32) left CL times. 

REX.W + D3 /2 RCL r/m64, CL MC | Valid N.E. Rotate 65 bits (CF, r/m64) left CL times. Uses a 
6 bit count. 

C1 /2 ib RCL r/m32, imm8 MI | Valid Valid Rotate 33 bits (CF, r/m32) left imm8 times. 

REX.W + C1 /2 ib RCL r/m64, imm8 MI | Valid N.E. Rotate 65 bits (CF, r/m64) left imm8 times. 
Uses a 6 bit count. 

DO /3 RCR r/m&, 1 M1 | Valid Valid Rotate 9 bits (CF, r/m8) right once. 

REX + DO /3 RCR r/m8*, 1 M1 | Valid N.E. Rotate 9 bits (CF, r/m8) right once. 

D2 /3 RCR r/m8, CL MC | Valid Valid Rotate 9 bits (CF, r/m8) right CL times. 

REX + D2 /3 RCR r/m8*, CL MC | Valid N.E. Rotate 9 bits (CF, r/m8) right CL times. 

CO /3 ib RCR r/m8, imm8 MI | Valid Valid Rotate 9 bits (CF, r/m8) right imm8 times. 

REX + CO /3 ib RCR r/m8&*, imm8 MI | Valid N.E. Rotate 9 bits (CF, r/m8) right imm8 times. 

D1 /3 RCR r/m16, 1 M1 | Valid Valid Rotate 17 bits (CF, r/m76) right once. 

D3 /3 RCR r/m76, CL MC | Valid Valid Rotate 17 bits (CF, r/m76) right CL times. 

C1 /3 ib RCR r/m16, imm8& MI | Valid Valid Rotate 17 bits (CF, r/m16) right imm8 times. 

D1 /3 RCR r/m32, 1 M1 | Valid Valid Rotate 33 bits (CF, r/m32) right once. Uses a6 
bit count. 

REX.W + D1 /3 RCR r/m64, 1 M1 | Valid N.E. Rotate 65 bits (CF, r/m64) right once. Uses a6 
bit count. 

D3 /3 RCR r/m32, CL MC | Valid Valid Rotate 33 bits (CF, r/m32) right CL times. 

REX.W + D3 /3 RCR r/m64, CL MC | Valid N.E. Rotate 65 bits (CF, r/m64) right CL times. Uses 
a 6 bit count. 

C1 /3 ib RCR r/m32, imm8& MI | Valid Valid Rotate 33 bits (CF, r/m32) right imm8 times. 

REX.W + C1 /3 ib RCR r/m64, inmm8& MI | Valid N.E. Rotate 65 bits (CF, r/m64) right imm8 times. 
Uses a 6 bit count. 

DO /O ROL r/m8, 1 M1 | Valid Valid Rotate 8 bits r/m8 left once. 

REX + DO /0 ROL r/m8*, 1 M1 | Valid N.E. Rotate 8 bits r/m8 left once 

D2 /0 ROL r/m8, CL MC | Valid Valid Rotate 8 bits r/m8 left CL times. 

REX + D2 /0 ROL r/m8*, CL MC | Valid N.E. Rotate 8 bits r/m8 left CL times. 

CO /0 ib ROL r/m8, imm8 MI | Valid Valid Rotate 8 bits r/m8 left imm8 times. 
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Opcode** Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

REX + CO /0 ib ROL r/m8*, imm8 MI Valid N.E. Rotate 8 bits r/m8 left imm8 times. 

D1 /0 ROL r/m16, 1 M1 | Valid Valid Rotate 16 bits r/m76 left once. 

D3 /0 ROL r/m76, CL MC | Valid Valid Rotate 16 bits r/m76 left CL times. 

C1 /0 ib ROL r/m16, imm8 MI Valid Valid Rotate 16 bits r/m76 left immé8 times. 

D1 /0 ROL r/m32, 1 M1 | Valid Valid Rotate 32 bits r/m32 left once. 

REX.W + D1 /0 ROL r/m64, 1 M1 | Valid N.E. Rotate 64 bits r/m64 left once. Uses a 6 bit 
count. 

D3 /0 ROL r/m32, CL MC | Valid Valid Rotate 32 bits r/m32 left CL times. 

REX.W + D3 /0 ROL r/m64, CL MC _ | Valid N.E. Rotate 64 bits r/m64 left CL times. Uses a 6 
bit count. 

C1 /0 ib ROL r/m32, imm8 MI Valid Valid Rotate 32 bits r/m32 left immé8 times. 

REX.W + C1 /0 ib ROL r/m64, imm8 MI Valid N.E. Rotate 64 bits r/m64 left imm8 times. Uses a 
6 bit count. 

DO /1 ROR r/m&, 1 M1 | Valid Valid Rotate 8 bits r/m right once. 

REX + DO/1 ROR r/m8*, 1 M1 | Valid N.E. Rotate 8 bits r/m8 right once. 

D2/1 ROR r/m8, CL MC | Valid Valid Rotate 8 bits r/m8 right CL times. 

REX + D2 /1 ROR r/m8*, CL MC | Valid N.E. Rotate 8 bits r/m8 right CL times. 

CO /1 ib ROR r/m8, imm8& MI Valid Valid Rotate 8 bits r/m16 right imm& times. 

REX + CO /1 ib ROR r/m8*, imm8& MI Valid N.E. Rotate 8 bits r/m16 right imm& times. 

D1/1 ROR r/m16, 1 M1 | Valid Valid Rotate 16 bits r/m76 right once. 

D3 /1 ROR r/m16, CL MC | Valid Valid Rotate 16 bits r/m76 right CL times. 

C1/1 ib ROR r/m16, imm8 MI Valid Valid Rotate 16 bits r/m16 right imm& times. 

D1/1 ROR r/m32, 1 M1 | Valid Valid Rotate 32 bits r/m32 right once. 

REX.W + D1 /1 ROR r/m64, 1 M1 | Valid N.E. Rotate 64 bits r/m64 right once. Uses a 6 bit 
count. 

D3/1 ROR r/m32, CL MC | Valid Valid Rotate 32 bits r/m32 right CL times. 

REX.W + D3 /1 ROR r/m64, CL MC | Valid N.E. Rotate 64 bits r/m64 right CL times. Uses a 6 
bit count. 

C1/1 ib ROR r/m32, imm8& MI Valid Valid Rotate 32 bits r/m32 right imm& times. 

REX.W+C1/1 ib ROR r/m64, imm8& MI Valid N.E. Rotate 64 bits r/m64 right imm8 times. Uses a 
6 bit count. 


NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 
** See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M1 ModRM:r/m (w) 1 NA NA 
MC ModRM:r/m (w) CL NA NA 
MI ModRM:r/m (w) imm8 NA NA 
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Description 


Shifts (rotates) the bits of the first operand (destination operand) the number of bit positions specified in the 
second operand (count operand) and stores the result in the destination operand. The destination operand can be 
a register or a memory location; the count operand is an unsigned integer that can be an immediate or a value in 
the CL register. The count is masked to 5 bits (or 6 bits if in 64-bit mode and REX.W = 1). 


The rotate left (ROL) and rotate through carry left (RCL) instructions shift all the bits toward more-significant bit 
positions, except for the most-significant bit, which is rotated to the least-significant bit location. The rotate right 
(ROR) and rotate through carry right (RCR) instructions shift all the bits toward less significant bit positions, except 
for the least-significant bit, which is rotated to the most-significant bit location. 


The RCL and RCR instructions include the CF flag in the rotation. The RCL instruction shifts the CF flag into the 
least-significant bit and shifts the most-significant bit into the CF flag. The RCR instruction shifts the CF flag into the 
most-significant bit and shifts the least-significant bit into the CF flag. For the ROL and ROR instructions, the orig- 
inal value of the CF flag is not a part of the result, but the CF flag receives a copy of the bit that was shifted from 
one end to the other. 


The OF flag is defined only for the 1-bit rotates; it is undefined in all other cases (except RCL and RCR instructions 
only: a zero-bit rotate does nothing, that is affects no flags). For left rotates, the OF flag is set to the exclusive OR 
of the CF bit (after the rotate) and the most-significant bit of the result. For right rotates, the OF flag is set to the 
exclusive OR of the two most-significant bits of the result. 


In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). Use of 
REX.W promotes the first operand to 64 bits and causes the count operand to become a 6-bit counter. 


IA-32 Architecture Compatibility 


The 8086 does not mask the rotation count. However, all other IA-32 processors (starting with the Intel 286 
processor) do mask the rotation count to 5 bits, resulting in a maximum count of 31. This masking is done in all 
operating modes (including the virtual-8086 mode) to reduce the maximum execution time of the instructions. 


Operation 


(* RCL and RCR instructions *) 

SIZE := OperandSize; 

CASE (determine count) OF 
SIZE := 8: tempCOUNT := (COUNT AND 1FH) MOD 9; 
SIZE := 16: | tempCOUNT := (COUNT AND 1FH) MOD 17; 
SIZE := 32: = tempCOUNT := COUNT AND 1FH; 
SIZE := 64: — tempCOUNT := COUNT AND 3FH; 

ESAC; 


(* RCL instruction operation *) 
WHILE (tempCOUNT # 0) 
DO 
tempCF := MSB(DEST); 
DEST := (DEST * 2) + CF; 
CF := tempCF; 
tempCOUNT := tempCOUNT - 1; 
OD; 

ELIHW; 

IF (COUNT & COUNTMASK) = 1 
THEN OF := MSB(DEST) XOR CF; 
ELSE OF is undefined; 

Fl; 
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(* RCR instruction operation *) 
IF (COUNT & COUNTMASK) = 1 
THEN OF := MSB(DEST) XOR CF; 
ELSE OF is undefined; 
Fl; 
WHILE (tempCOUNT # 0) 
DO 
tempCF := LSB(SRC); 
DEST := (DEST / 2) + (CF * 25/28); 
CF := tempCF; 
tempCOUNT := tempCOUNT - 1; 
OD; 


(* ROL and ROR instructions *) 
IF OperandSize = 64 
THEN COUNTMASK = 3FH; 
ELSE COUNTMASK = 1FH; 
Fl; 


(* ROL instruction operation *) 


tempCOUNT := (COUNT & COUNTMASK) MOD SIZE 


WHILE (tempCOUNT # 0) 
DO 
tempCF := MSB(DEST); 
DEST := (DEST * 2) + tempCF; 
tempCOUNT := tempCOUNT - 1; 
OD; 
ELIHW; 
IF (COUNT & COUNTMASK) # 0 
THEN CF := LSB(DEST); 
Fl; 
IF (COUNT & COUNTMASK) = 1 
THEN OF := MSB(DEST) XOR CF; 
ELSE OF is undefined; 
Fl; 


(* ROR instruction operation *) 


tempCOUNT := (COUNT & COUNTMASK) MOD SIZE 


WHILE (tempCOUNT + 0) 
DO 
tempCF := LSB(SRC); 
DEST := (DEST / 2) + (tempCF « 25!26), 
tempCOUNT := tempCOUNT - 1; 
OD; 
ELIHW; 
IF (COUNT & COUNTMASK) # 0 
THEN CF := MSB(DEST); 
Fl; 
IF (COUNT & COUNTMASK) = 1 
THEN OF := MSB(DEST) XOR MSB — 1(DEST); 
ELSE OF is undefined; 
Fl; 
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Flags Affected 


If the masked count is 0, the flags are not affected. If the masked count is 1, then the OF flag is affected, otherwise 
(masked count is greater than 1) the OF flag is undefined. The CF flag is affected when the masked count is non- 
zero. The SF, ZF, AF, and PF flags are always unaffected. 


Protected Mode Exceptions 

#GP(0) If the source operand is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the source operand is located in a nonwritable segment. 
If the memory address is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 
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RCPPS—Compute Reciprocals of Packed Single-Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 53 /r RM | V/V SSE Computes the approximate reciprocals of the 
RCPPS xmm1, xmm2/m128 packed single-precision floating-point values 
in xmm2/m128 and stores the results in 
xmm1. 
VEX.128.0F.WIG 53 /r RM | V/V AVX Computes the approximate reciprocals of 
VRCPPS xmm1, xmm2/m128 packed single-precision values in xmm2/mem 
and stores the results in xmm1. 
VEX.256.0F.WIG 53 /r RM |V/V AVX Computes the approximate reciprocals of 
VRCPPS ymm1, ymm2/m256 packed single-precision values in ynm2/mem 
and stores the results in ymm7. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Performs a SIMD computation of the approximate reciprocals of the four packed single-precision floating-point 
values in the source operand (second operand) stores the packed single-precision floating-point results in the 
destination operand. The source operand can be an XMM register or a 128-bit memory location. The destination 
operand is an XMM register. See Figure 10-5 in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, for an illustration of a SIMD single-precision floating-point operation. 


The relative error for this approximation is: 


[Relative Error| < 1.5 * 2-1¢ 


The RCPPS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is a 
0.0, an ~ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same sign). 
Tiny results (see Section 4.9.1.5, “Numeric Underflow Exception (#U)” in Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1) are always flushed to 0.0, with the sign of the operand. (Input values greater 
than or equal to |1.11111111110100000000000B«2!2°| are guaranteed to not produce tiny results; input values 
less than or equal to |1.00000000000110000000001B*2!2°| are guaranteed to produce tiny results, which are in 
turn flushed to 0.0; and input values in between this range may or may not produce tiny results, depending on the 
implementation.) When a source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN 
is returned. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 
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Operation 


RCPPS (128-bit Legacy SSE version) 
DEST[31:0] := APPROXIMATE(1/SRC[31:0]) 
DEST[63:32] := APPROXIMATE(1/SRC[63:32]) 
DEST[95:64] := APPROXIMATE(1/SRC[95:64]) 
DEST[127:96] := APPROXIMATE(1/SRC[1 27:96]) 
DEST[MAXVL-1:1 28] (Unmodified) 


VRCPPS (VEX.128 encoded version) 
DEST[31:0] := APPROXIMATE(1/SRC[31:0]) 
DEST[63:32] := APPROXIMATE(1/SRC[63:32]) 
DEST[95:64] := APPROXIMATE(1/SRC[95:64]) 
DEST[127:96] := APPROXIMATE(1/SRC[127:96]) 
DEST[MAXVL-1:128] := 0 


VRCPPS (VEX.256 encoded version) 

DEST[31:0] := APPROXIMATE(1/SRC[31:0]) 
DEST[63:32] := APPROXIMATE(1/SRC[63:32]) 
DEST[95:64] := APPROXIMATE(1/SRC[95:64]) 
DEST[127:96] := APPROXIMATE(1/SRC[127:96]) 
DEST[159:128] := APPROXIMATE(1/SRC[159:128]) 
DEST[191:160] := APPROXIMATE(1/SRC[191:160]) 
DEST[223:192] := APPROXIMATE(1/SRC[223:192]) 
DEST[255:224] := APPROXIMATE(1/SRC[255:224]) 


a on 


Intel C/C++ Compiler Intrinsic Equivalent 


RCCPS: m128_mm_rcp_ps(__m128 a) 
RCPPS: m256 __mm256_rcp_ps (__m256 a); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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RCPSS—Compute Reciprocal of Scalar Single-Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 OF 53 /r RM | V/V SSE Computes the approximate reciprocal of the 


scalar single-precision floating-point value in 
xmm2/m3z2 and stores the result in xmm1. 


RCPSS xmm17, xmm2/m32 


VEX.LIG.F3.0F.WIG 53 /r RVM | V/V AVX 
VRCPSS xmm1, xmm2, xmm3/m32 


Computes the approximate reciprocal of the 
scalar single-precision floating-point value in 
xmm3/m32 and stores the result in xmm7. 
Also, upper single precision floating-point 
values (bits[127:32]) from xmm2 are copied to 


xmm1[127:32]. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes of an approximate reciprocal of the low single-precision floating-point value in the source operand 
(second operand) and stores the single-precision floating-point result in the destination operand. The source 
operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The 
three high-order doublewords of the destination operand remain unchanged. See Figure 10-6 in the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a scalar single-precision floating- 
point operation. 


The relative error for this approximation is: 


[Relative Error| < 1.5 * 2-!¢ 


The RCPSS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is a 
0.0, an ~ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same sign). 
Tiny results (see Section 4.9.1.5, “Numeric Underflow Exception (#U)” in Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1) are always flushed to 0.0, with the sign of the operand. (Input values greater 
than or equal to |1.11111111110100000000000B«2!2°| are guaranteed to not produce tiny results; input values 
less than or equal to |1.00000000000110000000001B*2!2°| are guaranteed to produce tiny results, which are in 
turn flushed to 0.0; and input values in between this range may or may not produce tiny results, depending on the 
implementation.) When a source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN 
is returned. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 


Operation 


RCPSS (128-bit Legacy SSE version) 
DEST[31:0] := APPROXIMATE(1/SRC[31:0]) 
DEST[MAXVL-1:32] (Unmodified) 
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VRCPSS (VEX.128 encoded version) 
DEST[31:0] := APPROXIMATE(1/SRC2[31:0]) 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
RCPSS: m128 _mm_rcp_ss(__m128 a) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Table 2-22, “Type 5 Class Exception Conditions”. 
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RDFSBASE/RDGSBASE—Read FS/GS Segment Base 


Opcode/ Op/ |64/32- |CPUID Fea- | Description 
Instruction En bit ture Flag 

Mode 
F3 OF AE /0 M VA FSGSBASE _ | Load the 32-bit destination register with the FS 
RDFSBASE r32 base address. 
F3 REX.W OF AE /O M VA FSGSBASE _ | Load the 64-bit destination register with the FS 
RDFSBASE r64 base address. 
F3 OF AE /1 M V/I FSGSBASE _ | Load the 32-bit destination register with the GS 
RDGSBASE r32 base address. 
F3 REX.W OF AE /1 M VA FSGSBASE _ | Load the 64-bit destination register with the GS 
RDGSBASE r64 base address. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Loads the general-purpose register indicated by the modR/M:r/m field with the FS or GS segment base address. 


The destination operand may be either a 32-bit or a 64-bit general-purpose register. The REX.W prefix indicates the 
operand size is 64 bits. If no REX.W prefix is used, the operand size is 32 bits; the upper 32 bits of the source base 
address (for FS or GS) are ignored and upper 32 bits of the destination register are cleared. 


This instruction is supported only in 64-bit mode. 


Operation 
DEST := FS/GS segment base address; 


Flags Affected 
None 


C/C++ Compiler Intrinsic Equivalent 


RDFSBASE: unsigned int __readfsbase_u32(void ); 
RDFSBASE: unsigned __int64 _readfsbase_u64(void ); 
RDGSBASE: unsigned int __readgsbase_u32(void ); 
RDGSBASE: unsigned __int64 _readgsbase_u64(void ); 


Protected Mode Exceptions 
#UD The RDFSBASE and RDGSBASE instructions are not recognized in protected mode. 


Real-Address Mode Exceptions 
#UD The RDFSBASE and RDGSBASE instructions are not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The RDFSBASE and RDGSBASE instructions are not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD The RDFSBASE and RDGSBASE instructions are not recognized in compatibility mode. 


4-540 Vol. 2B RDFSBASE/RDGSBASE—Read FS/GS Segment Base 


INSTRUCTION SET REFERENCE, M-U 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If CR4.FSGSBASE[bit 16] = 0. 
If CPUID.0O7H.OH: EBX.FSGSBASE[bit 0] = 0. 
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RDMSR—Read from Model Specific Register 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF 32 RDMSR ZO | Valid Valid Read MSR specified by ECX into EDX:EAX. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Reads the contents of a 64-bit model specific register (MSR) specified in the ECX register into registers EDX:EAX. 
(On processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The EDX register 
is loaded with the high-order 32 bits of the MSR and the EAX register is loaded with the low-order 32 bits. (On 
processors that support the Intel 64 architecture, the high-order 32 bits of each of RAX and RDX are cleared.) If 
fewer than 64 bits are implemented in the MSR being read, the values returned to EDX:EAX in unimplemented bit 
locations are undefined. 


This instruction must be executed at privilege level 0 or in real-address mode; otherwise, a general protection 
exception #GP(0) will be generated. Specifying a reserved or unimplemented MSR address in ECX will also cause a 
general protection exception. 


The MSRs control functions for testability, execution tracing, performance-monitoring, and machine check errors. 
Chapter 2, “Model-Specific Registers (MSRs)” of the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 4, lists all the MSRs that can be read with this instruction and their addresses. Note that each 
processor family has its own set of MSRs. 


The CPUID instruction should be used to determine whether MSRs are supported (CPUID.01H:EDX[5] =1) before 
using this instruction. 


IA-32 Architecture Compatibility 


The MSRs and the ability to read them with the RDMSR instruction were introduced into the IA-32 Architecture with 
the Pentium processor. Execution of this instruction by an IA-32 processor earlier than the Pentium processor 
results in an invalid opcode exception #UD. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 
EDX:EAX := MSR[ECX]; 


Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If the current privilege level is not 0. 
If the value in ECX specifies a reserved or unimplemented MSR address. 
#UD If the LOCK prefix is used. 
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Real-Address Mode Exceptions 
#GP If the value in ECX specifies a reserved or unimplemented MSR address. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The RDMSR instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


RDMSR—Read from Model Specific Register Vol.2B 4-543 


INSTRUCTION SET REFERENCE, M-U 


RDPID—Read Processor ID 


Opcode/ Op/ |64/32- | CPUID Description 
Instruction En bit Feature Flag 
Mode 
F3 OF C7 /7 R N.E/V | RDPID Read IA32_TSC_AUX into r32. 
RDPID r32 
F3 OF C7 /7 R V/N.E. | RDPID Read IA32_TSC_AUX into r64. 
RDPID r64 
Instruction Operand Encoding! 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
R ModRM:r/m (w) NA NA NA 
Description 


Reads the value of the IA32_TSC_AUX MSR (address C0000103H) into the destination register. The value of CS.D 
and operand-size prefixes (66H and REX.W) do not affect the behavior of the RDPID instruction. 


Operation 


DEST := IA32_TSC_AUX 


Flags Affected 
None. 


Protected Mode Exceptions 
If the LOCK prefix is used. 
If CPUID.7H.0:ECX.RDPID[bit 22] = 0. 


#UD 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 


1.ModRM.MOD = 011B required 
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Opcode* Instruction Op/ |64/32bit | CPUID Description 
En |Mode Feature 
Support | Flag 
NP OF 01 EE RDPKRU ZO |V/V OSPKE Reads PKRU into EAX. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 

Description 


Reads the value of PKRU into EAX and clears EDX. ECX must be 0 when RDPKRU is executed; otherwise, a general- 


protection exception (#GP) occurs. 


RDPKRU can be executed only if CR4.PKE = 1; otherwise, an invalid-opcode exception (#UD) occurs. Software can 
discover the value of CR4.PKE by examining CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4]. 


On processors that support the Intel 64 Architecture, the high-order 32-bits of RCX are ignored and the high-order 


32-bits of RDX and RAX are cleared. 


Operation 


IF (ECX = 0) 
THEN 
EAX := PKRU; 
EDX := 0; 
ELSE #GP(0); 
Fl; 


Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 
RDPKRU: uint32_t _rdpkru_u32(void); 


Protected Mode Exceptions 


#GP(0) If ECX # 0. 
#UD If the LOCK prefix is used. 
If CR4.PKE = O. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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RDPMC—Read Performance-Monitoring Counters 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 33 RDPMC ZO | Valid Valid Read performance-monitoring counter 
specified by ECX into EDX:EAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Reads the contents of the performance monitoring counter (PMC) specified in ECX register into registers EDX:EAX. 
(On processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The EDX register 
is loaded with the high-order 32 bits of the PMC and the EAX register is loaded with the low-order 32 bits. (On 
processors that support the Intel 64 architecture, the high-order 32 bits of each of RAX and RDX are cleared.) If 
fewer than 64 bits are implemented in the PMC being read, unimplemented bits returned to EDX:EAX will have 
value zero. 


The width of PMCs on processors supporting architectural performance monitoring (CPUID.OAH:EAX[7:0] #0) are 
reported by CPUID.OAH:EAX[23:16]. On processors that do not support architectural performance monitoring 
(CPUID.OAH:EAX[7:0]=0), the width of general-purpose performance PMCs is 40 bits, while the widths of special- 
purpose PMCs are implementation specific. 


Use of ECX to specify a PMC depends on whether the processor supports architectural performance monitoring: 


¢ If the processor does not support architectural performance monitoring (CPUID.OAH:EAX[7:0]=0), ECX[30:0] 
specifies the index of the PMC to be read. Setting ECX[31] selects “fast” read mode if supported. In this mode, 
RDPMC returns bits 31:0 of the PMC in EAX while clearing EDX to zero. 


¢ If the processor does support architectural performance monitoring (CPUID.OAH:EAX[7:0] #0), ECX[31:16] 
specifies type of PMC while ECX[15:0] specifies the index of the PMC to be read within that type. The following 
PMC types are currently defined: 


— General-purpose counters use type 0. The index x (to read IA32_PMCx) must be less than the value 
enumerated by CPUID.OAH.EAX[15:8] (thus ECX[15:8] must be zero). 


— Fixed-function counters use type 4000H. The index x (to read IA32_FIXED_CTRx) can be used if either 
CPUID.OAH.EDX[4:0] > x or CPUID.OAH.ECX[x] = 1 (thus ECX[15:5] must be 0). 


— Performance metrics use type 2000H. This type can be used only if 
IA32_PERF_CAPABILITIES.PERF_METRICS_AVAILABLE[bit 15]=1. For this type, the index in ECX[15:0] is 
implementation specific. 


Specifying an unsupported PMC encoding will cause a general protection exception #GP(0). For PMC details see 
Chapter 18, “Performance Monitoring”, in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3B. 


When in protected or virtual 8086 mode, the Performance-monitoring Counters Enabled (PCE) flag in register 
CR4 restricts the use of the RDPMC instruction. When the PCE flag is set, the RDPMC instruction can be executed 
at any privilege level; when the flag is clear, the instruction can only be executed at privilege level 0. (When in real- 
address mode, the RDPMC instruction is always enabled.) The PMCs can also be read with the RDMSR instruction, 
when executing at privilege level 0. 


The RDPMC instruction is not a serializing instruction; that is, it does not imply that all the events caused by the 
preceding instructions have been completed or that events caused by subsequent instructions have not begun. If 
an exact event count is desired, software must insert a serializing instruction (Such as the CPUID instruction) 
before and/or after the RDPMC instruction. 


Performing back-to-back fast reads are not guaranteed to be monotonic. To guarantee monotonicity on back-to- 
back reads, a serializing instruction must be placed between the two RDPMC instructions. 
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The RDPMC instruction can execute in 16-bit addressing mode or virtual-8086 mode; however, the full contents of 
the ECX register are used to select the PMC, and the event count is stored in the full EAX and EDX registers. The 
RDPMC instruction was introduced into the IA-32 Architecture in the Pentium Pro processor and the Pentium 
processor with MMX technology. The earlier Pentium processors have PMCs, but they must be read with the RDMSR 
instruction. 


Operation 
MSCB = Most Significant Counter Bit (* Model-specific *) 


IF (((CR4.PCE = 1) or (CPL = O) or (CRO.PE = 0)) and (ECX indicates a supported counter)) 
THEN 
EAX := counter[31:0]; 
EDX := ZeroExtend(counter[MSCB:32]); 
ELSE (* ECX is not valid or CR4.PCE is O and CPL is 1, 2, or 3 and CRO.PE is 1 *) 
#GP(0); 
FI; 


Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If the current privilege level is not O and the PCE flag in the CR4 register is clear. 
If an invalid performance counter index is specified. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If an invalid performance counter index is specified. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If the PCE flag in the CR4 register is clear. 
If an invalid performance counter index is specified. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If the current privilege level is not 0 and the PCE flag in the CR4 register is clear. 
If an invalid performance counter index is specified. 
#UD If the LOCK prefix is used. 
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RDRAND—Read Random Number 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NFx OF C7 /6 M VIN RDRAND _ | Read a 16-bit random number and store in the 
RDRAND r16 destination register. 
NFx OF C7 /6 M VIV RDRAND _ | Read a 32-bit random number and store in the 
RDRAND r32 destination register. 
NFx REX.W + OF C7 /6 M VAI RDRAND _ | Read a 64-bit random number and store in the 
RDRAND r64 destination register. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Loads a hardware generated random value and store it in the destination register. The size of the random value is 
determined by the destination register size and operating mode. The Carry Flag indicates whether a random value 
is available at the time the instruction is executed. CF=1 indicates that the data in the destination is valid. Other- 
wise CF=0 and the data in the destination operand will be returned as zeros for the specified width. All other flags 
are forced to 0 in either situation. Software must check the state of CF=1 for determining if a valid random value 
has been returned, otherwise it is expected to loop and retry execution of RDRAND (see Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 1, Section 7.3.17, “Random Number Generator Instructions”). 
This instruction is available at all privilege levels. 

In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.B permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper- 
ands. See the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF HwW_RND_GEN.ready = 1 
THEN 
CASE of 
osize is 64: DEST[63:0] := HW_RND_GEN.data; 
osize is 32: DEST[31:0] := HW_RND_GEN.data; 
osize is 16: DEST[15:0] := HW_RND_GEN.data; 
ESAC 
CF := 1; 
ELSE 
CASE of 
osize is 64: DEST[63:0] := 0; 
osize is 32: DEST[31:0] := 0; 
osize is 16: DEST[15:0] := 0; 
ESAC 


FI 
OF, SF, ZF, AF, PF := 0; 


Flags Affected 


The CF flag is set according to the result (see the “Operation” section above). The OF, SF, ZF, AF, and PF flags are 
set to 0. 
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Intel C/C++ Compiler Intrinsic Equivalent 


RDRAND: int _rdrand16_step( unsigned short * ); 
RDRAND: int __rdrand32_step( unsigned int * ); 
RDRAND: int __rdrand64_step( unsigned __int64 *); 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.OLH:ECX.RDRAND[bit 30] = 0. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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RDSEED—Read Random SEED 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NFx OF C7 /7 M VIV RDSEED Read a 16-bit NIST SP800-90B & C compliant random value and 
RDSEED r16 store in the destination register. 
NFx OF C7 /7 M VIV RDSEED Read a 32-bit NIST SP800-90B & C compliant random value and 
RDSEED r32 store in the destination register. 
NFx REX.W + OF C7 /7 M VAI RDSEED Read a 64-bit NIST SP800-90B & C compliant random value and 
RDSEED r64 store in the destination register. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Loads a hardware generated random value and store it in the destination register. The random value is generated 
from an Enhanced NRBG (Non Deterministic Random Bit Generator) that is compliant to NIST SP800-90B and NIST 
SP800-90C in the XOR construction mode. The size of the random value is determined by the destination register 
size and operating mode. The Carry Flag indicates whether a random value is available at the time the instruction 
is executed. CF=1 indicates that the data in the destination is valid. Otherwise CF=0 and the data in the destination 
operand will be returned as zeros for the specified width. All other flags are forced to 0 in either situation. Software 
must check the state of CF=1 for determining if a valid random seed value has been returned, otherwise it is 
expected to loop and retry execution of RDSEED (see Section 1.2). 


The RDSEED instruction is available at all privilege levels. The RDSEED instruction executes normally either inside 
or outside a transaction region. 


In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.B permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper- 
ands. See the summary chart at the beginning of this section for encoding data and limits. 


Operation 


IF HW_NRND_GEN.ready = 1 
THEN 
CASE of 
osize is 64: DEST[63:0] := HW_NRND_GEN.data; 
osize is 32: DEST[31:0] := HW_NRND_GEN.data; 
osize is 16: DEST[15:0] := HW_NRND_GEN.data; 
ESAC; 
CF := 1; 
ELSE 
CASE of 
osize is 64: DEST[63:0] := 0; 
osize is 32: DEST[31:0] := 0; 
osize is 16: DEST[15:0] := 0; 
ESAC; 
CF := 0; 
Fl; 


OF, SF, ZF, AF, PF := 0; 


RDSEED—Read Random SEED Vol.2B 4-551 


INSTRUCTION SET REFERENCE, M-U 


Flags Affected 


The CF flag is set according to the result (see the "Operation" section above). The OF, SF, ZF, AF, and PF flags 
are set to 0. 


C/C++ Compiler Intrinsic Equivalent 


RDSEED int __rdseed16_step( unsigned short * ); 
RDSEED int __rdseed32_step( unsigned int * ); 
RDSEED int __rdseed64_step( unsigned __int64 *); 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 0. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 0. 


Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 0. 


Compatibility Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 0. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 0. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En | bitMode | Feature 
Support | Flag 
F3 OF 1€/1 (mod=11) R VIN CET_SS Copy low 32 bits of shadow stack pointer (SSP) to r32. 
RDSSPD r32 
F3 REX.W OF 1E/1 (mod=11) | R VINE. CET_SS Copies shadow stack pointer (SSP) to r64. 
RDSSPQ r64 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
R ModRM:r/m (w) NA NA NA 


Description 


Copies the current shadow stack pointer (SSP) register to the register destination. This opcode is a NOP when CET 
shadow stacks are not enabled and on processors that do not support CET. 


Operation 
IFCPL=3 
IF CR4.CET & IA32_U_CET.SH_STK_EN 
IF (operand size is 64 bit) 


THEN 
Dest := SSP; 
ELSE 
Dest := SSP[31:0]; 
Fl; 
Fl; 
ELSE 


IF CR4.CET & IA32_S_CET.SH_STK_EN 
IF (operand size is 64 bit) 


THEN 
Dest := SSP; 
ELSE 
Dest := SSP[31:0]; 
Fl; 
Fl; 
Fl; 
Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 


RDSSPD = ___int32 _rdsspd_i32(void); 
RDSSPQ __int64 _rdsspq_i64(void); 


Protected Mode Exceptions 
None. 
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Real-Address Mode Exceptions 
None. 


Virtual-8086 Mode Exceptions 
None. 


Compatibility Mode Exceptions 
None. 


64-Bit Mode Exceptions 
None. 
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RDTSC—Read Time-Stamp Counter 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 31 RDTSC ZO | Valid Valid Read time-stamp counter into EDX:EAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Reads the current value of the processor’s time-stamp counter (a 64-bit MSR) into the EDX:EAX registers. The EDX 
register is loaded with the high-order 32 bits of the MSR and the EAX register is loaded with the low-order 32 bits. 
(On processors that support the Intel 64 architecture, the high-order 32 bits of each of RAX and RDX are cleared.) 


The processor monotonically increments the time-stamp counter MSR every clock cycle and resets it to 0 whenever 
the processor is reset. See “Time Stamp Counter” in Chapter 17 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3B, for specific details of the time stamp counter behavior. 


The time stamp disable (TSD) flag in register CR4 restricts the use of the RDTSC instruction as follows. When the 
flag is clear, the RDTSC instruction can be executed at any privilege level; when the flag is set, the instruction can 
only be executed at privilege level 0. 


The time-stamp counter can also be read with the RDMSR instruction, when executing at privilege level 0. 


The RDTSC instruction is not a serializing instruction. It does not necessarily wait until all previous instructions 

have been executed before reading the counter. Similarly, subsequent instructions may begin execution before the 

read operation is performed. The following items may guide software seeking to order executions of RDTSC: 

¢ If software requires RDTSC to be executed only after all previous instructions have executed and all previous 
loads are globally visible, it can execute LFENCE immediately before RDTSC. 

¢ If software requires RDTSC to be executed only after all previous instructions have executed and all previous 
loads and stores are globally visible, it can execute the sequence MFENCE;LFENCE immediately before RDTSC. 


¢ If software requires RDTSC to be executed prior to execution of any subsequent instruction (including any 
memory accesses), it can execute the sequence LFENCE immediately after RDTSC. 


This instruction was introduced by the Pentium processor. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 


IF (CR4.TSD = 0) or (CPL = 0) or (CRO.PE = 0) 
THEN EDX:E€AX := TimeStampCounter; 
ELSE (* CR4.TSD = 1 and (CPL = 1, 2, or 3) and CRO.PE = 1 *) 
#GP(0); 
Fl; 


Flags Affected 
None. 


1. Aload is considered to become globally visible when the value to be loaded is determined. 
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Protected Mode Exceptions 


#GP(0) If the TSD flag in register CR4 is set and the CPL is greater than 0. 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) If the TSD flag in register CR4 is set. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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RDTSCP—Read Time-Stamp Counter and Processor ID 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 01 FO RDTSCP ZO ‘| Valid Valid Read 64-bit time-stamp counter and 
IA32_TSC_AUX value into EDX:EAX and ECX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Reads the current value of the processor’s time-stamp counter (a 64-bit MSR) into the EDX:EAX registers and also 
reads the value of the IA32_TSC_AUX MSR (address C0000103H) into the ECX register. The EDX register is loaded 
with the high-order 32 bits of the IA32_TSC MSR; the EAX register is loaded with the low-order 32 bits of the 
IA32_TSC MSR; and the ECX register is loaded with the low-order 32-bits of IA32_TSC_AUX MSR. On processors 
that support the Intel 64 architecture, the high-order 32 bits of each of RAX, RDX, and RCX are cleared. 


The processor monotonically increments the time-stamp counter MSR every clock cycle and resets it to 0 whenever 
the processor is reset. See “Time Stamp Counter” in Chapter 17 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3B, for specific details of the time stamp counter behavior. 


The time stamp disable (TSD) flag in register CR4 restricts the use of the RDTSCP instruction as follows. When the 
flag is clear, the RDTSCP instruction can be executed at any privilege level; when the flag is set, the instruction can 
only be executed at privilege level 0. 


The RDTSCP instruction is not a serializing instruction, but it does wait until all previous instructions have executed 

and all previous loads are globally visible.! But it does not wait for previous stores to be globally visible, and subse- 

quent instructions may begin execution before the read operation is performed. The following items may guide 

software seeking to order executions of RDTSCP: 

¢ If software requires RDTSCP to be executed only after all previous stores are globally visible, it can execute 
MFENCE immediately before RDTSCP. 


¢ If software requires RDTSCP to be executed prior to execution of any subsequent instruction (including any 
memory accesses), it can execute LFENCE immediately after RDTSCP. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 
IF (CR4.TSD = 0) or (CPL = 0) or (CRO.PE = 0) 
THEN 
EDX:EAX := TimeStampCounter; 
ECX := IA32_TSC_AUX[31:0]; 
ELSE (* CR4.TSD = 1 and (CPL = 1, 2, or 3) and CRO.PE = 1 *) 
#GP(0); 
Fl; 


Flags Affected 
None. 


1. Aload is considered to become globally visible when the value to be loaded is determined. 
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Protected Mode Exceptions 
#GP(0) 
#UD If the LOCK prefix is used. 

If CPUID.80000001H:EDX.RDTSCP[bit 27] = 0. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.80000001H:EDX.RDTSCP[bit 27] = 0. 


Virtual-8086 Mode Exceptions 
#GP(0) If the TSD flag in register CR4 is set. 
#UD If the LOCK prefix is used. 
If CPUID.80000001H:EDX.RDTSCP[bit 27] = 0. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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REP/REPE/REPZ/REPNE/REPNZ—Repeat String Operation Prefix 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

F3 6C REP INS m8, DX ZO | Valid Valid Input (E)CX bytes from port DX into ES:[(€)DI]. 

F3 6C REP INS m8, DX ZO | Valid N.E. Input RCX bytes from port DX into [RDI]. 

F3 6D REP INS m176, DX ZO ‘| Valid Valid Input (E)CX words from port DX into ES:[(E)DI.] 

F3 6D REP INS m32, DX ZO ‘| Valid Valid Input (E)CX doublewords from port DX into 
ES:[(E)DI]. 

F3 6D REP INS r/m32, DX ZO | Valid N.E. Input RCX default size from port DX into [RDI]. 

F3 A4 REP MOVS m8, m8 ZO_ | Valid Valid Move (€)CX bytes from DS:[(E)S!] to ES:[(E)DI]. 

F3 REX.W A4 REP MOVS m8, m8 ZO_ | Valid N.E. Move RCX bytes from [RSI] to [RDI]. 

F3A5 REP MOVS m16, m16 ZO_ | Valid Valid Move (€)CX words from DS:[(E)SI] to ES:[(E)DI]. 

F3 A5 REP MOVS m32, m32 ZO ‘| Valid Valid Move (€)CX doublewords from DS:[(E)SI] to 
ES:[(E)DI]. 

F3 REX.W A5 REP MOVS m64, m64 ZO_ | Valid N.E. Move RCX quadwords from [RSI] to [RDI]. 

F3 6E REP OUTS DX, r/m8& ZO | Valid Valid Output (E)CX bytes from DS:[(E)SI] to port DX. 

F3 REX.W 6E REP OUTS Dx, r/m8* ZO | Valid N.E. Output RCX bytes from [RSI] to port DX. 

F3 6F REP OUTS DX, r/m16 ZO ‘| Valid Valid Output (E)CX words from DS:[(E)SI] to port DX. 

F3 6F REP OUTS DX, r/m32 ZO ‘| Valid Valid Output (E)CX doublewords from DS:[(€)SI] to 
port DX. 

F3 REX.W 6F REP OUTS DX, r/m32 ZO | Valid N.E. Output RCX default size from [RSI] to port DX. 

F3 AC REP LODS AL ZO | Valid Valid Load (E)CX bytes from DS:[(E)SI] to AL. 

F3 REX.W AC REP LODS AL ZO | Valid N.E. Load RCX bytes from [RSI] to AL. 

F3 AD REP LODS AX ZO | Valid Valid Load (E)CX words from DS:[(E)SI] to AX. 

F3 AD REP LODS EAX ZO_ | Valid Valid Load (E)CX doublewords from DS:[(E)SI] to 
EAX. 

F3 REX.W AD REP LODS RAX ZO_ | Valid N.E. Load RCX quadwords from [RSI] to RAX. 

F3 AA REP STOS m8 ZO_ | Valid Valid Fill (E)CX bytes at ES:[(€)DI] with AL. 

F3 REX.W AA REP STOS m8 ZO_ | Valid N.E. Fill RCX bytes at [RDI] with AL. 

F3 AB REP STOS m16 ZO_ | Valid Valid Fill (E)CX words at ES:[(€)DI] with AX. 

F3 AB REP STOS m32 ZO_ | Valid Valid Fill (E)CX doublewords at ES:[(E)DI] with EAX. 

F3 REX.W AB REP STOS m64 ZO_ | Valid N.E. Fill RCX quadwords at [RDI] with RAX. 

F3 A6 REPE CMPS m8, m8 ZO | Valid Valid Find nonmatching bytes in ES:[(€)DI] and 
DS:[(E)SI]. 

F3 REX.W A6 REPE CMPS m8, m8 ZO | Valid N.E. Find non-matching bytes in [RDI] and [RSI]. 

F3 A7 REPE CMPS m16, m16 ZO | Valid Valid Find nonmatching words in ES:[(€)D!] and 
DS:[(E)SI]. 

F3 A7 REPE CMPS m32, m32 ZO | Valid Valid Find nonmatching doublewords in ES:[(€)DI] 
and DS:[(€)SI]. 

F3 REX.W A7 REPE CMPS m64, m64 ZO | Valid N.E. Find non-matching quadwords in [RDI] and 
[RSI]. 

F3 AE REPE SCAS m8 ZO | Valid Valid Find non-AL byte starting at ES:[(€)DI]. 

F3 REX.W AE REPE SCAS m8 ZO ‘| Valid N.E. Find non-AL byte starting at [RDI]. 

F3 AF REPE SCAS m16 ZO | Valid Valid Find non-AX word starting at ES:[(E)DI]. 

F3 AF REPE SCAS m32 ZO | Valid Valid Find non-EAX doubleword starting at 
ES:[(E)DI]. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

F3 REX.W AF REPE SCAS m64 ZO | Valid N.E. Find non-RAX quadword starting at [RDI]. 

F2 A6 REPNE CMPS m8, m8 ZO ‘| Valid Valid Find matching bytes in ES:[(E)DI] and DS:[(E)SI). 

F2 REX.W A6 REPNE CMPS m8, m8 ZO | Valid N.E. Find matching bytes in [RDI] and [RSI]. 

F2 A7 REPNE CMPS m16, m16 ZO | Valid Valid Find matching words in ES:[(€)DI] and 
DS:[(E)SI]. 

F2 A7 REPNE CMPS m32, m32 ZO | Valid Valid Find matching doublewords in ES:[(€)DI] and 
DS:[(E)SI1]. 

F2 REX.W A7 REPNE CMPS m64, m64 ZO ‘| Valid N.E. Find matching doublewords in [RDI] and [RSI]. 

F2 AE REPNE SCAS m8 ZO_ ‘| Valid Valid Find AL, starting at ES:[(€)DI]. 

F2 REX.W AE REPNE SCAS m8 ZO_ ‘| Valid N.E. Find AL, starting at [RDI]. 

F2 AF REPNE SCAS m16 ZO_ | Valid Valid Find AX, starting at ES:[(E)DI]. 

F2 AF REPNE SCAS m32 ZO_ ‘| Valid Valid Find EAX, starting at ES:[(E)DI]. 

F2 REX.W AF REPNE SCAS m64 ZO_ ‘| Valid N.E. Find RAX, starting at [RDI]. 

NOTES: 

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Repeats a string instruction the number of times specified in the count register or until the indicated condition of 
the ZF flag is no longer met. The REP (repeat), REPE (repeat while equal), REPNE (repeat while not equal), REPZ 
(repeat while zero), and REPNZ (repeat while not zero) mnemonics are prefixes that can be added to one of the 
string instructions. The REP prefix can be added to the INS, OUTS, MOVS, LODS, and STOS instructions, and the 
REPE, REPNE, REPZ, and REPNZ prefixes can be added to the CMPS and SCAS instructions. (The REPZ and REPNZ 
prefixes are synonymous forms of the REPE and REPNE prefixes, respectively.) The F3H prefix is defined for the 
following instructions and undefined for the rest: 


¢ F3H as REP/REPE/REPZ for string and input/output instruction. 
¢ F3H is a mandatory prefix for POPCNT, LZCNT, and ADOX. 


The REP prefixes apply only to one string instruction at a time. To repeat a block of instructions, use the LOOP 
instruction or another looping construct. All of these repeat prefixes cause the associated instruction to be repeated 
until the count in register is decremented to 0. See Table 4-22. 


Table 4-22. Repeat Prefixes 


Repeat Prefix Termination Condition 1* Termination Condition 2 
REP RCX or (E)CX = 0 None 

REPE/REPZ RCX or (E)CX = 0 ZF=0 

REPNE/REPNZ RCX or (E)CX = 0 ZF=1 

NOTES: 


* Count register is CX, ECX or RCX by default, depending on attributes of the operating modes. 
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The REPE, REPNE, REPZ, and REPNZ prefixes also check the state of the ZF flag after each iteration and terminate 
the repeat loop if the ZF flag is not in the specified state. When both termination conditions are tested, the cause 
of a repeat termination can be determined either by testing the count register with a JECXZ instruction or by 
testing the ZF flag (with a JZ, JNZ, or JNE instruction). 


When the REPE/REPZ and REPNE/REPNZ prefixes are used, the ZF flag does not require initialization because both 
the CMPS and SCAS instructions affect the ZF flag according to the results of the comparisons they make. 


A repeating string operation can be suspended by an exception or interrupt. When this happens, the state of the 
registers is preserved to allow the string operation to be resumed upon a return from the exception or interrupt 
handler. The source and destination registers point to the next string elements to be operated on, the EIP register 
points to the string instruction, and the ECX register has the value it held following the last successful iteration of 
the instruction. This mechanism allows long string operations to proceed without affecting the interrupt response 
time of the system. 


When a fault occurs during the execution of a CMPS or SCAS instruction that is prefixed with REPE or REPNE, the 
EFLAGS value is restored to the state prior to the execution of the instruction. Since the SCAS and CMPS instruc- 
tions do not use EFLAGS as an input, the processor can resume the instruction after the page fault handler. 


Use the REP INS and REP OUTS instructions with caution. Not all I/O ports can handle the rate at which these 
instructions execute. Note that a REP STOS instruction is the fastest way to initialize a large block of memory. 


In 64-bit mode, the operand size of the count register is associated with the address size attribute. Thus the default 
count register is RCX; REX.W has no effect on the address size and the count register. In 64-bit mode, if 67H is 
used to override address size attribute, the count register is ECX and any implicit source/destination operand will 
use the corresponding 32-bit index register. See the summary chart at the beginning of this section for encoding 
data and limits. 


REP INS may read from the I/O port without writing to the memory location if an exception or VM exit occurs due 
to the write (e.g. #PF). If this would be problematic, for example because the I/O port read has side-effects, soft- 
ware should ensure the write to the memory location does not cause an exception or VM exit. 


Operation 
IF AddressSize = 16 
THEN 
Use CX for CountReg; 


Implicit Source/Dest operand for memory use of SI/DI; 
ELSE IF AddressSize = 64 
THEN Use RCX for CountReg; 
Implicit Source/Dest operand for memory use of RSI/RDI; 
ELSE 
Use ECX for CountReg; 
Implicit Source/Dest operand for memory use of ESI/EDI; 
Fl; 
WHILE CountReg # 0 
DO 
Service pending interrupts (if any); 
Execute associated string instruction; 
CountReg := (CountReg - 1); 
IF CountReg = 0 
THEN exit WHILE loop; FI; 
IF (Repeat prefix is REPZ or REPE) and (ZF = 0) 
or (Repeat prefix is REPNZ or REPNE) and (ZF = 1) 
THEN exit WHILE loop; FI; 
OD; 


Flags Affected 
None; however, the CMPS and SCAS instructions do set the status flags in the EFLAGS register. 
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Exceptions (All Operating Modes) 
Exceptions may be generated by an instruction associated with the prefix. 


64-Bit Mode Exceptions 
#GP(0) If the memory address is in a non-canonical form. 
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RET—Return from Procedure 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
C3 RET ZO | Valid Valid Near return to calling procedure. 
CB RET ZO | Valid Valid Far return to calling procedure. 
C2 iw RET imm16 | Valid Valid Near return to calling procedure and pop 


imm16 bytes from stack. 


CA iw RET imm16 | Valid Valid Far return to calling procedure and pop imm16 
bytes from stack. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
| imm16 NA NA NA 
Description 


Transfers program control to a return address located on the top of the stack. The address is usually placed on the 
stack by a CALL instruction, and the return is made to the instruction that follows the CALL instruction. 


The optional source operand specifies the number of stack bytes to be released after the return address is popped; 
the default is none. This operand can be used to release parameters from the stack that were passed to the called 
procedure and are no longer needed. It must be used when the CALL instruction used to switch to a new procedure 
uses a call gate with a non-zero word count to access the new procedure. Here, the source operand for the RET 
instruction must specify the same number of bytes as is specified in the word count field of the call gate. 


The RET instruction can be used to execute three different types of returns: 


¢ Near return — Areturn to a calling procedure within the current code segment (the segment currently pointed 
to by the CS register), sometimes referred to as an intrasegment return. 


¢ Far return — A return to a calling procedure located in a different segment than the current code segment, 
sometimes referred to as an intersegment return. 


¢ Inter-privilege-level far return — A far return to a different privilege level than that of the currently 
executing program or procedure. 


The inter-privilege-level return type can only be executed in protected mode. See the section titled “Calling Proce- 
dures Using Call and RET” in Chapter 6 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1, for detailed information on near, far, and inter-privilege-level returns. 


When executing a near return, the processor pops the return instruction pointer (offset) from the top of the stack 
into the EIP register and begins program execution at the new instruction pointer. The CS register is unchanged. 


When executing a far return, the processor pops the return instruction pointer from the top of the stack into the EIP 
register, then pops the segment selector from the top of the stack into the CS register. The processor then begins 
program execution in the new code segment at the new instruction pointer. 


The mechanics of an inter-privilege-level far return are similar to an intersegment return, except that the 
processor examines the privilege levels and access rights of the code and stack segments being returned to deter- 
mine if the control transfer is allowed to be made. The DS, ES, FS, and GS segment registers are cleared by the RET 
instruction during an inter-privilege-level return if they refer to segments that are not allowed to be accessed at the 
new privilege level. Since a stack switch also occurs on an inter-privilege level return, the ESP and SS registers are 
loaded from the stack. 


If parameters are passed to the called procedure during an inter-privilege level call, the optional source operand 
must be used with the RET instruction to release the parameters on the return. Here, the parameters are released 
both from the called procedure’s stack and the calling procedure’s stack (that is, the stack being returned to). 


In 64-bit mode, the default operation size of this instruction is the stack-address size, i.e. 64 bits. This applies to 
near returns, not far returns; the default operation size of far returns is 32 bits. 
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Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Tech- 
nology (CET)” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET details. 


Instruction ordering. Instructions following a far return may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the far return have 
completed execution (the later instructions may execute before data stored by the earlier instructions have become 
globally visible). 


Unlike near indirect CALL and near indirect JMP, the processor will not speculatively execute the next sequential 
instruction after a near RET unless that instruction is also the target of a jump or is a target in a branch predictor. 


Operation 


(* Near return *) 
IF instruction = near return 
THEN; 
IF OperandSize = 32 
THEN 
IF top 4 bytes of stack not within stack limits 
THEN #SS(0); Fl; 
EIP := Pop(); 
IF ShadowStackEnabled(CPL) 
tempSsEIP = ShadowStackPop4B(); 
IF EIP = TempSsEIP 
THEN #CP(NEAR_RET); Fl; 
Fl; 
ELSE 
IF OperandSize = 64 
THEN 
IF top 8 bytes of stack not within stack limits 
THEN #SS(0); FI; 
RIP := Pop(); 
IF ShadowStackEnabled(CPL) 
tempSsEIP = ShadowStackPop8B(); 
IF RIP != tempSsE€IP 
THEN #CP(NEAR_RET); Fl; 
Fl; 
ELSE (* OperandSize = 16 *) 
IF top 2 bytes of stack not within stack limits 
THEN #SS(0); Fl; 
tempEIP := Pop(); 
tempElP := tempElP AND OOOOFFFFH; 
IF tempElP not within code segment limits 
THEN #GP(0); FI; 
EIP := tempEIP; 
IF ShadowStackEnabled(CPL) 
tempSsEip = ShadowStackPop4B(); 
IF EIP != tempSsEIP 
THEN #CP(NEAR_RET); Fl; 
Fl; 
Fl; 
Fl; 


IF instruction has immediate operand 
THEN (* Release parameters from stack *) 
IF StackAddressSize = 32 
THEN 
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ESP := ESP + SRC; 


ELSE 
IF StackAddressSize = 64 
THEN 
RSP := RSP + SRC; 
ELSE (* StackAddressSize = 16 *) 
SP := SP + SRC; 
Fl; 


Fl; 
Fl; 
Fl; 


(* Real-address mode or virtual-8086 mode *) 
IF ((PE = 0) or (PE = 1 AND VM = 1)) and instruction = far return 
THEN 
IF OperandSize = 32 
THEN 
IF top 8 bytes of stack not within stack limits 
THEN #SS(0); FI; 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
ELSE (* OperandSize = 16 *) 
IF top 4 bytes of stack not within stack limits 
THEN #SS(0); FI; 
tempElP := Pop(); 
tempEIP := tempEIP AND OOOOFFFFH; 
IF tempElP not within code segment limits 
THEN #GP(0); Fl; 
EIP := tempEIP; 
CS := Pop(); (* 16-bit pop *) 
Fl; 
IF instruction has immediate operand 
THEN (* Release parameters from stack *) 
SP := SP + (SRC AND FFFFH); 
Fl; 
Fl; 


(* Protected mode, not virtual-8086 mode *) 
IF (PE = 1 and VM = O and IA32_EFER.LMA = 0) and instruction = far return 


THEN 
IF OperandSize = 32 
THEN 
IF second doubleword on stack is not within stack limits 
THEN #SS(0); FI; 
ELSE (* OperandSize = 16 *) 
IF second word on stack is not within stack limits 
THEN #SS(0); Fl; 
Fl; 


IF return code segment selector is NULL 
THEN #GP(0); Fl; 
IF return code segment selector addresses descriptor beyond descriptor table limit 
THEN #GP(selector); Fl; 
Obtain descriptor to which return code segment selector points from descriptor table; 
IF return code segment descriptor is not a code segment 
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THEN #GP(selector); FI; 
IF return code segment selector RPL < CPL 
THEN #GP(selector); Fl; 
IF return code segment descriptor is conforming 
and return code segment DPL > return code segment selector RPL 
THEN #GP(selector); Fl; 
IF return code segment descriptor is non-conforming and return code 
segment DPL # return code segment selector RPL 
THEN #GP(selector); Fl; 
IF return code segment descriptor is not present 
THEN #NP(selector); FI: 
IF return code segment selector RPL > CPL 
THEN GOTO RETURN-TO-OUTER-PRIVILEGE-LEVEL; 
ELSE GOTO RETURN-TO-SAME-PRIVILEGE-LEVEL; 
Fl; 
Fl; 


RETURN-TO-SAME-PRIVILEGE-LEVEL: 


IF the return instruction pointer is not within the return code segment limit 


THEN #GP(0); Fl; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
ELSE (* OperandSize = 16 *) 
EIP := Pop(); 
EIP := EIP AND OOOOFFFFH; 
CS := Pop(); (* 16-bit pop *) 
Fl; 
IF instruction has immediate operand 
THEN (* Release parameters from stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE (* StackAddressSize = 16 *) 
SP := SP + SRC; 
Fl; 
Fl; 
IF ShadowStackEnabled(CPL) 
(* SSP must be 8 byte aligned *) 
IF SSP AND 0x7 != 0 
THEN #CP(FAR-RET/IRET); Fl; 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
prevSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 


(* do a 64 bit-compare to check if any bits beyond bit 15 are set *) 


tempCS = CS; (* zero pad to 64 bit *) 
IF tempCs != tempSsCS 
THEN #CP(FAR-RET/IRET); FI; 
(* do a 64 bit-compare; pad CSBASE+RIP with O for 32 bit LIP*) 
IF CSBASE + RIP != tempSsLIP 
THEN #CP(FAR-RET/IRET); Fl; 
(* prevSSP must be 4 byte aligned *) 
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IF prevSSP AND 0x3 != 0 
THEN #CP(FAR-RET/IRET); Fl; 
(* In legacy mode SSP must be in low 4GB *) 
IF prevSSP[63:32] != 0 
THEN #GP(0); Fl; 
SSP := prevSSP 
Fl; 


RETURN-TO-OUTER-PRIVILEGE-LEVEL: 
IF top (16 + SRC) bytes of stack are not within stack limits (OperandSize = 32) 
or top (8 + SRC) bytes of stack are not within stack limits (OQperandSize = 16) 
THEN #SS(0); Fl; 
Read return segment selector; 
IF stack segment selector is NULL 
THEN #GP(0); Fl; 
IF return stack segment selector index is not within its descriptor table limits 
THEN #GP(selector); FI; 
Read segment descriptor pointed to by return segment selector; 
IF stack segment selector RPL # RPL of the return code segment selector 
or stack segment is not a writable data segment 
or stack segment descriptor DPL # RPL of the return code segment selector 
THEN #GP(selector); Fl; 
IF stack segment not present 
THEN #SS(StackSegmentSelector); Fl; 
IF the return instruction pointer is not within the return code segment limit 
THEN #GP(0); Fl; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded; segment descriptor loaded *) 
CS(RPL) := ReturnCodeSegmentSelector(RPL); 
IF instruction has immediate operand 
THEN (* Release parameters from called procedure’s stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE (* StackAddressSize = 16 *) 
SP := SP + SRC; 
Fl; 
Fl; 
temp€SP := Pop(); 
tempSS := Pop(); (* 32-bit pop, high-order 16 bits discarded; seg. descriptor loaded *) 
ELSE (* OperandSize = 16 *) 
EIP := Pop(); 
EIP := EIP AND OOOOFFFFH; 
CS := Pop(); (* 16-bit pop; segment descriptor loaded *) 
CS(RPL) := ReturnCodeSegmentSelector(RPL); 
IF instruction has immediate operand 
THEN (* Release parameters from called procedure’s stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE (* StackAddressSize = 16 *) 
SP := SP + SRC; 
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Fl; 
Fl; 
temp€ESP := Pop(); 
tempSS := Pop(); (* 16-bit pop; segment descriptor loaded *) 
Fl; 
IF ShadowStackEnabled(CPL) 
(* check if 8 byte aligned *) 
IF SSP AND 0x7 != 0 
THEN #CP(FAR-RET/IRET); Fl; 
IF ReturnCodeSegmentSelector(RPL) !=3 
THEN 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
tempSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 
(* Do 64 bit compare to detect bits beyond 15 being set *) 
tempCS = CS; (* zero extended to 64 bit *) 
IF tempCs != tempSsCS 
THEN #CP(FAR-RET/IRET); FI; 
(* Do 64 bit compare; pad CSBASE+RIP with O for 32 bit LA *) 
IF CSBASE + RIP != tempSsLIP 
THEN #CP(FAR-RET/IRET); FI; 
(* check if 4 byte aligned *) 
IF tempSSP AND 0x3 != 0 
THEN #CP(FAR-RET/IRET); FI; 
Fl; 
Fl; 
tempOldCPL = CPL; 


CPL := ReturnCodeSegmentSelector(RPL); 
ESP := tempESP; 
SS := tempSS; 
tempOldSSP = SSP; 
IF ShadowStackEnabled(CPL) 
IF CPL = 3 
THEN tempSSP := IA32_PL3_SSP; Fl; 
IF tempSSP[63:32] != 0 
THEN #GP(0); Fl; 
SSP := tempSSP 
Fl; 
(* Now past all faulting points; safe to free the token. The token free is done using the old SSP 
* and using a supervisor override as old CPL was a supervisor privilege level *) 
IF ShadowStackEnabled(tempOldCPL) 
expected_token_value = tempOldSSP | BUSY_BIT (* busy bit - bit position O - must be set *) 
new_token_value = tempOldSSP (* clear the busy bit *) 
shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value) 
Fl; 
Fl; 


FOR each SegReg in (ES, FS, GS, and DS) 
DO 
tempDesc := descriptor cache for SegReg (* hidden part of segment register *) 
IF (SegmentSelector == NULL) OR (tempDesc(DPL) < CPL AND tempDesc(Type) is (data or non-conforming code))) 
THEN (* Segment register invalid *) 
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SegmentSelector := 0; (*Segment selector becomes null*) 
Fl; 
OD; 


IF instruction has immediate operand 
THEN (* Release parameters from calling procedure’s stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE (* StackAddressSize = 16 *) 
SP := SP + SRC; 
Fl; 
Fl; 


(* IA-32e Mode *) 
IF (PE = 1 and VM = 0 and IA32_EFER.LMA = 1) and instruction = far return 


THEN 
IF OperandSize = 32 
THEN 
IF second doubleword on stack is not within stack limits 
THEN #SS(0); FI; 
IF first or second doubleword on stack is not in canonical space 
THEN #SS(0); FI; 
ELSE 
IF OperandSize = 16 
THEN 
IF second word on stack is not within stack limits 
THEN #SS(0); FI; 
IF first or second word on stack is not in canonical space 
THEN #SS(0); FI; 
ELSE (* OperandSize = 64 *) 
IF first or second quadword on stack is not in canonical space 
THEN #SS(0); FI; 
Fl 
Fl; 


IF return code segment selector is NULL 
THEN GP(0); Fl; 
IF return code segment selector addresses descriptor beyond descriptor table limit 
THEN GP(selector); Fl; 
IF return code segment selector addresses descriptor in non-canonical space 
THEN GP(selector); Fl; 
Obtain descriptor to which return code segment selector points from descriptor table; 
IF return code segment descriptor is not a code segment 
THEN #GP(selector); Fl; 
IF return code segment descriptor has L-bit = 1 and D-bit = 1 
THEN #GP(selector); Fl; 
IF return code segment selector RPL < CPL 
THEN #GP(selector); Fl; 
IF return code segment descriptor is conforming 
and return code segment DPL > return code segment selector RPL 
THEN #GP(selector); Fl; 
IF return code segment descriptor is non-conforming 
and return code segment DPL # return code segment selector RPL 
THEN #GP(selector); Fl; 
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IF return code segment descriptor is not present 
THEN #NP(selector); FI: 
IF return code segment selector RPL > CPL 
THEN GOTO IA-32E-MODE-RETURN-TO-OUTER-PRIVILEGE-LEVEL; 
ELSE GOTO IA-32E-MODE-RETURN-TO-SAME-PRIVILEGE-LEVEL; 
Fl; 
Fl; 


IA-32E-MODE-RETURN-TO-SAME-PRIVILEGE-LEVEL: 
IF the return instruction pointer is not within the return code segment limit 
THEN #GP(0); Fl; 
IF the return instruction pointer is not within canonical address space 
THEN #GP(0); Fl; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) 
ELSE 
IF OperandSize = 16 
THEN 
EIP := Pop(); 
EIP := EIP AND OOOOFFFFH; 
CS := Pop(); (* 16-bit pop *) 
ELSE (* OperandSize = 64 *) 
RIP := Pop(); 
CS := Pop(); (* 64-bit pop, high-order 48 bits discarded *) 
Fl; 
Fl; 
IF instruction has immediate operand 
THEN (* Release parameters from stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE 
IF StackAddressSize = 16 
THEN 
SP := SP + SRC; 
ELSE (* StackAddressSize = 64 *) 
RSP := RSP + SRC; 
Fl; 
Fl; 
Fl; 
IF ShadowStackEnabled(CPL) 
IF SSP AND 0x7 != 0 (* check if aligned to 8 bytes *) 
THEN #CP(FAR-RET/IRET); Fl; 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
tempSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 
tempCS = CS; (* zero padded to 64 bit *) 
IF tempCS != tempSsCS (* 64 bit compare; CS zero padded to 64 bits *) 
THEN #CP(FAR-RET/IRET); Fl; 
IF CSBASE + RIP != tempSsLIP (* 64 bit compare *) 
THEN #CP(FAR-RET/IRET); Fl; 
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IF tempSSP AND Ox3 != 0 (* check if aligned to 4 bytes *) 
THEN #CP(FAR-RET/IRET); Fl; 
IF (CS.L = O AND tempSSP[63:32] != 0) OR 
(CS.L = 1 AND tempSSP is not canonical relative to the current paging mode) 
THEN #GP(0); Fl; 
SSP := tempSSP 
Fl; 


IA-32€-MODE-RETURN-TO-OUTER-PRIVILEGE-LEVEL: 
IF top (16 + SRC) bytes of stack are not within stack limits (OperandSize = 32) 
or top (8 + SRC) bytes of stack are not within stack limits (OQperandSize = 16) 
THEN #SS(0); Fl; 
IF top (16 + SRC) bytes of stack are not in canonical address space (OperandSize =32) 
or top (8 + SRC) bytes of stack are not in canonical address space (OperandSize = 16) 
or top (32 + SRC) bytes of stack are not in canonical address space (OperandSize = 64) 
THEN #SS(0); Fl; 
Read return stack segment selector; 
IF stack segment selector is NULL 
THEN 
IF new CS descriptor L-bit = 0 
THEN #GP(selector); 
IF stack segment selector RPL = 3 
THEN #GP(selector); 


Fl; 
IF return stack segment descriptor is not within descriptor table limits 
THEN #GP(selector); Fl; 
IF return stack segment descriptor is in non-canonical address space 
THEN #GP(selector); Fl; 
Read segment descriptor pointed to by return segment selector; 
IF stack segment selector RPL # RPL of the return code segment selector 
or stack segment is not a writable data segment 
or stack segment descriptor DPL # RPL of the return code segment selector 
THEN #GP(selector); Fl; 
IF stack segment not present 
THEN #SS(StackSegmentSelector); Fl; 
IF the return instruction pointer is not within the return code segment limit 
THEN #GP(0); Fl: 
IF the return instruction pointer is not within canonical address space 
THEN #GP(0); Fl; 
IF OperandSize = 32 
THEN 
EIP := Pop(); 
CS := Pop(); (* 32-bit pop, high-order 16 bits discarded, segment descriptor loaded *) 
CS(RPL) := ReturnCodeSegmentSelector(RPL); 
IF instruction has immediate operand 
THEN (* Release parameters from called procedure’s stack *) 
IF StackAddressSize = 32 


THEN 
ESP := ESP + SRC; 
ELSE 
IF StackAddressSize = 16 
THEN 
SP := SP + SRC; 


ELSE (* StackAddressSize = 64 *) 
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RSP := RSP + SRC; 
Fl; 
Fl; 
Fl; 
temp€ESP := Pop(); 
tempSS := Pop(); (* 32-bit pop, high-order 16 bits discarded, segment descriptor loaded *) 
ELSE 
IF OperandSize = 16 
THEN 
EIP := Pop(); 
EIP := EIP AND OOOOFFFFH; 
CS := Pop(); (* 16-bit pop; segment descriptor loaded *) 
CS(RPL) := ReturnCodeSegmentSelector(RPL); 
IF instruction has immediate operand 
THEN (* Release parameters from called procedure’s stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE 
IF StackAddressSize = 16 
THEN 
SP := SP + SRC; 
ELSE (* StackAddressSize = 64 *) 
RSP := RSP + SRC; 
Fl; 
Fl; 
Fl; 
tempESP := Pop(); 
tempSS := Pop(); (* 16-bit pop; segment descriptor loaded *) 
ELSE (* OperandSize = 64 *) 
RIP := Pop(); 
CS := Pop(); (* 64-bit pop; high-order 48 bits discarded; seg. descriptor loaded *) 
CS(RPL) := ReturnCodeSegmentSelector(RPL); 
IF instruction has immediate operand 
THEN (* Release parameters from called procedure’s stack *) 
RSP := RSP + SRC; 
Fl; 
tempESP := Pop(); 
tempSS := Pop(); (* 64-bit pop; high-order 48 bits discarded; seg. desc. loaded *) 
Fl; 
Fl; 


IF ShadowStackEnabled(CPL) 
(* check if 8 byte aligned *) 
IF SSP AND 0x7 != 0 
THEN #CP(FAR-RET/IRET); FI; 
IF ReturnCodeSegmentSelector(RPL) !=3 
THEN 
tempSsCS = shadow_stack_load 8 bytes from SSP+16; 
tempSsLIP = shadow_stack_load 8 bytes from SSP+8; 
tempSSP = shadow_stack_load 8 bytes from SSP; 
SSP = SSP + 24; 
(* Do 64 bit compare to detect bits beyond 15 being set *) 
tempCS = CS; (* zero padded to 64 bit *) 
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IF tempCs != tempSsCS 
THEN #CP(FAR-RET/IRET); Fl; 
(* Do 64 bit compare; pad CSBASE+RIP with O for 32 bit LIP *) 
IF CSBASE + RIP != tempSsLIP 
THEN #CP(FAR-RET/IRET); Fl; 
(* check if 4 byte aligned *) 
IF tempSSP AND Ox3 != 0 
THEN #CP(FAR-RET/IRET); FI; 
Fl; 
Fl; 
tempOldCPL = CPL; 
CPL := ReturnCodeSegmentSelector(RPL); 
ESP := tempESP; 
SS := tempSS; 
tempOldSSP = SSP; 
IF ShadowStackEnabled(CPL) 
IF CPL = 3 
THEN tempSSP := [A32_PL3_SSP; Fl; 
IF (CS.L = O AND tempSSP[63:32] != 0) OR 
(CS.L = 1 AND tempSSP is not canonical relative to the current paging mode) 
THEN #GP(0); Fl; 
SSP := tempSSP 
Fl; 
(* Now past all faulting points; safe to free the token. The token free is done using the old SSP 
* and using a supervisor override as old CPL was a supervisor privilege level *) 
IF ShadowStackEnabled(tempOldCPL) 
expected_token_value = tempOldSSP | BUSY_BIT (* busy bit - bit position O - must be set *) 
new_token_value = tempOldSSP (* clear the busy bit *) 
shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value) 
Fl; 


FOR each of segment register (ES, FS, GS, and DS) 
DO 
IF segment register points to data or non-conforming code segment 
and CPL > segment descriptor DPL; (* DPL in hidden part of segment register *) 
THEN SegmentSelector := 0; (* SegmentSelector invalid *) 
Fl; 
OD; 


IF instruction has immediate operand 
THEN (* Release parameters from calling procedure’s stack *) 
IF StackAddressSize = 32 
THEN 
ESP := ESP + SRC; 
ELSE 
IF StackAddressSize = 16 
THEN 
SP := SP + SRC; 
ELSE (* StackAddressSize = 64 *) 
RSP := RSP + SRC; 
Fl; 
Fl; 
Fl; 
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Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) 


#GP(selector) 


#SS(0) 


#NP(selector) 
#PF(fault-code) 
#AC(0) 
#CP(Far-RET/IRET) 


If the return code or stack segment selector is NULL. 
If the return instruction pointer is not within the return code segment limit. 


If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when 
returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB. 


If the RPL of the return code segment selector is less then the CPL. 
If the return code or stack segment selector index is not within its descriptor table limits. 
If the return code segment descriptor does not indicate a code segment. 


If the return code segment is non-conforming and the segment selector’s DPL is not equal to 
the RPL of the code segment’s segment selector 


If the return code segment is conforming and the segment selector’s DPL greater than the RPL 
of the code segment’s segment selector 


If the stack segment is not a writable data segment. 
If the stack segment selector RPL is not equal to the RPL of the return code segment selector. 


If the stack segment descriptor DPL is not equal to the RPL of the return code segment 
selector. 


If the top bytes of stack are not within stack limits. 

If the return stack segment is not present. 

If the return code segment is not present. 

If a page fault occurs. 

If an unaligned memory access occurs when the CPL is 3 and alignment checking is enabled. 


If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP 
(returning to CPL 3) is not 4 byte aligned. 


If return instruction pointer from stack and shadow stack do not match. 


Real-Address Mode Exceptions 


#GP 
#SS 


If the return instruction pointer is not within the return code segment limit 
If the top bytes of stack are not within stack limits. 


Virtual-8086 Mode Exceptions 


#GP(0) 
#SS(0) 
#PF(fault-code) 
#AC(0) 


If the return instruction pointer is not within the return code segment limit 
If the top bytes of stack are not within stack limits. 

If a page fault occurs. 

If an unaligned memory access occurs when alignment checking is enabled. 


Compatibility Mode Exceptions 
Same as 64-bit mode exceptions. 
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64-Bit Mode Exceptions 
#GP(0) If the return instruction pointer is non-canonical. 
If the return instruction pointer is not within the return code segment limit. 
If the stack segment selector is NULL going back to compatibility mode. 
If the stack segment selector is NULL going back to CPL3 64-bit mode. 
If a NULL stack segment selector RPL is not equal to CPL going back to non-CPL3 64-bit mode. 
If the return code segment selector is NULL. 


If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when 
returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB. 


#GP(selector) If the proposed segment descriptor for a code segment does not indicate it is a code segment. 
If the proposed new code segment descriptor has both the D-bit and L-bit set. 


If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment 
selector. 


If CPL is greater than the RPL of the code segment selector. 


If the DPL of a conforming-code segment is greater than the return code segment selector 
RPL. 


If a segment selector index is outside its descriptor table limits. 

If a segment descriptor memory address is non-canonical. 

If the stack segment is not a writable data segment. 

If the stack segment descriptor DPL is not equal to the RPL of the return code segment 


selector. 

If the stack segment selector RPL is not equal to the RPL of the return code segment selector. 
#SS(0) If an attempt to pop a value off the stack violates the SS limit. 

If an attempt to pop a value off the stack causes a non-canonical address to be referenced. 
#NP(selector) If the return code or stack segment is not present. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 


current privilege level is 3. 


#CP(Far-RET/IRET) If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP 
(returning to CPL 3) is not 4 byte aligned. 


If return instruction pointer from stack and shadow stack do not match. 
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RORX — Rotate Right Logical Without Affecting Flags 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode | Flag 
VEX.LZ.F2.0F3A.WO FO /r ib RMI | V/V BMI2 Rotate 32-bit r/m32 right imm8 times without affecting arithmetic 
RORX r32, r/m32, imm8 flags. 
VEX.LZ.F2.0F3A.W1 FO /r ib RMI | V/N.E. | BMI2 Rotate 64-bit r/m64 right imm8 times without affecting arithmetic 
RORX r64, r/m64, imm8 flags. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Rotates the bits of second operand right by the count value specified in imm8 without affecting arithmetic flags. 


The RORX instruction does not read or write the arithmetic flags. 


This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt 


to execute this instruction with VEX.L not equal to 0 will cause #UD. 


Operation 


IF (OperandSize = 32) 

y := imm8 AND 1FH; 

DEST := (SRC >> y) | (SRC << (32-y)); 
ELSEIF (OperandSize = 64 ) 

y = imm8 AND 3FH; 

DEST := (SRC >> y) | (SRC << (64-y)); 
FI; 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 
Auto-generated from high-level language. 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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ROUNDPD — Round Packed Double Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

66 OF 3A 09 /r ib RMI | V/V SSE4_1 Round packed double precision floating-point 

ROUNDPD xmm1, xmm2/m128, imm8 values in xmm2/m1 28 and place the result in 
xmm1. The rounding mode is determined by 
immé. 

VEX.128.66.0F3A.WIG 09 /r ib RMI | V/V AVX Round packed double-precision floating-point 

VROUNDPD xmm1, xmm2/m128, imm8 values in xmm2/m128 and place the result in 
xmm1. The rounding mode is determined by 
immé. 

VEX.256.66.0F3A.WIG 09 /r ib RMI | V/V AVX Round packed double-precision floating-point 

VROUNDPD ymm1, ymm2/m256, imm8 values in ynm2/m256 and place the result in 
ymm1. The rounding mode is determined by 
immé. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
Description 


Round the 2 double-precision floating-point values in the source operand (second operand) using the rounding 
mode specified in the immediate operand (third operand) and place the results in the destination operand (first 
operand). The rounding process rounds each input floating-point value to an integer value and returns the integer 
result as a double-precision floating-point value. 


The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in 
Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the 
source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded 
values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina- 
tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding YMM 
register destination are unmodified. 


VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina- 
tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 


VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination 
operand is a YMM register. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 
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3210 


Reserved 


P — Precision Mask; 0: normal, 1: inexact 
RS — Rounding select; 1: MXCSR.RC, 0: Imm8.RC 


RC — Rounding mode 


Figure 4-24. Bit Control Fields of Immediate Byte for ROUNDxx Instruction 


Table 4-23. Rounding Modes and Encoding of Rounding Control (RC) Field 


Rounding RC Field | Description 

Mode Setting 

Round to OOB Rounded result is the closest to the infinitely precise result. If two values are equally close, the result is 
nearest (even) the even value (i.e., the integer value with the least-significant bit of zero). 

Round down 01B Rounded result is closest to but no greater than the infinitely precise result. 

(toward —co) 

Round up 10B Rounded result is closest to but no less than the infinitely precise result. 

(toward +o) 

Round toward | 11B Rounded result is closest to but no greater in absolute value than the infinitely precise result. 

zero (Truncate) 


Operation 


IF (imm[2] = ‘1) 
THEN = // rounding mode is determined by MXCSR.RC 
DEST[63:0] := ConvertDPFPTolnteger_M(SRC[63:0}); 
DEST[1 27:64] := ConvertDPFPTolnteger_M(SRC[127:64}); 
ELSE // rounding mode is determined by IMM8.RC 
DEST[63:0] := ConvertDPFPTolnteger_Imm(SRC[63:0)); 
DEST[1 27:64] := ConvertDPFPTolnteger_Imm(SRC[1 27:64); 
Fl 


ROUNDPD (128-bit Legacy SSE version) 

DEST[63:0] := RoundTolnteger(SRC[63:0]], ROUND_CONTROL) 
DEST[127:64] := RoundTolnteger(SRC[127:64]], ROUND_CONTROL) 
DEST[MAXVL-1:128] (Unmodified) 


VROUNDPD (VEX.128 encoded version) 

DEST[63:0] := RoundTolnteger(SRC[63:0]], ROUND_CONTROL) 
DEST[127:64] := RoundTolnteger(SRC[127:64]], ROUND_CONTROL) 
DEST[MAXVL-1:128] := 0 


VROUNDPD (VEX.256 encoded version) 

DEST[63:0] := RoundTolnteger(SRC[63:0], ROUND_CONTROL) 
DEST[127:64] := RoundTolnteger(SRC[127:64]], ROUND_CONTROL) 
DEST[191:128] := RoundTolnteger(SRC[191:128]], ROUND_CONTROL) 
DEST[255:192] := RoundTolnteger(SRC[255:192] ], ROUND_CONTROL) 
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Intel C/C++ Compiler Intrinsic Equivalent 
m128 _mm_round_pd(__m128d s1, int iRoundMode); 
m128 _mm_floor_pd(__m128d s1); 
m128 _mm_ceil_pd(__m128d s1) 
m256 __mm256_round_pd(__m256d s1, int iRoundMode); 
m256 __mm256_floor_pd(__m256d s1); 
m256 _mm256_ceil_pd(__m256d s1) 


SIMD Floating-Point Exceptions 
Invalid (signaled only if SRC = SNaN) 


Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci- 
sion exception is not signaled.) 


Note that Denormal is not signaled by ROUNDPD. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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ROUNDPS — Round Packed Single Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

66 OF 3A 08 RMI | V/V SSE4_1 Round packed single precision floating-point 

/r ib values in xmm2/m128 and place the result in 

ROUNDPS xmm1, xmm2/m128, imm8 xmm1. The rounding mode is determined by 
immé. 

VEX.128.66.0F3A.WIG 08 /r ib RMI | V/V AVX Round packed single-precision floating-point 

VROUNDPS xmm17, xmm2/m128, imm8 values in xmm2/m128 and place the result in 
xmm1. The rounding mode is determined by 
immé. 

VEX.256.66.0F3A.WIG 08 /r ib RMI | V/V AVX Round packed single-precision floating-point 

VROUNDPS ymm1, ynm2/m256, imm8 values in ymm2/m256 and place the result in 
ymm1. The rounding mode is determined by 
immé. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
Description 


Round the 4 single-precision floating-point values in the source operand (second operand) using the rounding 
mode specified in the immediate operand (third operand) and place the results in the destination operand (first 
operand). The rounding process rounds each input floating-point value to an integer value and returns the integer 
result as a single-precision floating-point value. 


The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in 
Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the 
source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded 
values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina- 
tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding YMM 
register destination are unmodified. 


VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina- 
tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 


VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination 
operand is a YMM register. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


IF (imm[2] = ‘1) 

THEN = // rounding mode is determined by MXCSR.RC 
DEST[31:0] := ConvertSPFPTolnteger_M(SRC[31:0)); 
DEST[63:32] := ConvertSPFPTolnteger_M(SRC[63:32]); 
DEST[95:64] := ConvertSPFPTolnteger_M(SRC[95:64)); 
DEST[1 27:96] := ConvertSPFPTolnteger_M(SRC[127:96]); 

ELSE // rounding mode is determined by IMM8.RC 
DEST[31:0] := ConvertSPFPTolnteger_Imm(SRC[31:0]); 
DEST[63:32] := ConvertSPFPTolnteger_Imm(SRC[63:32]); 
DEST[95:64] := ConvertSPFPTolnteger_Imm(SRC[95:64}); 
DEST[1 27:96] := ConvertSPFPTolnteger_Imm(SRC[127:96]); 

Fl; 


ROUNDPS(1 28-bit Legacy SSE version) 

DEST[31:0] := RoundTolnteger(SRC[31:0], ROUND_CONTROL) 
DEST[63:32] := RoundTolnteger(SRC[63:32], ROUND_CONTROL) 
DEST[95:64] := RoundTolnteger(SRC[95:64]], ROUND_CONTROL) 
DEST[127:96] := RoundTolnteger(SRC[127:96]], ROUND_CONTROL) 
DEST[MAXVL-1:128] (Unmodified) 


VROUNDPS (VEX.128 encoded version) 

DEST[31:0] := RoundTolnteger(SRC[31:0], ROUND_CONTROL) 
DEST[63:32] := RoundTolnteger(SRC[63:32], ROUND_CONTROL) 
DEST[95:64] := RoundTolnteger(SRC[95:64]], ROUND_CONTROL) 
DEST[127:96] := RoundTolnteger(SRC[127:96]], ROUND_CONTROL) 
DEST[MAXVL-1:128] := 0 


VROUNDPS (VEX.256 encoded version) 

DEST[31:0] := RoundTolnteger(SRC[31:0], ROUND_CONTROL) 
DEST[63:32] := RoundTolnteger(SRC[63:32], ROUND_CONTROL) 
DEST[95:64] := RoundTolnteger(SRC[95:64]], ROUND_CONTROL) 
DEST[127:96] := RoundTolnteger(SRC[127:96]], ROUND_CONTROL) 


DEST[159:128] := RoundTolnteger(SRC[159:128]], ROUND_CONTROL) 
DEST[191:160] := RoundTolnteger(SRC[191:160]], ROUND_CONTROL) 
DEST[223:192] := RoundTolnteger(SRC[223:1 92] ], ROUND_CONTROL) 
DEST[255:224] := RoundTolnteger(SRC[255:224] ], ROUND_CONTROL) 


Intel C/C++ Compiler Intrinsic Equivalent 


m128 _mm_round_ps(__m128 s1, int iRoundMode); 


m128 _mm_floor_ps(__m128 s1); 


m128 _mm_ceil_ps(__m128 s1) 

m256 __mm256_round_ps(__m256 s1, int iRoundMode); 
m256 _mm256_floor_ps(__m256 s1); 

m256 __mm256_ceil_ps(__m256 s1) 
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SIMD Floating-Point Exceptions 
Invalid (signaled only if SRC = SNaN) 


Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci- 
sion exception is not signaled.) 


Note that Denormal is not signaled by ROUNDPS. 


Other Exceptions 
See Table 2-19, “Type 2 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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ROUNDSD — Round Scalar Double Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A OB /r ib RMI | V/V SSE4_1 Round the low packed double precision 
ROUNDSD xmm1, xmm2/m64, imm8 floating-point value in xmm2/m64 and place 


the result in xmm1. The rounding mode is 
determined by immé. 


VEX.LIG.66.0F3A.WIG OB /r ib RVMI | V/V AVX Round the low packed double precision 
VROUNDSD xmm1, xmm2, xmm3/m64, imm8 floating-point value in xmm3/m64 and place 
the result in xmm1. The rounding mode is 
determined by imm8. Upper packed double 
precision floating-point value (bits[127:64]) 
from xmm_2 is copied to xmm1[1 27:64]. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


Round the DP FP value in the lower qword of the source operand (second operand) using the rounding mode spec- 
ified in the immediate operand (third operand) and place the result in the destination operand (first operand). The 
rounding process rounds a double-precision floating-point input to an integer value and returns the integer result 
as a double precision floating-point value in the lowest position. The upper double precision floating-point value in 
the destination is retained. 


The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in 
Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the 
source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded 
values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:64) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 


Operation 


IF (imm[2] = ‘1) 
THEN = // rounding mode is determined by MXCSR.RC 
DEST[63:0] := ConvertDPFPTolnteger_M(SRC[63:0)); 
ELSE // rounding mode is determined by IMM8.RC 
DEST[63:0] := ConvertDPFPTolnteger_Imm(SRC[63:0)); 
Fl; 
DEST[127:63] remains unchanged ; 


ROUNDSD (128-bit Legacy SSE version) 


DEST[63:0] := RoundTolnteger(SRC[63:0], ROUND_CONTROL) 
DEST[MAXVL-1:64] (Unmodified) 


ROUNDSD — Round Scalar Double Precision Floating-Point Values Vol.2B 4-583 


INSTRUCTION SET REFERENCE, M-U 


VROUNDSD (VEX.128 encoded version) 

DEST[63:0] := RoundTolnteger(SRC2[63:0], ROUND_CONTROL) 
DEST[127:64] := SRC1[127:64] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


ROUNDSD: __m128d mm_round_sd(__m128d dst, __m128d s1, int iRoundMode); 
__m128d mm_floor_sd(__m128d dst,__m128d s1); 
__m128d mm_ceil_sd(__m128d dst, ___m128d s1); 


SIMD Floating-Point Exceptions 
Invalid (signaled only if SRC = SNaN) 


Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci- 
sion exception is not signaled.) 


Note that Denormal is not signaled by ROUNDSD. 


Other Exceptions 
See Table 2-20, “Type 3 Class Exception Conditions”. 
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ROUNDSS — Round Scalar Single Precision Floating-Point Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF 3A OA /r ib RMI | V/V SSE4_1 Round the low packed single precision 


floating-point value in xmm2/m32 and place 
the result in xmm1. The rounding mode is 
determined by immé. 


ROUNDSS xmm17, xmm2/m32, imm8 


Round the low packed single precision 
floating-point value in xmm3/m32 and place 
the result in xmm1. The rounding mode is 
determined by imm@. Also, upper packed 
single precision floating-point values 
(bits[127:32]) from xmm2 are copied to 


VEX.LIG.66.0F3A.WIG OA /r ib RVMI | V/V AVX 
VROUNDSS xmm1, xmm2, xmm3/m32, imm8 


xmm1[127:32]. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMI ModRM:reg (w) ModRM:r/m (r) imm8 NA 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8s 
Description 


Round the single-precision floating-point value in the lowest dword of the source operand (second operand) using 
the rounding mode specified in the immediate operand (third operand) and place the result in the destination 
operand (first operand). The rounding process rounds a single-precision floating-point input to an integer value 
and returns the result as a single-precision floating-point value in the lowest position. The upper three single-preci- 
sion floating-point values in the destination are retained. 


The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in 
Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the 
source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded 
values for rounding-mode field). 

The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 


Operation 
IF (imm[2] = ‘1) 
THEN = // rounding mode is determined by MXCSR.RC 
DEST[31:0] := ConvertSPFPTolnteger_M(SRC[31:0)); 
ELSE // rounding mode is determined by IMM8.RC 
DEST[31:0] := ConvertSPFPTolnteger_Imm(SRC[31:0]); 
Fl; 
DEST[127:32] remains unchanged ; 


ROUNDSS (128-bit Legacy SSE version) 
DEST[31:0] := RoundTolnteger(SRC[3 1:0], ROUND_CONTROL) 
DEST[MAXVL-1:32] (Unmodified) 
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VROUNDSS (VEX.128 encoded version) 

DEST[31:0] := RoundTolnteger(SRC2[3 1:0], ROUND_CONTROL) 
DEST[127:32] := SRC1[127:32] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


ROUNDSS: __m128 mm_round_ss(__m128 dst,__m128 s1, int iRoundMode); 
__m128 mm_floor_ss(__m128 dst,__m128 s1); 
__m128 mm_ceil_ss(__m128 dst, _m128 s1); 


SIMD Floating-Point Exceptions 
Invalid (signaled only if SRC = SNaN) 


Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci- 
sion exception is not signaled.) 


Note that Denormal is not signaled by ROUNDSS. 


Other Exceptions 
See Table 2-20, “Type 3 Class Exception Conditions”. 
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RSM—Resume from System Management Mode 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF AA RSM ZO | Valid Valid Resume operation of interrupted program. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Returns program control from system management mode (SMM) to the application program or operating-system 
procedure that was interrupted when the processor received an SMM interrupt. The processor’s state is restored 
from the dump created upon entering SMM. If the processor detects invalid state information during state restora- 
tion, it enters the shutdown state. The following invalid information can cause a shutdown: 


° Any reserved bit of CR4 is set to 1. 
¢ = Any illegal combination of bits in CRO, such as (PG=1 and PE=0) or (NW=1 and CD=0). 


¢ (Intel Pentium and Intel486™ processors only.) The value stored in the state dump base field is not a 32-KByte 
aligned address. 


The contents of the model-specific registers are not affected by a return from SMM. 
The SMM state map used by RSM supports resuming processor context for non-64-bit modes and 64-bit mode. 


See Chapter 30, “System Management Mode,” in the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3C, for more information about SMM and the behavior of the RSM instruction. 


Operation 


ReturnFromSMM; 
IF (IA-32e mode supported) or (CPUID DisplayFamily_DisplayModel = OGH_OCH ) 
THEN 
ProcessorState := Restore(SMMDump(lA-32e SMM STATE MAP)); 
Else 
ProcessorState := Restore(SMMDump(Non-32-Bit-Mode SMM STATE MAP)); 
Fl 


Flags Affected 
All. 


Protected Mode Exceptions 
#UD If an attempt is made to execute this instruction when the processor is not in SMM. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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RSQRTPS—Compute Reciprocals of Square Roots of Packed Single-Precision Floating-Point 
Values 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 52 /r RM | V/V SSE Computes the approximate reciprocals of the 
RSORTPS xmm1, xmm2/m128 square roots of the packed single-precision 


floating-point values in xmm2/m128 and 
stores the results in xmm1. 


VEX.128.0F.WIG 52 /r RM | V/V AVX Computes the approximate reciprocals of the 
VRSQRTPS xmm1, xmm2/m128 square roots of packed single-precision values 
in xmm2/mem and stores the results in xmm17. 
VEX.256.0F.WIG 52 /r RM | V/V AVX Computes the approximate reciprocals of the 
VRSQRTPS ymm1, ymm2/m256 square roots of packed single-precision values 


in ynm2/mem and stores the results in ymm7. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Performs a SIMD computation of the approximate reciprocals of the square roots of the four packed single-preci- 
sion floating-point values in the source operand (second operand) and stores the packed single-precision floating- 
point results in the destination operand. The source operand can be an XMM register or a 128-bit memory location. 
The destination operand is an XMM register. See Figure 10-5 in the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1, for an illustration of a SIMD single-precision floating-point operation. 


The relative error for this approximation is: 


[Relative Error] < 1.5 * 2-!¢ 


The RSQRTPS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is 
a 0.0, an ~ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same 
sign). When a source value is a negative value (other than —0.0), a floating-point indefinite is returned. When a 
source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN is returned. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
YMM register destination are unmodified. 

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination 
operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are 
zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 
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Operation 


RSQRTPS (128-bit Legacy SSE version) 

DEST[31:0] := APPROXIMATE(1/SOQRT(SRC[31:0])) 
DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32])) 
DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64])) 
DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[127:96])) 
DEST[MAXVL-1:128] (Unmodified) 


VRSQRTPS (VEX.128 encoded version) 

DEST[31:0] := APPROXIMATE(1/SOQRT(SRC[31:0])) 
DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32])) 
DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64])) 
DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[1 27:96])) 
DEST[MAXVL-1:128] := 0 


VRSQRTPS (VEX.256 encoded version) 

DEST[31:0] := APPROXIMATE(1/SORT(SRC[31:0])) 
DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32])) 
DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64)])) 
DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[1 27:96])) 
DEST[159:128] := APPROXIMATE(1/SORT(SRC2[159:128]) 
DEST[191:160] := APPROXIMATE(1/SORT(SRC2[191:160]) 
DEST[223:192] := APPROXIMATE(1/SORT(SRC2[223:192]) 
DEST[255:224] := APPROXIMATE(1/SORT(SRC2[255:224]) 


a on 
Sara Tr hw 


Intel C/C++ Compiler Intrinsic Equivalent 


RSQRTPS: m128 _mm_rsqrt_ps(__m128 a) 
RSQRTPS: m256 _mm256_rsqrt_ps (__m256 a); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 
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RSQRTSS—Compute Reciprocal of Square Root of Scalar Single-Precision Floating-Point Value 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 OF 52 /r RM |V/V SSE Computes the approximate reciprocal of the 
RSQRTSS xmm1, xmm2/m32 square root of the low single-precision 


floating-point value in xmm2/m32 and stores 
the results in xmm17. 


VEX.LIG.F3.0F.WIG 52 /r RVM | V/V AVX Computes the approximate reciprocal of the 
VRSQRTSS xmm1, xmm2, xmm3/m32 square root of the low single precision 
floating-point value in xmm3/m32 and stores 
the results in xmm7. Also, upper single 
precision floating-point values (bits[127:32]) 
from xmm2 are copied to xmm1[127:32]. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes an approximate reciprocal of the square root of the low single-precision floating-point value in the 
source operand (second operand) stores the single-precision floating-point result in the destination operand. The 
source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. 
The three high-order doublewords of the destination operand remain unchanged. See Figure 10-6 in the Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a scalar single-precision 
floating-point operation. 


The relative error for this approximation is: 


[Relative Error] < 1.5 * 2-1@ 


The RSQRTSS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is 
a 0.0, an ~ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same 
sign). When a source value is a negative value (other than —0.0), a floating-point indefinite is returned. When a 
source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN is returned. 


In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers 
(XMM8-XMM15). 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed. 


Operation 


RSQRTSS (128-bit Legacy SSE version) 
DEST[31:0] := APPROXIMATE(1/SQRT(SRC2[31:0])) 
DEST[MAXVL-1:32] (Unmodified) 


VRSQRTSS (VEX.128 encoded version) 
DEST[31:0] := APPROXIMATE(1/SQRT(SRC2[31:0])) 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
RSQRTSS: m128_mm_rsqrt_ss(__m128 a) 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 
See Table 2-22, “Type 5 Class Exception Conditions”. 
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RSTORSSP—Restore Saved Shadow Stack Pointer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
F3 OF 01 /5 (mod!=11, /5, M VIV CET_SS Restore SSP. 
memory only) 
RSTORSSP m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r, w) NA NA NA 
Description 


Restores SSP from the shadow-stack-restore token pointed to by m64. If the SSP restore was successful then the 
instruction replaces the shadow-stack-restore token with a previous-ssp token. The instruction sets the CF flag to 
indicate whether the SSP address recorded in the shadow-stack-restore token that was processed was 4 byte 
aligned, i.e., whether an alignment hole was created when the restore-shadow-stack token was pushed on this 
shadow stack. 

Following RSTORSSP if a restore-shadow-stack token needs to be saved on the previous shadow stack, use the 
SAVEPREVSSP instruction. 

If pushing a restore-shadow-stack token on the previous shadow stack is not required, the previous-ssp token can 
be popped using the INCSSPQ instruction. If the CF flag was set to indicate presence of an alignment hole, an addi- 
tional INCSSPD instruction is needed to advance the SSP past the alignment hole. 


Operation 
IF CPL = 3 
IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0 
THEN #UD; Fl; 
ELSE 
IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0 
THEN #UD; Fl; 
Fl; 


SSP_LA = Linear_Address(mem operand) 
IF SSP_LA not aligned to 8 bytes 
THEN #GP(0); Fl; 


previous_ssp_token = SSP | (IA32_EFER.LMA AND CS.L) | 0x02 

Start Atomic Execution 

restore_ssp_token = Locked shadow_stack_load 8 bytes from SSP_LA 
fault = 0 


IF ((restore_ssp_token & 0x03) != (IA32_EFER.LMA & CS.L)) 
THEN fault = 1; Fl; (* If L flag in token does not match IA32_EFER.LMA & CS.L or bit 1 is not O *) 


IF ((IA32_EFER.LMA AND CS.L) = 0 AND restore_ssp_token[63:32] != 0) 
THEN fault = 1; Fl; (* If compatibility/legacy mode and SSP to be restored not below 4G *) 


TMP = restore_ssp_token & ~Ox01 


TMP = (TMP - 8) 
TMP = TMP & ~Ox07 
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IF TMP != SSP_LA 
THEN fault = 1; Fl; (* If address in token does not match the requested top of stack *) 


TMP = (fault == 0) ? previous_ssp_token : restore_ssp_token 
shadow_stack_store 8 bytes of TMP to SSP_LA and release lock 
End Atomic Execution 


IF fault == 
THEN #CP(RSTORSSP); FI; 


SSP = SSP_LA 


// Set the CF if the SSP in the restore token was 4 byte aligned, i.e., there is an alignment hole 
RFLAGS.CF = (restore_ssp_token & 0x04) ? 1:0; 
RFLAGS.ZF,PF,AF,OF,SF := 0; 


Flags Affected 


CF is set to indicate if the shadow stack pointer in the restore token was 4 byte aligned, else it is cleared. ZF, 
PF, AF, OF, and SF are cleared. 


C/C++ Compiler Intrinsic Equivalent 
RSTORSSP void _rstorssp(void *); 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. 
IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 
#GP(0) If linear address of memory operand not 8 byte aligned. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If destination is located in a non-writeable segment. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#CP(rstorssp) If L bit in token does not match (IA32_EFER.LMA & CS.L). 


If address in token does not match linear address of memory operand. 
If in 32-bit or compatibility mode and the address in token is not below 4G. 
#PF(fault-code) If a page fault occurs. 


Real-Address Mode Exceptions 
#UD The RSTORSSP instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The RSTORSSP instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same as protected mode exceptions. 
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64-Bit Mode Exceptions 

#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
If CPL = 3 and JA32_U_CET.SH_STK_EN = 0. 
If CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 


#GP(0) If linear address of memory operand not 8 byte aligned. 

If a memory address is in a non-canonical form. 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#CP(rstorssp) If L bit in token does not match (IA32_EFER.LMA & CS.L). 


If address in token does not match linear address of memory operand. 
#PF(fault-code) If a page fault occurs. 
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SAHF—Store AH into Flags 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
SE SAHF ZO | Invalid* Valid Loads SF, ZF, AF, PF, and CF from AH into 
EFLAGS register. 
NOTES: 


* Valid in specific steppings. See Description section. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Loads the SF, ZF, AF, PF, and CF flags of the EFLAGS register with values from the corresponding bits in the AH 
register (bits 7, 6, 4, 2, and 0, respectively). Bits 1, 3, and 5 of register AH are ignored; the corresponding reserved 
bits (1, 3, and 5) in the EFLAGS register remain as shown in the “Operation” section below. 


This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only 
if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1. 


Operation 


IF |A-64 Mode 
THEN 
IF CPUID.8B0000001H.ECX[0] = 1; 
THEN 
RFLAGS(SF:ZF:0:AF:0:PF:1:CF) := AH; 
ELSE 
#UD; 
Fl 
ELSE 
EFLAGS(SF:ZF:0:AF:0:PF:1:CF) := AH; 
Fl; 


Flags Affected 


The SF, ZF, AF, PF, and CF flags are loaded with values from the AH register. Bits 1, 3, and 5 of the EFLAGS register 
are unaffected, with the values remaining 1, 0, and 0, respectively. 


Protected Mode Exceptions 
None. 


Real-Address Mode Exceptions 
None. 


Virtual-8086 Mode Exceptions 
None. 


Compatibility Mode Exceptions 
None. 
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64-Bit Mode Exceptions 
#UD If CPUID.80000001H.ECX[0] = 0. 
If the LOCK prefix is used. 
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SAL/SAR/SHL/SHR—Shift 
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Opcode*** Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
DO /4 SAL r/m&, 1 M1 | Valid Valid Multiply r/m8 by 2, once. 
REX + DO /4 SAL r/m8**, 1 M1 | Valid N.E. Multiply r/m8 by 2, once. 
D2 /4 SAL r/m8, CL MC | Valid Valid Multiply r/m8 by 2, CL times. 
REX + D2 /4 SAL r/m8**, CL MC | Valid N.E. Multiply r/m8 by 2, CL times. 
CO /4 ib SAL r/m8, imm8 MI Valid Valid Multiply r/m8 by 2, imm8 times. 
REX + CO /4 ib SAL r/m8**, imm8 MI Valid N.E. Multiply r/m8 by 2, imm8 times. 
D1 /4 SAL r/m16, 1 M1 | Valid Valid Multiply r/m76 by 2, once. 
D3 /4 SAL r/m16, CL MC | Valid Valid Multiply r/m76 by 2, CL times. 
C1 /4 ib SAL r/m16, imm8 MI Valid Valid Multiply r/m76 by 2, imm8 times. 
D1 /4 SAL r/m32, 1 M1 | Valid Valid Multiply r/m32 by 2, once. 
REX.W + D1 /4 SAL r/m64, 1 M1 | Valid N.E. Multiply r/m64 by 2, once. 
D3 /4 SAL r/m32, CL MC | Valid Valid Multiply r/m32 by 2, CL times. 
REX.W + D3 /4 SAL r/m64, CL MC | Valid N.E. Multiply r/m64 by 2, CL times. 
C1 /4 ib SAL r/m32, imm8 MI Valid Valid Multiply r/m32 by 2, imm8 times. 
REX.W + C1 /4 ib SAL r/m64, imm8 MI Valid N.E. Multiply r/m64 by 2, imm8 times. 
DO /7 SAR r/m&, 1 M1 | Valid Valid Signed divide* r/m8 by 2, once. 
REX + DO /7 SAR r/m8**, 1 M1 | Valid N.E. Signed divide* r/m8 by 2, once. 
D2 /7 SAR r/m8, CL MC | Valid Valid Signed divide* r/m8 by 2, CL times. 
REX + D2 /7 SAR r/m8**, CL MC | Valid N.E. Signed divide* r/m8 by 2, CL times. 
CO /7 ib SAR r/m8, imm8 MI Valid Valid Signed divide* r/m8 by 2, imm8 times. 
REX + CO /7 ib SAR r/m8**, imm8 MI Valid N.E. Signed divide* r/m8 by 2, imm8 times. 
D1 /7 SAR r/m16,1 M1 | Valid Valid Signed divide* r/m76 by 2, once. 
D3 /7 SAR r/m76, CL MC | Valid Valid Signed divide* r/m76 by 2, CL times. 
C1/7 ib SAR r/m16, imm8 MI Valid Valid Signed divide* r/m16 by 2, imm8 times. 
D1 /7 SAR r/m32, 1 M1 | Valid Valid Signed divide* r/m32 by 2, once. 
REX.W + D1 /7 SAR r/m64, 1 M1 | Valid N.E. Signed divide* r/m64 by 2, once. 
D3 /7 SAR r/m32, CL MC | Valid Valid Signed divide* r/m32 by 2, CL times. 
REX.W + D3 /7 SAR r/m64, CL MC | Valid N.E. Signed divide* r/m64 by 2, CL times. 
C1/7 ib SAR r/m32, imm8 MI Valid Valid Signed divide* r/m32 by 2, imm8 times. 
REX.W + C1 /7 ib SAR r/m64, imm8 MI Valid N.E. Signed divide* r/m64 by 2, imm8 times 
DO /4 SHL r/m8, 1 M1 | Valid Valid Multiply r/m8 by 2, once. 
REX + DO /4 SHL r/m8**, 1 M1 | Valid N.E. Multiply r/m8 by 2, once. 
D2 /4 SHL r/m8, CL MC | Valid Valid Multiply r/m8 by 2, CL times. 
REX + D2 /4 SHL r/m8**, CL MC | Valid N.E. Multiply r/m8 by 2, CL times. 
CO /4 ib SHL r/m8, imm8& MI Valid Valid Multiply r/m8 by 2, imm8 times. 
REX + CO /4 ib SHL r/m8**, imm8& MI Valid N.E. Multiply r/m8 by 2, imm8 times. 
D1 /4 SHL r/m16,1 M1 | Valid Valid Multiply r/m76 by 2, once. 
D3 /4 SHL r/m16, CL MC | Valid Valid Multiply r/m76 by 2, CL times. 
C1 /4 ib SHL r/m16, imm8& MI Valid Valid Multiply r/m76 by 2, imm8 times. 
D1 /4 SHL r/m32,1 M1 | Valid Valid Multiply r/m32 by 2, once. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
REX.W + D1 /4 SHL r/m64,1 M1 | Valid N.E. Multiply r/m64 by 2, once. 
D3 /4 SHL r/m32, CL MC | Valid Valid Multiply r/m32 by 2, CL times. 
REX.W + D3 /4 SHL r/m64, CL MC | Valid N.E. Multiply r/m64 by 2, CL times. 
C1 /4 ib SHL r/m32, imm8& MI Valid Valid Multiply r/m32 by 2, imm8 times. 
REX.W + C1 /4 ib SHL r/m64, imm8& MI Valid N.E. Multiply r/m64 by 2, imm8 times. 
DO/5 SHR r/m&,1 M1 | Valid Valid Unsigned divide r/m8 by 2, once. 
REX + DO/5 SHR r/m8**, 1 M1 | Valid N.E. Unsigned divide r/m8 by 2, once. 
D2/5 SHR r/m8, CL MC | Valid Valid Unsigned divide r/m8 by 2, CL times. 
REX +D2/5 SHR r/m8**, CL MC | Valid N.E. Unsigned divide r/m8 by 2, CL times. 
CO /5 ib SHR r/m&, imm8 MI Valid Valid Unsigned divide r/m8 by 2, imm8 times. 
REX + CO /5 ib SHR r/m8**, imm8 MI Valid N.E. Unsigned divide r/m8 by 2, imm8 times. 
D1/5 SHR r/m16, 1 M1 | Valid Valid Unsigned divide r/m16 by 2, once. 
D3 /5 SHR r/m16, CL MC | Valid Valid Unsigned divide r/m76 by 2, CL times 
C1/5 ib SHR r/m16, imm8 MI Valid Valid Unsigned divide r/m16 by 2, imm8 times. 
D1/5 SHR r/m32, 1 M1 | Valid Valid Unsigned divide r/m32 by 2, once. 
REX.W+D1/5 SHR r/m64, 1 M1 | Valid N.E. Unsigned divide r/m64 by 2, once. 
D3 /5 SHR r/m32, CL MC | Valid Valid Unsigned divide r/m32 by 2, CL times. 
REX.W + D3 /5 SHR r/m64, CL MC | Valid N.E. Unsigned divide r/m64 by 2, CL times. 
C1/5 ib SHR r/m32, imm8 MI Valid Valid Unsigned divide r/m32 by 2, imm8 times. 
REX.W + (C1 /5 ib SHR r/m64, imm8 MI Valid N.E. Unsigned divide r/m64 by 2, imm8 times. 


NOTES: 


* Not the same form of division as IDIV; rounding is toward negative infinity. 
** In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 
***See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M1 ModRM:r/m (r, w) 1 NA NA 
MC ModRM:r/m (r, w) CL NA NA 
MI ModRM:r/m (r, w) imm8 NA NA 
Description 


Shifts the bits in the first operand (destination operand) to the left or right by the number of bits specified in the 
second operand (count operand). Bits shifted beyond the destination operand boundary are first shifted into the CF 
flag, then discarded. At the end of the shift operation, the CF flag contains the last bit shifted out of the destination 
operand. 


The destination operand can be a register or a memory location. The count operand can be an immediate value or 
the CL register. The count is masked to 5 bits (or 6 bits if in 64-bit mode and REX.W is used). The count range is 
limited to 0 to 31 (or 63 if 64-bit mode and REX.W is used). A special opcode encoding is provided for a count of 1. 


The shift arithmetic left (SAL) and shift logical left (SHL) instructions perform the same operation; they shift the 
bits in the destination operand to the left (toward more significant bit locations). For each shift count, the most 
significant bit of the destination operand is shifted into the CF flag, and the least significant bit is cleared (see 
Figure 7-7 in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 
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The shift arithmetic right (SAR) and shift logical right (SHR) instructions shift the bits of the destination operand to 
the right (toward less significant bit locations). For each shift count, the least significant bit of the destination 
operand is shifted into the CF flag, and the most significant bit is either set or cleared depending on the instruction 
type. The SHR instruction clears the most significant bit (see Figure 7-8 in the Inte/® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 1); the SAR instruction sets or clears the most significant bit to correspond 
to the sign (most significant bit) of the original value in the destination operand. In effect, the SAR instruction fills 
the empty bit position’s shifted value with the sign of the unshifted value (see Figure 7-9 in the Inte/® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 1). 


The SAR and SHR instructions can be used to perform signed or unsigned division, respectively, of the destination 
operand by powers of 2. For example, using the SAR instruction to shift a signed integer 1 bit to the right divides 
the value by 2. 


Using the SAR instruction to perform a division operation does not produce the same result as the IDIV instruction. 
The quotient from the IDIV instruction is rounded toward zero, whereas the “quotient” of the SAR instruction is 
rounded toward negative infinity. This difference is apparent only for negative numbers. For example, when the 
IDIV instruction is used to divide -9 by 4, the result is -2 with a remainder of -1. If the SAR instruction is used to 
shift -9 right by two bits, the result is -3 and the “remainder” is +3; however, the SAR instruction stores only the 
most significant bit of the remainder (in the CF flag). 


The OF flag is affected only on 1-bit shifts. For left shifts, the OF flag is set to 0 if the most-significant bit of the 
result is the same as the CF flag (that is, the top two bits of the original operand were the same); otherwise, it is 
set to 1. For the SAR instruction, the OF flag is cleared for all 1-bit shifts. For the SHR instruction, the OF flag is set 
to the most-significant bit of the original operand. 


In 64-bit mode, the instruction’s default operation size is 32 bits and the mask width for CL is 5 bits. Using a REX 
prefix in the form of REX.R permits access to additional registers (R8-R15). Using a REX prefix in the form of REX.W 
promotes operation to 64-bits and sets the mask width for CL to 6 bits. See the summary chart at the beginning of 
this section for encoding data and limits. 


IA-32 Architecture Compatibility 


The 8086 does not mask the shift count. However, all other IA-32 processors (starting with the Intel 286 processor) 
do mask the shift count to 5 bits, resulting in a maximum count of 31. This masking is done in all operating modes 
(including the virtual-8086 mode) to reduce the maximum execution time of the instructions. 


Operation 
IF 64-Bit Mode and using REX.W 
THEN 
countMASK := 3FH; 
ELSE 


countMASK := 1FH; 
FI 


tempCOUNT := (COUNT AND countMASK); 
tempDEST := DEST; 
WHILE (tempCOUNT # 0) 
DO 
IF instruction is SAL or SHL 
THEN 
CF := MSB(DEST); 
ELSE (* Instruction is SAR or SHR *) 
CF := LSB(DEST); 
Fl; 
IF instruction is SAL or SHL 
THEN 
DEST := DEST * 2; 
ELSE 
IF instruction is SAR 
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THEN 
DEST := DEST / 2; (* Signed divide, rounding toward negative infinity *) 
ELSE (* Instruction is SHR *) 
DEST := DEST / 2; (* Unsigned divide *) 
Fl; 
Fl; 
tempCOUNT := tempCOUNT - 1; 
OD; 


(* Determine overflow for the various instructions *) 
IF (COUNT and countMASK) = 1 


THEN 
IF instruction is SAL or SHL 
THEN 
OF := MSB(DEST) XOR CF; 
ELSE 
IF instruction is SAR 
THEN 
OF := 0; 
ELSE (* Instruction is SHR *) 
OF := MSB(tempDEST); 
Fl; 
Fl; 
ELSE IF (COUNT AND countMASK) = 0 
THEN 


All flags unchanged; 
ELSE (* COUNT not 1 or 0 *) 
OF := undefined; 
Fl; 
Fl; 


Flags Affected 


The CF flag contains the value of the last bit shifted out of the destination operand; it is undefined for SHL and SHR 
instructions where the count is greater than or equal to the size (in bits) of the destination operand. The OF flag is 
affected only for 1-bit shifts (see “Description” above); otherwise, it is undefined. The SF, ZF, and PF flags are set 
according to the result. If the count is 0, the flags are not affected. For a non-zero count, the AF flag is undefined. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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Opcode/ Op/ 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode | Flag 
VEX.LZ.F3.0F38.W0 F7 /r RMV | V/V BMI2 Shift r/m32 arithmetically right with count specified in r32b. 
SARX r32a, r/m32, r32b 
VEX.LZ.66.0F38.W0 F7 /r RMV | V/V BMI2 Shift r/m32 logically left with count specified in r32b. 
SHLX 32a, r/m32, r32b 
VEX.LZ.F2.0F38.W0 F7 /r RMV | V/V BMI2 Shift r/m32 logically right with count specified in r32b. 
SHRX r32a, r/m32, r32b 
VEX.LZ.F3.0F38.W1 F7 /r RMV | V/N.E. | BMI2 Shift r/m64 arithmetically right with count specified in r64b. 
SARX r64a, r/m64, r64b 
VEX.LZ.66.0F38.W1 F7 /r RMV | V/N.E. | BMI2 Shift r/m64 logically left with count specified in r64b. 
SHLX r64a, r/m64, r64b 
VEX.LZ.F2.0F38.W1 F7 /r RMV | V/N.E. | BMI2 Shift r/m64 logically right with count specified in r64b. 
SHRX r64a, r/m64, r64b 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RMV ModRM:reg (w) ModRM:r/m (r) VEX.vvvv (r) NA 
Description 


Shifts the bits of the first source operand (the second operand) to the left or right by a COUNT value specified in the 
second source operand (the third operand). The result is written to the destination operand (the first operand). 
The shift arithmetic right (SARX) and shift logical right (SHRX) instructions shift the bits of the destination operand 
to the right (toward less significant bit locations), SARX keeps and propagates the most significant bit (sign bit) 
while shifting. 

The logical shift left (SHLX) shifts the bits of the destination operand to the left (toward more significant bit loca- 
tions). 

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 


64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An 
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD. 


If the value specified in the first source operand exceeds OperandSize -1, the COUNT value is masked. 
SARX,SHRX, and SHLX instructions do not update flags. 


Operation 


TEMP := SRC1; 
IF VEX.W1 and CS.L = 1 
THEN 
countMASK := 3FH; 
ELSE 
countMASK := 1FH; 
Fl 
COUNT := (SRC2 AND countMASK) 


DEST[OperandSize -1] = TEMP[OperandSize -1]; 
DO WHILE (COUNT + 0) 
IF instruction is SHLX 
THEN 
DEST[] := DEST *2; 
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ELSE IF instruction is SHRX 
THEN 
DEST[] := DEST /2; //unsigned divide 
ELSE /1 SARX 
DEST{[] := DEST /2; // signed divide, round toward negative infinity 
Fl; 
COUNT := COUNT - 1; 
OD 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
Auto-generated from high-level language. 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-29, “Type 13 Class Exception Conditions”. 
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SAVEPREVSSP—Save Previous Shadow Stack Pointer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En | bitMode | Feature 
Support | Flag 
F3 OF 01 EA (mod!=11, /5, ZO | V/V CET_SS Save a restore-shadow-stack token on previous shadow stack. 
RM=010) 
SAVEPREVSSP 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Push a restore-shadow-stack token on the previous shadow stack at the next 8 byte aligned boundary. The 
previous SSP is obtained from the previous-ssp token at the top of the current shadow stack. 


Operation 
IF CPL = 3 
IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0 
THEN #UD; FI; 
ELSE 
IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0 
THEN #UD; FI; 
Fl; 


IF SSP not aligned to 8 bytes 

THEN #GP(0); Fl; 
(* Pop the “previous-ssp” token from current shadow stack *) 
previous_ssp_token = ShadowStackPop8B(SSP) 


(* If the CF flag indicates there was a alignment hole on current shadow stack then pop that alignment hole *) 
(* Note that the alignment hole must be zero and can be present only when in legacy/compatibility mode *) 
IF RFLAGS.CF == 1 AND (IA32_EFER.LMA AND CS.L) 


#GP(0) 

FI; 

IF RFLAGS.CF == 
must_be_zero = ShadowStackPop4B(SSP) 
IF must_be_zero != 0 THEN #GP(0) 

FI; 


(* Previous SSP token must have the bit 1 set *) 
IF ((previous_ssp_token & Ox02) == 0) 
THEN #GP(0); (* bit 1 was 0 *) 


IF ((IA32_EFER.LMA AND CS.L) = 0 AND previous_ssp_token [63:32] != 0) 
THEN #GP(0); Fl; (* If compatibility/legacy mode and SSP not in 4G *) 


(* Save Prev SSP from previous_ssp_token to the old shadow stack at next 8 byte aligned address *) 
old_SSP = previous_ssp_token & ~0x03 

temp := (old_SSP | (IA32_EFER.LMA & CS.L)); 

Shadow_stack_store 4 bytes of 0 to (old_SSP - 4) 

old_SSP := old_SSP & ~0x07; 
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Shadow_stack_store 8 bytes of temp to (old_SSP - 8) 


Flags Affected 


None. 


C/C++ Compiler Intrinsic Equivalent 


SAVEPREVSSP 


void _saveprevssp(void); 


Protected Mode Exceptions 


#UD 


#GP(0) 


#PF(fault-code) 


If the LOCK prefix is used. 

If CR4.CET = 0. 

IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. 
IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 
If SSP not 8 byte aligned. 

If alignment hole on shadow stack is not 0. 


If bit 1 of the previous-ssp token is not set to 1. 


If in 32-bit/compatibility mode and SSP recorded in previous-ssp token is beyond 4G. 


If a page fault occurs. 


Real-Address Mode Exceptions 


#UD 


Virtual-8086 Mode Exceptions 


#UD 


Compatibility Mode Exceptions 
Same as protected mode exceptions. 


64-Bit Mode Exceptions 


#UD 


#GP(0) 


#PF(fault-code) 
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If the LOCK prefix is used. 

If CR4.CET = 0. 

If CPL = 3 and JA32_U_CET.SH_STK_EN = 0. 
If CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 
If SSP not 8 byte aligned. 

If carry flag is set. 


If bit 1 of the previous-ssp token is not set to 1. 


If a page fault occurs. 


The SAVEPREVSSP instruction is not recognized in real-address mode. 


The SAVEPREVSSP instruction is not recognized in virtual-8086 mode. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

1C ib SBB AL, imm8 | Valid Valid Subtract with borrow imm8 from AL. 

1D iw SBB AX, imm16 | Valid Valid Subtract with borrow imm16 from AX. 

1D id SBB EAX, imm32 | Valid Valid Subtract with borrow imm32 from EAX. 

REX.W + 1D id SBB RAX, imm32 | Valid N.E. Subtract with borrow sign-extended imm.32 
to 64-bits from RAX. 

80 /3 ib SBB r/m8, imm8 MI Valid Valid Subtract with borrow imm8 from r/m8. 

REX + 80 /3 ib SBB r/m8*, imm8 MI Valid N.E. Subtract with borrow imm8 from r/m8. 

81 /3 iw SBB r/m16, imm16 MI Valid Valid Subtract with borrow imm16 from r/m76. 

81 /3 id SBB r/m32, imm32 MI Valid Valid Subtract with borrow imm32 from r/m32. 

REX.W + 81 /3 id SBB r/m64, imm32 MI Valid N.E. Subtract with borrow sign-extended imm32 to 
64-bits from r/m64. 

83 /3 ib SBB r/m16, imm8 MI | Valid Valid Subtract with borrow sign-extended imm8 
from r/m16. 

83 /3 ib SBB r/m32, imm8 MI Valid Valid Subtract with borrow sign-extended imm8 
from r/m32. 

REX.W + 83 /3 ib SBB r/m64, imm8 MI | Valid N.E. Subtract with borrow sign-extended imm8 
from r/m64. 

18 /r SBB r/m&, r8 MR | Valid Valid Subtract with borrow r8 from r/mé. 

REX + 18 /r SBB r/m8*, r8 MR | Valid N.E. Subtract with borrow r8 from r/mé8. 

19/r SBB r/m16, r16 MR | Valid Valid Subtract with borrow r716 from r/m16. 

19/r SBB r/m32, r32 MR | Valid Valid Subtract with borrow r32 from r/m32. 

REX.W + 19 /r SBB r/m64, r64 MR | Valid N.E. Subtract with borrow r64 from r/m64. 

1A/r SBB r8, r/m8& RM_ | Valid Valid Subtract with borrow r/m8 from ré. 

REX + 1A/r SBB r8*, r/m8* RM_ | Valid N.E. Subtract with borrow r/m8 from ré. 

1B/r SBB r16, r/m16 RM_ | Valid Valid Subtract with borrow r/m76 from r76. 

1B/r SBB r32, r/m32 RM_ | Valid Valid Subtract with borrow r/m32 from r32. 

REX.W + 1B /r SBB r64, r/m64 RM_ | Valid N.E. Subtract with borrow r/m64 from r64. 

NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
MI ModRM:r/m (w) imm8/16/32 NA NA 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
SBB—Integer Subtraction with Borrow Vol.2B 4-607 


INSTRUCTION SET REFERENCE, M-U 


Description 


Adds the source operand (second operand) and the carry (CF) flag, and subtracts the result from the destination 
operand (first operand). The result of the subtraction is stored in the destination operand. The destination operand 
can be a register or a memory location; the source operand can be an immediate, a register, or a memory location. 
(However, two memory operands cannot be used in one instruction.) The state of the CF flag represents a borrow 
from a previous subtraction. 


When an immediate value is used as an operand, it is sign-extended to the length of the destination operand 
format. 


The SBB instruction does not distinguish between signed or unsigned operands. Instead, the processor evaluates 
the result for both data types and sets the OF and CF flags to indicate a borrow in the signed or unsigned result, 
respectively. The SF flag indicates the sign of the signed result. 


The SBB instruction is usually executed as part of a multibyte or multiword subtraction in which a SUB instruction 
is followed by a SBB instruction. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


Operation 
DEST := (DEST - (SRC + CF)); 


Intel C/C++ Compiler Intrinsic Equivalent 


SBB: extern unsigned char _subborrow_u8(unsigned char c_in, unsigned char src1, unsigned char src2, unsigned char *diff_out); 
ie extern unsigned char _subborrow_u16(unsigned char c_in, unsigned short src1, unsigned short src2, unsigned short 
*diff_out); 

SBB: extern unsigned char _subborrow_u32(unsigned char c_in, unsigned int src1, unsigned char int, unsigned int *diff_out); 
SBB extern unsigned char _subborrow_u64(unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned 


__int64 *diff_out); 


Flags Affected 
The OF, SF, ZF, AF, PF, and CF flags are set according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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SCAS/SCASB/SCASW/SCASD—Scan String 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

AE SCAS m8 ZO ‘| Valid Valid Compare AL with byte at ES:(€)DI or RDI, then 
set status flags.* 

AF SCAS m16 ZO ‘| Valid Valid Compare AX with word at ES:(€)DI or RDI, then 
set status flags.* 

AF SCAS m32 ZO ‘| Valid Valid Compare EAX with doubleword at ES(E)DI or 
RDI then set status flags.* 

REX.W + AF SCAS m64 ZO | Valid N.E. Compare RAX with quadword at RDI or EDI 
then set status flags. 

AE SCASB ZO ‘| Valid Valid Compare AL with byte at ES:(E)DI or RDI then 
set status flags.* 

AF SCASW ZO ‘| Valid Valid Compare AX with word at ES:(€)DI or RDI then 
set status flags.* 

AF SCASD ZO ‘| Valid Valid Compare EAX with doubleword at ES:(E)DI or 
RDI then set status flags.* 

REX.W + AF SCASQ ZO_ ‘| Valid N.E. Compare RAX with quadword at RDI or EDI 
then set status flags. 


NOTES: 


* |n 64-bit mode, only 64-bit (RDI) and 32-bit (EDI) address sizes are supported. In non-64-bit mode, only 32-bit (EDI) and 16-bit (Dl) 
address sizes are supported. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


In non-64-bit modes and in default 64-bit mode: this instruction compares a byte, word, doubleword or quadword 
specified using a memory operand with the value in AL, AX, or EAX. It then sets status flags in EFLAGS recording 
the results. The memory operand address is read from ES:(E)DI register (depending on the address-size attribute 
of the instruction and the current operational mode). Note that ES cannot be overridden with a segment override 
prefix. 


At the assembly-code level, two forms of this instruction are allowed. The explicit-operand form and the no-oper- 
ands form. The explicit-operand form (specified using the SCAS mnemonic) allows a memory operand to be speci- 
fied explicitly. The memory operand must be a symbol that indicates the size and location of the operand value. The 
register operand is then automatically selected to match the size of the memory operand (AL register for byte 
comparisons, AX for word comparisons, EAX for doubleword comparisons). The explicit-operand form is provided 
to allow documentation. Note that the documentation provided by this form can be misleading. That is, the 
memory operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword) but it 
does not have to specify the correct location. The location is always specified by ES:(E)DI. 


The no-operands form of the instruction uses a short form of SCAS. Again, ES:(E)DI is assumed to be the memory 
operand and AL, AX, or EAX is assumed to be the register operand. The size of operands is selected by the 
mnemonic: SCASB (byte comparison), SCASW (word comparison), or SCASD (doubleword comparison). 


After the comparison, the (E)DI register is incremented or decremented automatically according to the setting of 

the DF flag in the EFLAGS register. If the DF flag is 0, the (E)DI register is incremented; if the DF flag is 1, the (E)DI 
register is decremented. The register is incremented or decremented by 1 for byte operations, by 2 for word oper- 
ations, and by 4 for doubleword operations. 


SCAS, SCASB, SCASW, SCASD, and SCASQ can be preceded by the REP prefix for block comparisons of ECX bytes, 
words, doublewords, or quadwords. Often, however, these instructions will be used in a LOOP construct that takes 
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some action based on the setting of status flags. See “REP/REPE/REPZ /REPNE/REPNZ—Repeat String Operation 
Prefix” in this chapter for a description of the REP prefix. 


In 64-bit mode, the instruction’s default address size is 64-bits, 32-bit address size is supported using the prefix 
67H. Using a REX prefix in the form of REX.W promotes operation on doubleword operand to 64 bits. The 64-bit no- 
operand mnemonic is SCASQ. Address of the memory operand is specified in either RDI or EDI, and 
AL/AX/EAX/RAX may be used as the register operand. After a comparison, the destination register is incremented 
or decremented by the current operand size (depending on the value of the DF flag). See the summary chart at the 
beginning of this section for encoding data and limits. 


Operation 
Non-64-bit Mode: 


IF (Byte comparison) 
THEN 
temp := AL-— SRG 
SetStatusFlags(temp); 
THEN IF DF = 0 
THEN (€)DI := (E)DI + 1; 
ELSE (E)DI := (€)DI - 1; FI; 
ELSE IF (Word comparison) 


THEN 
temp := AX — SRC; 
SetStatusFlags(temp); 
IF DF =0 
THEN (€)DI := (E)DI + 2; 
ELSE (E)DI := (€)DI - 2; Fl; 
Fl; 
ELSE IF (Doubleword comparison) 
THEN 
temp := EAX - SRC; 
SetStatusFlags(temp); 
IF DF = 0 
THEN (€)DI := (E)DI + 4; 
ELSE (E)DI := (€)DI - 4; Fl; 
Fl; 
FI; 
64-bit Mode: 
IF (Byte cmparison) 
THEN 
temp := AL-— SRG 
SetStatusFlags(temp); 


THEN IF DF = 0 
THEN (RJE)DI := (RJE)DI + 1; 
ELSE (RIE)DI := (RJE)DI - 1; FA; 
ELSE IF (Word comparison) 


THEN 
temp := AX — SRC; 
SetStatusFlags(temp); 
IF DF =0 
THEN (RJE)DI := (RJE)DI + 2; 
ELSE (RIE)DI := (RJE)DI - 2; FA; 
Fl; 
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ELSE IF (Doubleword comparison) 
THEN 
temp := EAX - SRC; 
SetStatusFlags(temp); 
IF DF =O 
THEN (RIE)DI := (RIJE)DI + 4; 
ELSE (RIE)DI := (RIE)DI - 4; FI; 
FI; 
ELSE IF (Quadword comparison using REX.W ) 
THEN 
temp := RAX — SRC; 
SetStatusFlags(temp); 
IF DF =0 
THEN (RIE)DI := (RIE)DI + 8; 
ELSE (RIE)DI := (RIE)DI - 8; 
FI; 
Fl; 


Flags Affected 
The OF, SF, ZF, AF, PF, and CF flags are set according to the temporary result of the comparison. 


Protected Mode Exceptions 
#GP(0) If a memory operand effective address is outside the limit of the ES segment. 
If the ES register contains a NULL segment selector. 
If an illegal memory operand effective address in the ES segment is given. 
#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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SETcc—Set Byte on Condition 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 97 SETA r/m8 M Valid Valid Set byte if above (CF=0 and ZF=0). 
REX + OF 97 SETA r/m8* M Valid N.E. Set byte if above (CF=0 and ZF=0). 
OF 93 SETAE r/m8 M Valid Valid Set byte if above or equal (CF=0). 
REX + OF 93 SETAE r/m8* M Valid N.E. Set byte if above or equal (CF=0). 
OF 92 SETB r/m8 M Valid Valid Set byte if below (CF=1). 
REX + OF 92 SETB r/m8* M Valid N.E. Set byte if below (CF=1). 
OF 96 SETBE r/m8 M Valid Valid Set byte if below or equal (CF=1 or ZF=1). 
REX + OF 96 SETBE r/m8* M Valid N.E. Set byte if below or equal (CF=1 or ZF=1). 
OF 92 SETC r/m8 M Valid Valid Set byte if carry (CF=1). 
REX + OF 92 SETC r/ma* M Valid N.E. Set byte if carry (CF=1). 
OF 94 SETE r/m8 M Valid Valid Set byte if equal (ZF=1). 
REX + OF 94 SETE r/m8* M Valid N.E. Set byte if equal (ZF=1). 
OF SF SETG r/m8 M Valid Valid Set byte if greater (ZF=0 and SF=OF). 
REX + OF SF SETG r/m8* M Valid N.E. Set byte if greater (ZF=0 and SF=OF). 
OF 9D SETGE r/m8 M Valid Valid Set byte if greater or equal (SF=OF). 
REX + OF 9D SETGE r/m8* M Valid N.E. Set byte if greater or equal (SF=OF). 
OF 9C SETL r/m8 M Valid Valid Set byte if less (SF4 OF). 
REX + OF 9C SETL r/ma* M Valid N.E. Set byte if less (SF4 OF). 
OF SE SETLE r/m8& M Valid Valid Set byte if less or equal (ZF=1 or SF# OF). 
REX + OF 9E SETLE r/m8* M Valid N.E. Set byte if less or equal (ZF=1 or SF# OF). 
OF 96 SETNA r/m8 M Valid Valid Set byte if not above (CF=1 or ZF=1). 
REX + OF 96 SETNA r/m8* M Valid N.E. Set byte if not above (CF=1 or ZF=1). 
OF 92 SETNAE r/m8 M Valid Valid Set byte if not above or equal (CF=1). 
REX + OF 92 SETNAE r/m8* M Valid N.E. Set byte if not above or equal (CF=1). 
OF 93 SETNB r/m8 M Valid Valid Set byte if not below (CF=0). 
REX + OF 93 SETNB r/m8* M Valid N.E. Set byte if not below (CF=0). 
OF 97 SETNBE r/m8& M Valid Valid Set byte if not below or equal (CF=0 and 
ZF=0). 
REX + OF 97 SETNBE r/m8* M Valid N.E. Set byte if not below or equal (CF=0 and 
ZF=0). 
OF 93 SETNC r/m8 M Valid Valid Set byte if not carry (CF=0). 
REX + OF 93 SETNC r/m8* M Valid N.E. Set byte if not carry (CF=0). 
OF 95 SETNE r/m8 M Valid Valid Set byte if not equal (ZF=0). 
REX + OF 95 SETNE r/m8* M Valid N.E. Set byte if not equal (ZF=0). 
OF SE SETNG r/m8 M Valid Valid Set byte if not greater (ZF=1 or SF OF) 
REX + OF 9E SETNG r/m8* M Valid N.E. Set byte if not greater (ZF=1 or SF4 OF). 
OF 9C SETNGE r/m& M Valid Valid Set byte if not greater or equal (SF# OF). 
REX + OF 9C SETNGE r/m8* M Valid N.E. Set byte if not greater or equal (SF# OF). 
OF 9D SETNL r/m8 M Valid Valid Set byte if not less (SF=OF). 
REX + OF 9D SETNL r/m8* M Valid N.E. Set byte if not less (SF=OF). 
OF SF SETNLE r/m8 M Valid Valid Set byte if not less or equal (ZF=0 and SF=OF). 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
REX + OF SF SETNLE r/m8* M Valid N.E. Set byte if not less or equal (ZF=0 and SF=OF). 
OF 91 SETNO r/m8 M Valid Valid Set byte if not overflow (OF=0). 
REX + OF 91 SETNO r/m8* M Valid N.E. Set byte if not overflow (OF=0). 
OF 9B SETNP r/m8 M Valid Valid Set byte if not parity (PF=0). 
REX + OF 9B SETNP r/m8* M Valid N.E. Set byte if not parity (PF=0). 
OF 99 SETNS r/m8 M Valid Valid Set byte if not sign (SF=0). 
REX + OF 99 SETNS r/m8* M Valid N.E. Set byte if not sign (SF=0). 
OF 95 SETNZ r/m8 M Valid Valid Set byte if not zero (ZF=0). 
REX + OF 95 SETNZ r/m8* M Valid N.E. Set byte if not zero (ZF=0). 
OF 90 SETO r/m8 M Valid Valid Set byte if overflow (OF=1) 
REX + OF 90 SETO r/m8* M Valid N.E. Set byte if overflow (OF=1). 
OF 9A SETP r/m8 M Valid Valid Set byte if parity (PF=1). 
REX + OF 9A SETP r/m8* M Valid N.E. Set byte if parity (PF=1). 
OF 9A SETPE r/m8 M Valid Valid Set byte if parity even (PF=1). 
REX + OF 9A SETPE r/m8* M Valid N.E. Set byte if parity even (PF=1). 
OF 9B SETPO r/m8 M Valid Valid Set byte if parity odd (PF=0). 
REX + OF 9B SETPO r/m8* M Valid N.E. Set byte if parity odd (PF=0). 
OF 98 SETS r/m8 M Valid Valid Set byte if sign (SF=1). 
REX + OF 98 SETS r/m8* M Valid N.E. Set byte if sign (SF=1). 
OF 94 SETZ r/m8 M Valid Valid Set byte if zero (ZF=1). 
REX + OF 94 SETZ r/m8* M Valid N.E. Set byte if zero (ZF=1). 
NOTES: 
* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Sets the destination operand to O or 1 depending on the settings of the status flags (CF, SF, OF, ZF, and PF) in the 
EFLAGS register. The destination operand points to a byte register or a byte in memory. The condition code suffix 
(cc) indicates the condition being tested for. 


The terms “above” and “below” are associated with the CF flag and refer to the relationship between two unsigned 
integer values. The terms “greater” and “less” are associated with the SF and OF flags and refer to the relationship 
between two signed integer values. 


Many of the SETcc instruction opcodes have alternate mnemonics. For example, SETG (set byte if greater) and 
SETNLE (set if not less or equal) have the same opcode and test for the same condition: ZF equals 0 and SF equals 
OF. These alternate mnemonics are provided to make code more intelligible. Appendix B, “EFLAGS Condition 
Codes,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, shows the alternate 
mnemonics for various test conditions. 


Some languages represent a logical one as an integer with all bits set. This representation can be obtained by 
choosing the logically opposite condition for the SETcc instruction, then decrementing the result. For example, to 
test for overflow, use the SETNO instruction, then decrement the result. 
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The reg field of the ModR/M byte is not used for the SETCC instruction and those opcode bits are ignored by the 
processor. 


In IA-64 mode, the operand size is fixed at 8 bits. Use of REX prefix enable uniform addressing to additional byte 
registers. Otherwise, this instruction’s operation is the same as in legacy mode and compatibility mode. 


Operation 


IF condition 
THEN DEST := 1; 
ELSE DEST := 0; 
Fl; 


Flags Affected 
None. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 
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SETSSBSY—Mark Shadow Stack Busy 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF 01 E8 ZO VIV CET_SS Set busy flag in supervisor shadow stack token reference by 
SETSSBSY IA32_PLO_SSP. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


The SETSSBSY instruction verifies the presence of a non-busy supervisor shadow stack token at the address in the 
IA32_PLO_SSP MSR and marks it busy. Following successful execution of the instruction, the SSP is set to the value 
of the IA32_PLO_SSP MSR. 


Operation 

IF (CR4.CET = 0) 
THEN #UD; Fl; 

IF (IA32_S_CET.SH_STK_EN = 0) 
THEN #UD; FI; 

IF CPL>O 
THEN GP(0); Fl; 


SSP_LA = IA32_PLO_SSP 
If SSP_LA not aligned to 8 bytes 
THEN #GP(0); FI; 


expected_token_value = SSP_LA (* busy bit must not be set *) 

new_token_value = SSP_LA | BUSY_BIT (* set busy bit; bit position O *) 

IF shadow_stack_lock_cmpxchg8B(SSP_LA, new_token_value, expected_token_value) != expected_token_value 
THEN #CP(SETSSBSY); FI; 

SSP = SSP_LA 

Flags Affected 


None. 


C/C++ Compiler Intrinsic Equivalent 
SETSSBSY void _setssbsy(void); 


Protected Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
IF IA32_S_CET.SH_STK_EN = 0. 
#GP(0) If IA32_PLO_SSP not aligned to 8 bytes. 
If CPLis not 0. 
#CP(setssbsy) If busy bit in token is set. 


If in 32-bit or compatibility mode, and the address in token is not below 4G. 
#PF(fault-code) If a page fault occurs. 
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Real-Address Mode Exceptions 
#UD The SETSSBSY instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The SETSSBSY instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same as protected mode exceptions. 


64-Bit Mode Exceptions 
Same as protected mode exceptions. 
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SFENCE—Store Fence 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
NP OF AE F8 SFENCE ZO | Valid Valid Serializes store operations. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Orders processor execution relative to all memory stores prior to the SFENCE instruction. The processor ensures 
that every store prior to SFENCE is globally visible before any store after SFENCE becomes globally visible. The 
SFENCE instruction is ordered with respect to memory stores, other SFENCE instructions, MFENCE instructions, 
and any serializing instructions (such as the CPUID instruction). It is not ordered with respect to memory loads or 
the LFENCE instruction. 


Weakly ordered memory types can be used to achieve higher processor performance through such techniques as 
out-of-order issue, write-combining, and write-collapsing. The degree to which a consumer of data recognizes or 
knows that the data is weakly ordered varies among applications and may be unknown to the producer of this data. 
The SFENCE instruction provides a performance-efficient way of ensuring store ordering between routines that 
produce weakly-ordered results and routines that consume this data. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Specification of the instruction's opcode above indicates a ModR/M byte of F8. For this instruction, the processor 
ignores the r/m field of the ModR/M byte. Thus, SFENCE is encoded by any opcode of the form OF AE Fx, where x 
is in the range 8-F. 


Operation 


Wait_On_Following_Stores_Until(preceding_stores_globally_visible); 


Intel C/C++ Compiler Intrinsic Equivalent 


void _mm_sfence(void) 


Exceptions (All Operating Modes) 
#UD If CPUID.O1H:EDX.SSE[bit 25] = 0. 
If the LOCK prefix is used. 
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SGDT—Store Global Descriptor Table Register 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF 01 /0 SGDT m M Valid Valid Store GDTR to m. 
NOTES: 


* See IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the content of the global descriptor table register (GDTR) in the destination operand. The destination 
operand specifies a memory location. 


In legacy or compatibility mode, the destination operand is a 6-byte memory location. If the operand-size attribute 
is 16 or 32 bits, the 16-bit limit field of the register is stored in the low 2 bytes of the memory location and the 32- 
bit base address is stored in the high 4 bytes. 


In 64-bit mode, the operand size is fixed at 8+2 bytes. The instruction stores an 8-byte base and a 2-byte limit. 


SGDT is useful only by operating-system software. However, it can be used in application programs without causing 
an exception to be generated if CR4.UMIP = 0. See “LGDT/LIDT—Load Global/Interrupt Descriptor Table Register” 
in Chapter 3, Inte!® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A, for information on 
loading the GDTR and IDTR. 


IA-32 Architecture Compatibility 


The 16-bit form of the SGDT is compatible with the Intel 286 processor if the upper 8 bits are not referenced. The 
Intel 286 processor fills these bits with 1s; processor generations later than the Intel 286 processor fill these bits 
with Os. 


Operation 


IF instruction is SGDT 
IF OperandSize =16 or OperandSize = 32 (* Legacy or Compatibility Mode *) 
THEN 
DEST[O:1 5] := GDTR(Limit); 
DEST[16:47] := GDTR(Base); (* Full 32-bit base address stored *) 
Fl; 
ELSE (* 64-bit Mode *) 
DEST[O:1 5] := GDTR(Limit); 
DEST[16:79] := GDTR(Base); (* Full 64-bit base address stored *) 
Fl; 
Fl; 


Flags Affected 


None. 
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Protected Mode Exceptions 

#UD If the LOCK prefix is used. 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
If CR4.UMIP = 1 and CPL > O. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 
#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 


Virtual-8086 Mode Exceptions 


#UD If the LOCK prefix is used. 

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If CR4.UMIP = 1. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#UD If the LOCK prefix is used. 
#GP(0) If the memory address is in a non-canonical form. 


If CR4.UMIP = 1 and CPL > O. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
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SHA1RNDS4—Perform Four Rounds of SHA1 Operation 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
NP OF 3A CC /r ib RMI VIN SHA Performs four rounds of SHA1 operation operating on SHA1 state 
SHA1RNDS4 xmm1, (A,B,C,D) from xmm1, with a pre-computed sum of the next 4 
xmm2/m128, imm8 round message dwords and state variable E from xmm2/m128. 
The immediate byte controls logic functions and round constants. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RMI ModRM:reg (r, w) ModRM:r/m (r) Imm8s 
Description 


The SHAIRNDS4 instruction performs four rounds of SHA1 operation using an initial SHA1 state (A,B,C,D) from the 
first operand (which is a source operand and the destination operand) and some pre-computed sum of the next 4 
round message dwords, and state variable E from the second operand (a source operand). The updated SHA1 state 
(A,B,C,D) after four rounds of processing is stored in the destination operand. 


Operation 


SHA1RNDS4 
The function f() and Constant K are dependent on the value of the immediate. 


IF (imm8[1:0] = 0 ) 
THEN f() := f0(), K := Kg; 
ELSE IF ( imm8[1:0] = 1 ) 
THEN f() := f1(), K := Ky; 
ELSE IF ( imm8[1:0] = 2 ) 
THEN f() := f2(), K := Kp; 
ELSE IF (imm8[1:0] = 3 ) 
THEN f() := £3(), K = K3; 
Fl; 


A:= SRC1[127:96]; 
B := SRC1[95:64]; 

C:= SRC1[63:32]; 

D := SRC1[31:0}; 

WoE := SRC2[127:96]; 
Wy := SRC2[95:64]; 
We := SRC2[63:32]; 
W3 := SRC2[31:0]; 


Round i = O operation: 

A_1:=f (B,C, D) + (A ROL 5) +WoE +K; 
1:=A; 

_1:=BROL 30; 
1 . . 


FORi=1to3 
A_(i +1) :=  (BLi, Ci, D_i) + (A_i ROL 5) +W;+ €_i +k; 
B_(i+1):= Ai; 
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C_(i+1) := B_i ROL 30; 

D_(i+1) := Ci; 

E_(i+1):= Di; 
ENDFOR 


DEST[127:96] = A_4; 
DEST[95:64] := B_4; 
DEST[63:32] := C_4; 
DEST[31:0] := D_4; 


Intel C/C++ Compiler Intrinsic Equivalent 
SHA1RNDS4: __m128i__mm_sha1rnds4_epu32(__m128i,__m128i, const int); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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SHA1NEXTE—Calculate SHA1 State Variable € after Four Rounds 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support Flag 
NP OF 38 C8 /r RM VIN SHA Calculates SHA1 state variable E after four rounds of operation 
SHA1NEXTE xmm1, from the current SHA1 state variable A in xmm1. The calculated 
xmm2/m128 value of the SHA1 state variable E is added to the scheduled 
dwords in xmm2/m1 28, and stored with some of the scheduled 
dwords in xmm1. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (r, w) ModRM:r/m (r) NA 
Description 


The SHA1NEXTE calculates the SHA1 state variable E after four rounds of operation from the current SHA1 state 
variable A in the destination operand. The calculated value of the SHA1 state variable E is added to the source 


operand, which contains the scheduled dwords. 


Operation 
SHA1NEXTE 


TMP := (SRC1[127:96] ROL 30); 


DEST[127:96] := SRC2[127:96] + TMP; 
DEST[95:64] := SRC2[95:64]; 
DEST[63:32] = SRC2[63:32]; 
DEST[31:0] := SRC2[31:0]; 


Intel C/C++ Compiler Intrinsic Equivalent 
SHA1NEXTE: ___m128i__mm_sha1nexte_epu32(__m128i, 


m1 28i); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”. 
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SHA1MSG1—Perform an Intermediate Calculation for the Next Four SHA1 Message Dwords 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
NP OF 38 C9 /r RM VV SHA Performs an intermediate calculation for the next four SHA1 
SHA1MSG1 xmm1, message dwords using previous message dwords from xmm1 and 
xmm2/m128 xmm2/m1 28, storing the result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (r, w) ModRM:r/m (r) NA 
Description 


The SHA1MSG1 instruction is one of two SHA1 message scheduling instructions. The instruction performs an inter- 
mediate calculation for the next four SHA1 message dwords. 


Operation 
SHA1MSG1 


WO := SRC1[127:96] ; 
W1 := SRC1[95:64]; 
W2 := SRC1[63: 32]; 
W3 := SRC1[31: 0]; 
W4 := SRC2[127:96] ; 
W5 := SRC2[95:64]; 


DEST[127:96] := W2 XOR WO; 
DEST[95:64] := W3 XOR W1; 
DEST[63:32] := W4 XOR W2; 
DEST[31:0] := W5 XOR W3; 


Intel C/C++ Compiler Intrinsic Equivalent 
SHA1MSG1:__m128i_mm_sha1msg1_epu32(__m128i, 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”. 


m1 28i); 
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SHA1MSG2—Perform a Final Calculation for the Next Four SHA1 Message Dwords 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
NP OF 38 CA /r RM VN SHA Performs the final calculation for the next four SHA1 message 
SHA1MSG2 xmm1, dwords using intermediate results from xmm1 and the previous 
xmm2/m128 message dwords from xmm2/m1 28, storing the result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (r, w) ModRM:r/m (r) NA 
Description 


The SHA1MSGz2 instruction is one of two SHA1 message scheduling instructions. The instruction performs the final 
calculation to derive the next four SHA1 message dwords. 


Operation 
SHA1MSG2 


W13 := SRC2[95:64] ; 
W14 := SRC2[63: 32]; 

W15 := SRC2[31: 0]; 

W16 := (SRC1[127:96] XOR W13 ) ROL 1; 
W17 := (SRC1[95:64] XOR W14) ROL 1; 
W18 := (SRC1[63: 32] XOR W15) ROL 1; 
W19 := (SRC1[31; 0] XOR W16) ROL 1; 


DEST[127:96] := W16; 
DEST[95:64] = W17; 
DEST[63:32] = W18; 
DEST[31:0] := W19; 


Intel C/C++ Compiler Intrinsic Equivalent 


SHA1MSG2: __m128i __mm_shalmsg2_epu32(__m128i, __m128i); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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SHA256RNDS2—Perform Two Rounds of SHA256 Operation 


xmme2/m128, <XMMO> 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
NP OF 38 CB /r RMI VIV SHA Perform 2 rounds of SHA256 operation using an initial SHA256 
SHA256RNDS2 xmm1, state (C,D,G,H) from xmm1, an initial SHA256 state (A,B,E,F) from 


xmm2/m1 28, and a pre-computed sum of the next 2 round mes- 
sage dwords and the corresponding round constants from the 
implicit operand XMMO, storing the updated SHA256 state 
(A,B,E,F) result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RMI ModRM:reg (r, w) ModRM:r/m (r) Implicit XMMO (r) 
Description 


The SHA256RNDS2 instruction performs 2 rounds of SHA256 operation using an initial SHA256 state (C,D,G,H) 
from the first operand, an initial SHA256 state (A,B,E,F) from the second operand, and a pre-computed sum of the 
next 2 round message dwords and the corresponding round constants from the implicit operand xmm0O. Note that 
only the two lower dwords of XMMO are used by the instruction. 


The updated SHA256 state (A,B,E,F) is written to the first operand, and the second operand can be used as the 


updated state (C,D,G,H) in later rounds. 


Operation 
SHA256RNDS2 


A_O:= SRC2[127:96]; 
B_O:= SRC2[95:64]; 
C_0:= SRC1[127:96]; 
D_O:= SRC1[95:64]; 
E_0:= SRC2[63:32]; 
F_O:= SRC2[31:0]; 
G_0:= SRC1[63:32]; 
H_O:= SRC1[31:0]; 
WKg = XMMO[31: 0}; 
WK, := XMMO[63: 32]; 


FORi =O to 1 


A_(i +1) := Ch (€_i, Fi, G_i) +2,( €i) +WK;+ H_i + Maj(A_i, Bi, Ci) +Z9( A_i); 


B_(i+1):= Ai; 
C_(i+1):=Bi; 

D_(i+1):= Ci: 

E_(i +1) := Ch (€_i, Fi, Gi) +2,( €i) +WK;+ Hi+ Di: 
F_(i+1):=€]; 

G_(i+1):= Fi; 

H_(i +1) := Git 

ENDFOR 


DEST[127:96] = A_2; 
DEST[95:64] := B_2; 
DEST[63:32] := €_2; 
DEST[31:0] := F_2; 
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Intel C/C++ Compiler Intrinsic Equivalent 
SHA256RNDS2: __m128i_mm_sha256rnds2_epu32(__m128i,__m128i,__m128i); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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SHA256MSG1—Perform an Intermediate Calculation for the Next Four SHA256 Message 


Dwords 

Opcode/ Op/En | 64/32 CPUID Description 

Instruction bit Mode | Feature 

Support | Flag 

NP OF 38 CC /r RM VV SHA Performs an intermediate calculation for the next four SHA256 

SHA256MSG1 xmm1, message dwords using previous message dwords from xmm1 and 

xmm2/m128 xmm2/m1 28, storing the result in xmm1. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (r, w) ModRM:r/m (r) NA 

Description 


The SHA256MSG1i instruction is one of two SHA256 message scheduling instructions. The instruction performs an 


intermediate calculation for the next four SHA256 message dwords. 


Operation 
SHA256MSG1 


W4 := SRC2[31: 0]; 
W3 := SRC1[127:96] ; 
W2 := SRC1[95:64]; 
W1 := SRC1[63: 32]; 
WO := SRC1[31: 0]; 


DEST[127:96] := W3 + oo( W4); 
DEST[95:64] := W2 + oo( W3); 
DEST[63:32] := W1 + o9( W2); 
DEST[31:0] := WO + o9( W1); 


Intel C/C++ Compiler Intrinsic Equivalent 
SHA256MSG1:__m128i__mm_sha256msg1_epu32(__m128i, __m128i); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 
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SHA256MSG2—Perform a Final Calculation for the Next Four SHA256 Message Dwords 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 

Support | Flag 
NP OF 38 CD /r RM VN SHA Performs the final calculation for the next four SHA256 message 
SHA256MSC@2 xmm1, dwords using previous message dwords from xmm1 and 
xmm2/m128 xmm2/m1 28, storing the result in xmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 
RM ModRM:reg (r, w) ModRM:r/m (r) NA 
Description 


The SHA256MSGz2 instruction is one of two SHA2 message scheduling instructions. The instruction performs the 
final calculation for the next four SHA256 message dwords. 


Operation 
SHA256MSG2 


W14 := SRC2[95:64] ; 

W15 := SRC2[127:96] ; 

W16 := SRC1[31: 0] + o,( W14); 
W17 := SRC1[63: 32] + o)( W15); 
W18 := SRC1[95: 64] + o)( W16); 
W19 := SRC1[127: 96] + o,;( W17) ; 


DEST[127:96] := W19; 
DEST[95:64] := W18; 
DEST[63:32] = W17; 
DEST[31:0] := W16; 


Intel C/C++ Compiler Intrinsic Equivalent 
SHA256MSC@2 :__m128i_mm_sha256msg2_epu32(__m128i,__m128i); 


Flags Affected 
None 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”. 


4-630 Vol. 2B SHA256MSG2—Perform a Final Calculation for the Next Four SHA256 Message Dwords 


INSTRUCTION SET REFERENCE, M-U 


SHLD—Double Precision Shift Left 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF A4 /r ib SHLD r/m16, 716, imm8 MRI | Valid Valid Shift r/m76 to left imm8 places while shifting 
bits from r76 in from the right. 

OF AS /r SHLD r/m16, 716, CL MRC | Valid Valid Shift r/m76 to left CL places while shifting bits 
from r16 in from the right. 

OF A4 /r ib SHLD r/m32, r32, imm8 MRI | Valid Valid Shift r/m32 to left imm8 places while shifting 
bits from r32 in from the right. 

REX.W + OF A4 /r ib SHLD r/m64, r64, imm8 MRI | Valid N.E. Shift r/m64 to left imm8 places while shifting 
bits from r64 in from the right. 

OF AS /r SHLD r/m32, r32, CL MRC | Valid Valid Shift r/m32 to left CL places while shifting bits 
from r32 in from the right. 

REX.W + OF AS /r SHLD r/m64, r64, CL MRC | Valid N.E. Shift r/m64 to left CL places while shifting 
bits from r64 in from the right. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MRI ModRM:r/m (w) ModRM:reg (r) imm8 NA 
MRC ModRM:r/m (w) ModRM:reg (r) cL NA 

Description 


The SHLD instruction is used for multi-precision shifts of 64 bits or more. 


The instruction shifts the first operand (destination operand) to the left the number of bits specified by the third 
operand (count operand). The second operand (source operand) provides bits to shift in from the right (starting 
with bit 0 of the destination operand). 


The destination operand can be a register or a memory location; the source operand is a register. The count 
operand is an unsigned integer that can be stored in an immediate byte or in the CL register. If the count operand 
is CL, the shift count is the logical AND of CL and a count mask. In non-64-bit modes and default 64-bit mode; only 
bits 0 through 4 of the count are used. This masks the count to a value between 0 and 31. If a count is greater than 
the operand size, the result is undefined. 


If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand. For a 1-bit 
shift, the OF flag is set if a sign change occurred; otherwise, it is cleared. If the count operand is 0, flags are not 
affected. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits 
(upgrading the count mask to 6 bits). See the summary chart at the beginning of this section for encoding data and 
limits. 


Operation 


IF (In 64-Bit Mode and REX.W = 1) 
THEN COUNT := COUNT MOD 64; 
ELSE COUNT := COUNT MOD 32; 

Fl 

SIZE := OperandSize; 

IF COUNT = 0 
THEN 

No operation; 
ELSE 
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IF COUNT > SIZE 
THEN (* Bad parameters *) 
DEST is undefined; 
CF, OF, SF, ZF, AF, PF are undefined; 
ELSE (* Perform the shift *) 
CF := BIT[DEST, SIZE - COUNT]; 
(* Last bit shifted out on exit *) 
FOR i := SIZE - 1 DOWN TO COUNT 


DO 
Bit(DEST, i) := Bit(DEST, i - COUNT); 
OD; 
FOR i := COUNT - 1 DOWN TO 0 
DO 
BIT[DEST, i] := BIT[SRC, i - COUNT + SIZE]; 
OD; 
Fl; 
Fl; 
Flags Affected 


If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand and the SF, ZF, 
and PF flags are set according to the value of the result. For a 1-bit shift, the OF flag is set if a sign change occurred; 
otherwise, it is cleared. For shifts greater than 1 bit, the OF flag is undefined. If a shift occurs, the AF flag is unde- 
fined. If the count operand is 0, the flags are not affected. If the count is greater than the operand size, the flags 

are undefined. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


4-632 Vol. 2B SHLD—Double Precision Shift Left 


INSTRUCTION SET REFERENCE, M-U 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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SHRD—Double Precision Shift Right 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF AC /r ib SHRD r/m16, 716, imm8 MRI | Valid Valid Shift r/m76 to right imm8 places while 
shifting bits from r76 in from the left. 
OF AD /r SHRD r/m16, 716, CL MRC | Valid Valid Shift r/m76 to right CL places while shifting 
bits from r76 in from the left. 
OF AC /r ib SHRD r/m32, r32, imm8 MRI | Valid Valid Shift r/m32 to right imm8 places while 
shifting bits from r32 in from the left. 
REX.W + OF AC /r ib SHRD r/m64, r64, imm8 MRI | Valid N.E. Shift r/m64 to right imm@ places while 
shifting bits from r64 in from the left. 
OF AD /r SHRD r/m32, r32, CL MRC | Valid Valid Shift r/m32 to right CL places while shifting 
bits from r32 in from the left. 
REX.W + OF AD /r SHRD r/m64, r64, CL MRC | Valid N.E. Shift r/m64 to right CL places while shifting 
bits from r64 in from the left. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MRI ModRM:r/m (w) ModRM:reg (r) imm8 NA 
MRC ModRM:r/m (w) ModRM:reg (r) cL NA 
Description 


The SHRD instruction is useful for multi-precision shifts of 64 bits or more. 


The instruction shifts the first operand (destination operand) to the right the number of bits specified by the third 
operand (count operand). The second operand (source operand) provides bits to shift in from the left (starting with 
the most significant bit of the destination operand). 


The destination operand can be a register or a memory location; the source operand is a register. The count 
operand is an unsigned integer that can be stored in an immediate byte or the CL register. If the count operand is 
CL, the shift count is the logical AND of CL and a count mask. In non-64-bit modes and default 64-bit mode, the 
width of the count mask is 5 bits. Only bits 0 through 4 of the count register are used (masking the count to a value 
between 0 and 31). If the count is greater than the operand size, the result is undefined. 


If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand. For a 1-bit 
shift, the OF flag is set if a sign change occurred; otherwise, it is cleared. If the count operand is 0, flags are not 
affected. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits 
(upgrading the count mask to 6 bits). See the summary chart at the beginning of this section for encoding data and 
limits. 


Operation 


IF (In 64-Bit Mode and REX.W = 1) 
THEN COUNT := COUNT MOD 64; 
ELSE COUNT := COUNT MOD 32; 

Fl 

SIZE := OperandSize; 

IF COUNT = 0 
THEN 

No operation; 
ELSE 
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IF COUNT > SIZE 
THEN (* Bad parameters *) 
DEST is undefined; 
CF, OF, SF, ZF, AF, PF are undefined; 
ELSE (* Perform the shift *) 
CF := BIT[DEST, COUNT - 1]; (* Last bit shifted out on exit *) 
FOR i := 0 TO SIZE - 1 - COUNT 


DO 
BIT[DEST, i] := BIT[DEST, i + COUNT]; 
OD; 
FOR i := SIZE - COUNT TO SIZE - 1 
DO 
BIT[DEST,i] := BIT[SRC, i + COUNT - SIZE]; 
OD; 
Fl; 
Fl; 
Flags Affected 


If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand and the SF, 
ZF, and PF flags are set according to the value of the result. For a 1-bit shift, the OF flag is set if a sign change 
occurred; otherwise, it is cleared. For shifts greater than 1 bit, the OF flag is undefined. If a shift occurs, the AF flag 
is undefined. If the count operand is 0, the flags are not affected. If the count is greater than the operand size, the 
flags are undefined. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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SHUFPD—Packed Interleave Shuffle of Pairs of Double-Precision Floating-Point Values 


Opcode/ Op/ 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 

66 OF C6 /r ib A VV SSE2 Shuffle two pairs of double-precision floating-point 

SHUFPD xmm1, xmm2/m128, imm8 values from xmm1 and xmm2/m128 using imm8 to 
select from each pair, interleaved result is stored in 
xmm1. 

VEX.128.66.0F.WIG C6 /r ib B VN AVX Shuffle two pairs of double-precision floating-point 

VSHUFPD xmm1, xmm2, xmm3/m128, values from xmm2 and xmm3/m128 using imm8 to 

imm8 select from each pair, interleaved result is stored in 
xmm1. 

VEX.256.66.0F.WIG C6 /r ib B VN AVX Shuffle four pairs of double-precision floating-point 

VSHUFPD ymm1, ymm2, ymm3/m256, values from ymm2 and ymm3/m256 using imm8 to 

imm8 select from each pair, interleaved result is stored in 
xmm1. 

EVEX.128.66.0F.W1 C6 /r ib C VV AVX512VL | Shuffle two paris of double-precision floating-point 

VSHUFPD xmm1{k1}{z}, xmm_2, AVX512F values from xmm2 and xmm3/m128/m64bcst using 

xmm3/m128/m64bcst, imm8 imm8 to select from each pair. store interleaved 
results in xmm1 subject to writemask k1. 

EVEX.256.66.0F.W1 C6 /r ib C VIV AVX512VL | Shuffle four paris of double-precision floating-point 

VSHUFPD ymm1{k1}{z}, ymm2, AVX512F values from ymm2 and ymm3/m256/m64bcst using 

ymm3/m256/m64bcst, imm8 imm8 to select from each pair. store interleaved 
results in ymm1 subject to writemask k1. 

EVEX.512.66.0F.W1 C6 /r ib C VV AVX512F Shuffle eight paris of double-precision floating-point 

VSHUFPD zmm1{k1}{z}, zmm2, values from zmm2 and zmm3/m512/m64bcst using 

zmm3/m512/m64bcst, imm8 imm8 to select from each pair. store interleaved 
results in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8s 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Selects a double-precision floating-point value of an input pair using a bit control and move to a designated 
element of the destination operand. The low-to-high order of double-precision element of the destination operand 
is interleaved between the first source operand and the second source operand at the granularity of input pair of 
128 bits. Each bit in the imm§8 byte, starting from bit 0, is the select control of the corresponding element of the 
destination to received the shuffled result of an input pair. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
64-bit memory location The destination operand is a ZMM/YMM/XMM register updated according to the writemask. 
The select controls are the lower 8/4/2 bits of the imm8 byte. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. The select controls are the bit 3:0 
of the imm8 byte, imm8[7:4) are ignored. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. The select controls are the bit 1:0 of the imm8 byte, 
imm8[7:2) are ignored. 


SHUFPD—Packed Interleave Shuffle of Pairs of Double-Precision Floating-Point Values Vol.2B 4-637 


INSTRUCTION SET REFERENCE, M-U 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation operand and the first source operand is the same and is an XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are unmodified. The select controls are the bit 1:0 of the imm8 byte, 
imm8[7:2) are ignored. 


SRC1 X3 X2 x1 v.40) 
SRC2 Y3 2 Y1 YO 
DEST Y2 or Y3 X2 or X3 YO or Y1 XO or X1 


Figure 4-25. 256-bit VSHUFPD Operation of Four Pairs of DP FP Values 


Operation 


VSHUFPD (EVEX encoded versions when SRC2 is a vector register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF IMMO[O] = 0 
THEN TMP_DEST[63:0] := SRC1[63:0] 
ELSE TMP_DEST[63:0] := SRC1[127:64] Fl; 
IF IMMO[1] = 0 
THEN TMP_DEST[127:64] := SRC2[63:0] 
ELSE TMP_DEST[127:64] := SRC2[127:64] Fl; 
IF VL >= 256 
IF IMMO[2] = 0 
THEN TMP_DEST[191:128] := SRC1[191:128] 
ELSE TMP_DEST[191:128] := SRC1[255:192] Fl; 
IF IMMO[3] = 0 
THEN TMP_DEST[255:192] := SRC2[191:128] 
ELSE TMP_DEST[255:192] := SRC2[255:192] Fl; 


Fl; 
IF VL >= 512 
IF IMMO[4] = 0 
THEN TMP_DEST[319:256] := SRC1[319:256] 
ELSE TMP_DEST[319:256] := SRC1[383:320] Fl; 
IF IMMO[5] = 0 
THEN TMP_DEST[383:320] := SRC2[319:256] 
ELSE TMP_DEST[383:320] := SRC2[383:320] Fl; 
IF IMMO[6] = 0 
THEN TMP_DEST[447:384] := SRC1[447:384] 
ELSE TMP_DEST[447:384] := SRC1[511:448] Fl; 
IF IMMO[7] = 0 
THEN TMP_DEST[51 1:448] := SRC2[447:384] 
ELSE TMP_DEST[51 1:448] := SRC2[511:448] Fl; 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := TMP_DEST[i+63:i] 
ELSE 
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IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSHUFPD (EVEX encoded versions when SRC2 is memory) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) 
THEN TMP_SRC2[i+63:i] := SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF IMMO[O] = O 
THEN TMP_DEST[63:0] := SRC1[63:0] 
ELSE TMP_DEST[63:0] := SRC1[127:64] FI; 
IF IMMO[1] = 0 
THEN TMP_DEST[1 27:64] := TMP_SRC2[63:0] 
ELSE TMP_DEST[127:64] := TMP_SRC2[127:64] Fl; 
IF VL >= 256 
IF IMMO[2] = 0 
THEN TMP_DEST[191:128] := SRC1[191:128] 
ELSE TMP_DEST[191:128] := SRC1[255:192] Fl; 
IF IMMO[3] = 0 
THEN TMP_DEST[255:192] := TMP_SRC2[191:128] 
ELSE TMP_DEST[255:192] := TMP_SRC2[255:192] Fl; 


Fl; 
IF VL >= 512 
IF IMMO[4] = 0 
THEN TMP_DEST[319:256] := SRC1[319:256] 
ELSE TMP_DEST[319:256] := SRC1[383:320] Fl; 
IF IMMO[5] = 0 
THEN TMP_DEST[383:320] := TMP_SRC2[319:256] 
ELSE TMP_DEST[383:320] := TMP_SRC2[383:320] FI; 
IF IMMO[6] = 0 
THEN TMP_DEST[447:384] := SRC1[447:384] 
ELSE TMP_DEST[447:384] := SRC1[511:448] Fl; 
IF IMMO[7] = 0 
THEN TMP_DEST[51 1:448] := TMP_SRC2[447:384] 
ELSE TMP_DEST[51 1:448] := TMP_SRC2[51 1:448] Fl; 
Fl; 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
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ELSE *zeroing-masking* 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VSHUFPD (VEX.256 encoded version) 
IF IMMO[O] = O 
THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST[63:0] := SRC1[127:64] Fl; 
IF IMMO[1] = 0 
THEN DEST[127:64] := SRC2[63:0] 
ELSE DEST[127:64] := SRC2[127:64] Fl; 
IF IMMO[2] = 0 
THEN DEST[191:128] := SRC1[191:128] 
ELSE DEST[191:128] := SRC1[255:192] Fl; 
IF IMMO[3] = 0 
THEN DEST[255:192] := SRC2[191:128] 
ELSE DEST[255:192] := SRC2[255:192] Fl; 
DEST[MAXVL-1:256] (Unmodified) 


VSHUFPD (VEX.128 encoded version) 
IF IMMO[O] = 0 
THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST[63:0] := SRC1[127:64] Fl; 
IF IMMO[1] = 0 
THEN DEST[1 27:64] := SRC2[63:0] 
ELSE DEST[1 27:64] := SRC2[127:64] Fl; 
DEST[MAXVL-1:128] := 0 


VSHUFPD (128-bit Legacy SSE version) 
IF IMMO[O] = 0 
THEN DEST[63:0] := SRC1[63:0] 
ELSE DEST[63:0] := SRC1[127:64] Fl; 
IF IMMO[1] = 0 
THEN DEST[127:64] := SRC2[63:0] 
ELSE DEST[127:64] := SRC2[127:64] Fl; 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSHUFPD __m512d_mm512_shuffle_pd(__m512d a, 


; zeroing-masking 


m512d b, int imm); 


VSHUFPD __m512d_mm512_mask_shuffle_pd(__m512d s, 


mmask8 k,__m512da,__m512db, int imm); 


VSHUFPD __m512d 


mm512 


maskz_shuffle_pd(__mmask8 k,__m512da,__m512d 5, int imm); 


VSHUFPD __m256d 


mm256 


VSHUFPD __m256d 


mm256 


shuffle_pd (__m256d a,___m256d b, const int select); 
mask_shuffle_pd(__m256d s,__ mmask8 k,__ m256d a,__ m256d b, int imm); 


VSHUFPD __m256d 


mm256 


maskz_shuffle_pd(__mmask8 k,__ m256d a, __m256d b, int imm); 


SHUFPD __m128d __mm_shuffle_pd (__m128d a,__m128d b, const int select); 


VSHUFPD __m128d __mm_mask_shuffle_pd(__m128d s, 


mmask8 k,__m128d a,__m128d , int imm); 


VSHUFPD __m128d __mm_maskz_shuffle_pd(___mmask8 k, 


m128d a,__m128d b, int imm); 
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SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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SHUFPS—Packed Interleave Shuffle of Quadruplets of Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF C6 /r ib A VN SSE Select from quadruplet of single-precision floating- 
SHUFPS xmm1, xmm3/m128, imm8 point values in xmm1 and xmm2/m1 28 using imm8, 
interleaved result pairs are stored in xmm1. 
VEX.128.0F.WIG C6 /r ib B VIN AVX Select from quadruplet of single-precision floating- 
VSHUFPS xmm1, xmm2, point values in xmm1 and xmm2/m1 28 using imm8, 
xmm3/m1 28, imm8 interleaved result pairs are stored in xmm1. 
VEX.256.0F.WIG C6 /r ib B VIN AVX Select from quadruplet of single-precision floating- 
VSHUFPS ymm1, ymm2, point values in ymm2 and ymm3/m256 using imm8, 
ymm3/m256, imm8 interleaved result pairs are stored in ymm1. 
EVEX.128.0F.WO C6 /r ib C VIV AVX512VL | Select from quadruplet of single-precision floating- 
VSHUFPS xmm1{k1}{z}, xmm2, AVX512F point values in xmm1 and xmm2/m1 28 using imm8, 
xmm3/m128/m32bcst, imm8 interleaved result pairs are stored in xmm1, subject to 
writemask k1. 
EVEX.256.0F.WO C6 /r ib C VIV AVX512VL | Select from quadruplet of single-precision floating- 
VSHUFPS ymm1{k1}{z}, ymm2, AVX512F point values in ymm2 and ymm3/m256 using imm8, 
ymm3/m256/m32bcst, imm8 interleaved result pairs are stored in ymm1, subject to 
writemask k1. 
EVEX.512.0F.WO C6 /r ib C VN AVX512F Select from quadruplet of single-precision floating- 
VSHUFPS zmm1{k1}{z}, zmm2, point values in zmm2 and zmm3/m512 using imms, 
zmm3/m512/m32bcst, imm8 interleaved result pairs are stored in zmm1, subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) Imm8s8 NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8s 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Selects a single-precision floating-point value of an input quadruplet using a two-bit control and move to a desig- 
nated element of the destination operand. Each 64-bit element-pair of a 128-bit lane of the destination operand is 
interleaved between the corresponding lane of the first source operand and the second source operand at the gran- 
ularity 128 bits. Each two bits in the imm8 byte, starting from bit 0, is the select control of the corresponding 
element of a 128-bit lane of the destination to received the shuffled result of an input quadruplet. The two lower 
elements of a 128-bit lane in the destination receives shuffle results from the quadruple of the first source operand. 
The next two elements of the destination receives shuffle results from the quadruple of the second source operand. 


EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be 
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 
32-bit memory location. The destination operand is aZMM/YMM/XMM register updated according to the writemask. 
Imm8g[7:0] provides 4 select controls for each applicable 128-bit lane of the destination. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. Imm8[7:0] provides 4 select 
controls for the high and low 128-bit of the destination. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. Imm8[7:0] provides 4 select controls for each element of 
the destination. 


4-642 Vol. 2B SHUFPS—Packed Interleave Shuffle of Quadruplets of Single-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, M-U 


128-bit Legacy SSE version: The source can be an XMM register or an 128-bit memory location. The destination is 
not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM 
register destination are unmodified. Imm8[7:0] provides 4 select controls for each element of the destination. 


src X7 x6 X5 x4 X3 x2 x1 x0 
sRca Y7 Y6 Y Y4 Y3 Y2 Y1 YO 


DEST| Y7..Y4 | Y7..Y4 | X7..X4] X7..X4]Y3..YO | Y3 ..YO 


Figure 4-26. 256-bit VSHUFPS Operation of Selection from Input Quadruplet and Pair-wise Interleaved Result 


Operation 


Select4(SRC, control) { 
CASE (control[1:0]) OF 
O: TMP := SRC[31:0); 
1: TMP := SRC[63:32]; 
2: TMP :=SRC[95:64]; 
3: TMP := SRC[127:96]; 
ESAC; 
RETURN TMP 
} 


VPSHUFPS (EVEX encoded versions when SRC2 is a vector register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


TMP_DEST[31:0] := Select4(SRC1[127:0], imm8[1:0)); 
TMP_DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]); 
TMP_DEST[95:64] := Select4(SRC2[1 27:0], imm8[5:4)); 
TMP_DEST[1 27:96] := Select4(SRC2[1 27:0], imm8[7:6)); 
IF VL >= 256 
TMP_DEST[159:1 28] := Select4(SRC1[255:1 28], imm8[1:0}); 
TMP_DEST[191:160] := Select4(SRC1[255:1 28], imm8[3:2]); 
TMP_DEST[223:192] := Select4(SRC2[255:1 28], imm8[5:4}); 
TMP_DEST[255:224] := Select4(SRC2[255:1 28], imm8[7:6]); 
Fl; 
IFVL>=512 
TMP_DEST[287:256] := Select4(SRC1[383:256], imm8[1:0}); 
TMP_DEST[319:288] := Select4(SRC1[383:256], imm8[3:2]); 
TMP_DEST[351:320] := Select4(SRC2[383:256], imm8[5:4)); 
TMP_DEST[383:352] := Select4(SRC2[383:256], imm8[7:6]); 
TMP_DEST[415:384] := Select4(SRC1[51 1:384], imm8[1:0]) 
TMP_DEST[447:416] := Select4(SRC1[51 1:384], imm8[3:2]); 
) 
) 


TMP_DEST[479:448] := Select4(SRC2[51 1:384], imm8[5:4] 
TMP_DEST[51 1:480] := Select4(SRC2[51 1:384], imm8[7:6] 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
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THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPSHUFPS (EVEX encoded versions when SRC2 is memory) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) 
THEN TMP_SRC2{[i+31:i] := SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
TMP_DEST[31:0] := Select4(SRC1[127:0], imm8[1:0)); 
TMP_DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]); 
TMP_DEST[95:64] := Select4(TMP_SRC2[1 27:0], imm8[5:4]); 
TMP_DEST[1 27:96] := Select4(TMP_SRC2[1 27:0], imm8[7:6]); 
IF VL >= 256 
TMP_DEST[159:1 28] := Select4(SRC1[255:1 28], imm8[1:0]); 
TMP_DEST[191:160] := Select4(SRC1[255:1 28], imm8[3:2]); 
TMP_DEST[223:192] := Select4(TMP_SRC2[255:1 28], imm8[5:4]); 
TMP_DEST[255:224] := Select4(TMP_SRC2[255:1 28], imm8[7:6]); 
Fl; 
IF VL >= 512 
TMP_DEST[287:256] := Select4(SRC1[383:256], imm8[1:0]); 
TMP_DEST[319:288] := Select4(SRC1[383:256], imm8[3:2]); 
TMP_DEST[351:320] := Select4(TMP_SRC2[383:256], imm8[5:4]); 
TMP_DEST[383:352] := Select4(TMP_SRC2[383:256], imm8[7:6]); 
TMP_DEST[415:384] := Select4(SRC1[511:384], imm8[1:0]); 
TMP_DEST[447:416] := Select4(SRC1[511:384], imm8[3:2]); 
TMP_DEST[479:448] := Select4(TMP_SRC2[51 1:384], imm8[5:4]); 
TMP_DEST[51 1:480] := Select4(TMP_SRC2[51 1:384], imm8[7:6]); 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VSHUFPS (VEX.256 encoded version) 

DEST[31:0] := Select4(SRC1[127:0], imm8[1:0)); 
DEST[63:32] := Select4(SRC1[127:0], imm8[3:2)); 
DEST[95:64] := Select4(SRC2[1 27:0], imm8[5:4)); 
DEST[127:96] := Select4(SRC2[127:0], imm8[7:6]); 
DEST[159:128] := Select4(SRC1[255:1 28], imm8[1:0)), 
DEST[191:160] := Select4(SRC1[255:1 28], imm8[3:2]); 
DEST[223:192] := Select4(SRC2[255:1 28], imm8[5:4)), 
DEST[255:224] := Select4(SRC2[255:1 28], imm8[7:6]), 
DEST[MAXVL-1:256] := 0 


VSHUFPS (VEX.128 encoded version) 
DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]); 
DEST[63:32] := Select4(SRC1[127:0], imm8[3:2)); 
DEST[95:64] := Select4(SRC2[1 27:0], imm8[5:4)); 
DEST[127:96] := Select4(SRC2[1 27:0], imm8[7:6]); 
DEST[MAXVL-1:128] := 0 


SHUFPS (128-bit Legacy SSE version) 
DEST[31:0] := Select4(SRC1[127:0], imm8[1:0)); 
DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]); 
DEST[95:64] := Select4(SRC2[1 27:0], imm8[5:4]); 
DEST[127:96] := Select4(SRC2[1 27:0], imm8[7:6]); 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 
VSHUFPS __m512_mm512_shuffle_ps(__m512 a, 


VSHUFPS __m512 _mm512_maskz_shuffle_ps(__mmask16 k, 
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m512 b, int imm); 
VSHUFPS __m512_mm512_mask_shuffle_ps(__m512s,__ mmask16 k,__m512 a,__m512 b, int imm); 
m512 a,__m512 5, int imm); 


VSHUFPS __m256 _mm256_shuffle_ps (__m256 a,__m256 b, const int select); 


VSHUFPS __m256 _mm256_mask_shuffle_ps(__m256 s, 


mmask8 k,__m256 a,__m256 b, int imm); 


VSHUFPS __m256 _mm256_maskz_shuffle_ps(__mmask8 k,__m256 a,__m256 b, int imm); 


SHUFPS __m128 _mm_shuffle_ps (_m128 a, 


m128 b, const int select); 


VSHUFPS __m128 _mm_mask_shuffle_ps(__m128s,__ mmask8 k,__m128 a,__m128, int imm); 


VSHUFPS __m128 _mm_maskz_shuffle_ps(__mmask8 k,__m128 a, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


m128 b, int imm); 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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SIDT—Store Interrupt Descriptor Table Register 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 01/1 SIDT m M Valid Valid Store IDTR to m. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the content the interrupt descriptor table register (IDTR) in the destination operand. The destination 
operand specifies a 6-byte memory location. 


In non-64-bit modes, the 16-bit limit field of the register is stored in the low 2 bytes of the memory location and 
the 32-bit base address is stored in the high 4 bytes. 


In 64-bit mode, the operand size fixed at 8+2 bytes. The instruction stores 8-byte base and 2-byte limit values. 


SIDT is only useful in operating-system software; however, it can be used in application programs without causing 
an exception to be generated if CR4.UMIP = 0. See “LGDT/LIDT—Load Global/Interrupt Descriptor Table Register” 
in Chapter 3, Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A, for information on 
loading the GDTR and IDTR. 


IA-32 Architecture Compatibility 


The 16-bit form of SIDT is compatible with the Intel 286 processor if the upper 8 bits are not referenced. The Intel 
286 processor fills these bits with 1s; processor generations later than the Intel 286 processor fill these bits with 
Os. 


Operation 


IF instruction is SIDT 
THEN 
IF OperandSize =16 or OperandSize = 32 (* Legacy or Compatibility Mode *) 
THEN 
DEST[O:15] := IDTR(Limit); 
DEST[16:47] := IDTR(Base); Fl; (* Full 32-bit base address stored *) 
ELSE (* 64-bit Mode *) 
DEST[O:15] := IDTR(Limit); 
DEST[16:79] := IDTR(Base); (* Full 64-bit base address stored *) 
Fl; 
Fl; 


Flags Affected 
None. 
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Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
If CR4.UMIP = 1 and CPL > 0. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If CR4.UMIP = 1. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#UD If the LOCK prefix is used. 
#GP(0) If the memory address is in a non-canonical form. 


If CR4.UMIP = 1 and CPL > O. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
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SLDT—Store Local Descriptor Table Register 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 00 /0 SLDT r/m16 M Valid Valid Stores segment selector from LDTR in r/m176. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the segment selector from the local descriptor table register (LDTR) in the destination operand. The desti- 
nation operand can be a general-purpose register or a memory location. The segment selector stored with this 
instruction points to the segment descriptor (located in the GDT) for the current LDT. This instruction can only be 
executed in protected mode. 


Outside IA-32e mode, when the destination operand is a 32-bit register, the 16-bit segment selector is copied into 
the low-order 16 bits of the register. The high-order 16 bits of the register are cleared for the Pentium 4, Intel Xeon, 
and P6 family processors. They are undefined for Pentium, Intel486, and Intel386 processors. When the destina- 
tion operand is a memory location, the segment selector is written to memory as a 16-bit quantity, regardless of 
the operand size. 


In compatibility mode, when the destination operand is a 32-bit register, the 16-bit segment selector is copied into 
the low-order 16 bits of the register. The high-order 16 bits of the register are cleared. When the destination 
operand is a memory location, the segment selector is written to memory as a 16-bit quantity, regardless of the 
operand size. 


In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). The 
behavior of SLDT with a 64-bit register is to zero-extend the 16-bit selector and store it in the register. If the desti- 
nation is memory and operand size is 64, SLDT will write the 16-bit selector to memory as a 16-bit quantity, 
regardless of the operand size. 


Operation 
DEST := LDTR(SegmentSelector); 


Flags Affected 
None. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
If CR4.UMIP = 1 and CPL > 0. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The SLDT instruction is not recognized in real-address mode. 
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Virtual-8086 Mode Exceptions 
#UD The SLDT instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
If CR4.UMIP = 1 and CPL > O. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
#UD If the LOCK prefix is used. 
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SMSW-—Store Machine Status Word 


Opcode* Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

OF 01 /4 SMSW r/m16 M Valid Valid Store machine status word to r/m76. 

OF 01 /4 SMSW r32/m16 M Valid Valid Store machine status word in low-order 16 
bits of r32/m16; high-order 16 bits of r32 are 
undefined. 

REX.W + OF 01 /4 SMSW r64/m16 M Valid Valid Store machine status word in low-order 16 
bits of r64/m16; high-order 16 bits of r32 are 
undefined. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the machine status word (bits 0 through 15 of control register CRO) into the destination operand. The desti- 
nation operand can be a general-purpose register or a memory location. 


In non-64-bit modes, when the destination operand is a 32-bit register, the low-order 16 bits of register CRO are 
copied into the low-order 16 bits of the register and the high-order 16 bits are undefined. When the destination 
operand is a memory location, the low-order 16 bits of register CRO are written to memory as a 16-bit quantity, 
regardless of the operand size. 


In 64-bit mode, the behavior of the SMSW instruction is defined by the following examples: 
¢ SMSW ri6 operand size 16, store CRO[15:0] in ri6 

° SMSW r32 operand size 32, zero-extend CRO[31:0], and store in r32 

° SMSW r64 operand size 64, zero-extend CRO[63:0], and store in r64 

¢ SMSW mi6 operand size 16, store CRO[15:0] in m1i6 

° SMSW mi6 operand size 32, store CRO[15:0] in m16 (not m32) 

° SMSW mi16 operands size 64, store CRO[15:0] in m16 (not m64) 


SMSW is only useful in operating-system software. However, it is not a privileged instruction and can be used in 
application programs if CR4.UMIP = 0. It is provided for compatibility with the Intel 286 processor. Programs and 
procedures intended to run on IA-32 and Intel 64 processors beginning with the Intel386 processors should use the 
MOV CR instruction to load the machine status word. 


See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 24 of the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in 
VMX non-root operation. 


Operation 


DEST := CRO[15:0]; 
(* Machine status word *) 


Flags Affected 
None. 
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Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
If CR4.UMIP = 1 and CPL > 0. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If CR4.UMIP = 1. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 
If CR4.UMIP = 1 and CPL > O. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL = 3. 
#UD If the LOCK prefix is used. 
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SQRTPD—Square Root of Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 51 /r A VV SSE2 Computes Square Roots of the packed double-precision 
SQRTPD xmm1, xmm2/m128 floating-point values in xmm2/m128 and stores the result 
inxmm1. 
VEX.128.66.0F.WIG 51 /r A VV AVX Computes Square Roots of the packed double-precision 
VSQRTPD xmm1, xmm2/m128 floating-point values in xmm2/m128 and stores the result 
inxmm1. 
VEX.256.66.0F.WIG 51 /r A VV AVX Computes Square Roots of the packed double-precision 
VSQRTPD ymm1, ymm2/m256 floating-point values in ymm2/m256 and stores the result 
inymm1. 
EVEX.128.66.0F.W1 51 /r B VV AVX512VL | Computes Square Roots of the packed double-precision 
VSQRTPD xmm1 {k1}{Z}, AVX512F floating-point values in xmm2/m128/m64bcst and stores 
xmm2/m1 28/m64bcst the result in xmm1 subject to writemask k1. 
EVEX.256.66.0F.W1 51 /r B VV AVX512VL | Computes Square Roots of the packed double-precision 
VSQRTPD ymm1 {k1}{Z}, AVX512F floating-point values in ymm2/m256/m64bcst and stores 
ymm2/m256/m64bcst the result in ymm1 subject to writemask k1. 
EVEX.512.66.0F.W1 51 /r B VV AVX512F Computes Square Roots of the packed double-precision 
VSQRTPD zmm1 {k1}{Z}, floating-point values in zmm2/m512/m64bcst and stores 
zmm2/m512/m64bcst{er} the result in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Performs a SIMD computation of the square roots of the two, four or eight packed double-precision floating-point 
values in the source operand (the second operand) stores the packed double-precision floating-point results in the 
destination operand (the first operand). 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or 
a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is a 
ZMM/YMM/XMM register updated according to the writemask. 


VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination 
operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are 
zeroed. 


VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina- 
tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina- 
tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM 
register destination are unmodified. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VSQRTPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND (SRC *is register*) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+63:i] = SOQRT(SRC[63:0]) 
ELSE DEST[i+63:i] := SQRT(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VSQRTPD (VEX.256 encoded version) 
DEST[63:0] := SQRT(SRC[63:0]) 
DEST[127:64] := SQRT(SRC[127:64]) 
DEST[191:128] := SQRT(SRC[191:128}]) 
DEST[255:192] := SQRT(SRC[255:1 92]) 
DEST[MAXVL-1:256] := 0 


VSQRTPD (VEX.128 encoded version) 
DEST[63:0] := SQRT(SRC[63:0)) 
DEST[127:64] := SQRT(SRC[127:64]) 
DEST[MAXVL-1:128] := 0 


SQRTPD (128-bit Legacy SSE version) 
DEST[63:0] := SQRT(SRC[63:0]) 
DEST[127:64] := SORT(SRC[127:64]) 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSQRTPD __m512d_mm512_sqrt_round_pd(__m512d a, int r); 

VSQRTPD __m512d_mm512_mask_sqrt_round_pd(__m512d s,___mmask8 k,___m512d a, int r); 
VSQRTPD __m512d_mm512_maskz_sqrt_round_pd(__mmask8 k,__m512d a, int r); 
VSQRTPD __m256d __mm256_sqrt_pd (__m256d a); 
VSQRTPD __m256d__mm256_mask_sqrt_pd(__m256d s, 
VSQRTPD __m256d __mm256_maskz_sqrt_pd(__mmask8 k, 
SQRTPD __m128d _mm_sqrt_pd (__m128d a); 

VSQRTPD __m128d __mm_mask_sqrt_pd(__m128d s, __mmask8 k, __m128d a, int r); 
VSQRTPD __m128d _mm_maskz_sqrt_pd(__mmask8 k, __m128d a, int r); 


mmask8 k, _m256d a, int r); 
m256d a, int r); 
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SIMD Floating-Point Exceptions 
Invalid, Precision, Denormal 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv != 1111B. 

EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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SQRTPS—Square Root of Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 51 /r A VIV SSE Computes Square Roots of the packed single-precision 
SQRTPS xmm1, xmm2/m128 floating-point values in xmm2/m128 and stores the result in 
xmm1. 
VEX.128.0F.WIG 51 /r A VIV AVX Computes Square Roots of the packed single-precision 
VSQRTPS xmm1, xmm2/m128 floating-point values in xmm2/m128 and stores the result in 
xmm1. 
VEX.256.0F.WIG 51/r A VIV AVX Computes Square Roots of the packed single-precision 
VSQRTPS ymm1, ymm2/m256 floating-point values in ymm2/m256 and stores the result in 
ymm1. 
EVEX.128.0F.WO 51 /r B VIV AVX512VL_ | Computes Square Roots of the packed single-precision 
VSQRTPS xmm1 {k1}{Z}, AVX512F floating-point values in xmm2/m128/m32bcst and stores 
xmm2/m128/m32bcst the result in xmm1 subject to writemask k1. 
EVEX.256.0F.WO 51 /r B VIV AVX512VL_ | Computes Square Roots of the packed single-precision 
VSQRTPS ymm1 {k1}{Z}, AVX512F floating-point values in ymm2/m256/m32bcst and stores 
ymm2/m256/m32bcst the result in ymm1 subject to writemask k1. 
EVEX.512.0F.WO0 51/r B VIV AVX512F Computes Square Roots of the packed single-precision 
VSQRTPS zmm1 {k1}{z}, floating-point values in zmm2/m512/m32bcst and stores 
zmm2/m512/m32bcst{er} the result in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Performs a SIMD computation of the square roots of the four, eight or sixteen packed single-precision floating-point 
values in the source operand (second operand) stores the packed single-precision floating-point results in the 
destination operand. 

EVEX.512 encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location 
or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register updated according to the writemask. 

VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination 
operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are 
zeroed. 

VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina- 
tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are 
zeroed. 

128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina- 
tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM 
register destination are unmodified. 


Note: VEX.vvvv and EVEX.vvvwv are reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VSQRTPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND (SRC *is register*) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN DEST[i+31:i] := SQRT(SRC[3 1:0]) 
ELSE DEST[i+31:i] = SOQRT(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSQRTPS (VEX.256 encoded version) 
DEST[31:0] := SQRT(SRC[31:0]) 
DEST[63:32] := SQRT(SRC[63:32]) 
DEST[95:64] := SQRT(SRC[95:64)) 
DEST[127:96] := SQRT(SRC[127:96]) 
DEST[159:1 28] := SQRT(SRC[159:1 28] 
DEST[191:160] := SQRT(SRC[191:160] 
DEST[223:192] := SQRT(SRC[223:192] 
DEST[255:224] := SQRT(SRC[255:224] 


a) 


VSQRTPS (VEX.128 encoded version) 
DEST[31:0] := SQRT(SRC[31:0]) 
DEST[63:32] := SQRT(SRC[63:32)) 
DEST[95:64] := SQRT(SRC[95:64}) 
DEST[127:96] := SQRT(SRC[127:96]) 
DEST[MAXVL-1:128] := 0 


SQRTPS (128-bit Legacy SSE version) 
DEST[31:0] := SQRT(SRC[31:0]) 
DEST[63:32] := SQRT(SRC[63:32]) 
DEST[95:64] := SQRT(SRC[95:64)) 
DEST[1 27:96] := SORT(SRC[127:96]) 
DEST[MAXVL-1:128] (Unmodified) 
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VSQRTPS __m512 _mm512_sqrt_round_ps(__m512 a, int r); 
VSQRTPS __m512 _mm512_mask_sqrt_round_ps(__m512 s, 


mmask16 k, 


VSQRTPS __m512 _mm512_maskz_sqrt_round_ps(__mmask16 k, 


VSQRTPS __m256 __mm256_sqrt_ps (__m256 a); 
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m512 a, int r); 
m512 a, int r); 


VSQRTPS __m256 __mm256_mask_sqrt_ps(__m256 s,__mmask8 k,__m256 a, int r); 


VSQRTPS __m256 __mm256_maskz_sqrt_ps(__mmask8 k, 


SQRTPS __m128 _mm_sqrt_ps (__m128 a); 


VSQRTPS __m128 __mm_mask_sqrt_ps(__m128 s,__ mmask8 k, 


m256 a, int r); 


m128 a, int r); 


VSQRTPS __m128 _mm_maskz_sqrt_ps(_mmask8 k, __m128 a, int r); 


SIMD Floating-Point Exceptions 
Invalid, Precision, Denormal 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv != 1111B. 


EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 


#UD If EVEX.vvvv != 1111B. 
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SQRTSD—Compute Square Root of Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F2 OF 51/r A VIV SSE2 Computes square root of the low double-precision floating- 
SQRTSD xmm1,xmm2/m64 point value in xmm2/m64 and stores the results in xmm1. 
VEX.LIG.F2.0F.WIG 51/r B VIV AVX Computes square root of the low double-precision floating- 
VSQRTSD xmm1,xmm2, point value in xmm3/m64 and stores the results in xmm1. 
xmm3/m64 Also, upper double-precision floating-point value 
(bits[127:64]) from xmm_2 is copied to xmm1[127:64]. 
EVEX.LLIG.F2.0F.W1 51/r C VIV AVX512F Computes square root of the low double-precision floating- 
VSQRTSD xmm1 {k1}{z}, xmm2, point value in xmm3/m64 and stores the results in xmm1 
xmm3/m64{er} under writemask k1. Also, upper double-precision floating- 
point value (bits[127:64]) from xmm2 is copied to 
xmm1[127:64]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the square root of the low double-precision floating-point value in the second source operand and stores 
the double-precision floating-point result in the destination operand. The second source operand can be an XMM 
register or a 64-bit memory location. The first source and destination operands are XMM registers. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. The quadword at 
bits 127:64 of the destination operand remains unchanged. Bits (MAXVL-1:64) of the corresponding destination 
register remain unchanged. 


VEX.128 and EVEX encoded versions: Bits 127:64 of the destination operand are copied from the corresponding 
bits of the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination operand is updated according to the 
writemask. 


Software should ensure VSQRTSD is encoded with VEX.L=0. Encoding VSQRTSD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VSQRTSD (EVEX encoded version) 
IF (EVEX.b = 1) AND (SRC2 *is register*) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := SQRT(SRC2[63:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VSQRTSD (VEX.128 encoded version) 
DEST[63:0] := SQRT(SRC2[63:0]) 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


SQRTSD (128-bit Legacy SSE version) 
DEST[63:0] := SQRT(SRC[63:0]) 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSQRTSD __m128d _mm_sqrt_round_sd(__m128d a, ___m128d, int r); 

VSQRTSD __m128d _mm_mask_sqrt_round_sd(__m128d s,__mmask8 k,__m128d a, ___m128d, int r); 
VSQRTSD __m128d _mm_maskz_sqrt_round_sd(__mmask8 k,___m128d a, ___m128d, int r); 

SQRTSD __m128d __mm_sqrt_sd (__m128d a, ___m128d b) 


SIMD Floating-Point Exceptions 
Invalid, Precision, Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 
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SQRTSS—Compute Square Root of Scalar Single-Precision Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
F3 OF 51 /r A VIV SSE Computes square root of the low single-precision floating-point 
SQRTSS xmm1, xmm2/m32 value in xmm2/m32 and stores the results in xmm1. 
VEX.LIG.F3.0F.WIG 51 /r B VIV AVX Computes square root of the low single-precision floating-point 
VSQRTSS xmm1, xmm2, value in xmm3/m32 and stores the results in xmm1. Also, 
xmm3/m32 upper single-precision floating-point values (bits[127:32]) from 
xmm_2 are copied to xmm1[127:32]. 
EVEX.LLIG.F3.0F.WO 51 /r C VIV AVX512F | Computes square root of the low single-precision floating-point 
VSQRTSS xmm1 {k1}{z}, xmm2, value in xmm3/m32 and stores the results in xmm1 under 
xmm3/m32{er} writemask k1. Also, upper single-precision floating-point values 
(bits[127:32]) from xmm2 are copied to xmm1[127:32]. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the square root of the low single-precision floating-point value in the second source operand and stores 
the single-precision floating-point result in the destination operand. The second source operand can be an XMM 
register or a 32-bit memory location. The first source and destination operands is an XMM register. 


128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL- 
1:32) of the corresponding YMM destination register remain unchanged. 


VEX.128 and EVEX encoded versions: Bits 127:32 of the destination operand are copied from the corresponding 
bits of the first source operand. Bits (MAXVL-1:128) of the destination ZMM register are zeroed. 


EVEX encoded version: The low doubleword element of the destination operand is updated according to the 


writemask. 


Software should ensure VSQRTSS is encoded with VEX.L=0. Encoding VSQRTSS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 
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Operation 


VSQRTSS (EVEX encoded version) 
IF (EVEX.b = 1) AND (SRC2 *is register*) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := SQRT(SRC2[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VSQRTSS (VEX.128 encoded version) 
DEST[31:0] := SQRT(SRC2[31:0]) 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


SQRTSS (128-bit Legacy SSE version) 
DEST[31:0] := SQRT(SRC2[31:0]) 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSQRTSS __m128 _mm_sqrt_round_ss(__m128 a, __m128, int r); 

VSQRTSS __m128 _mm_mask_sqrt_round_ss(__m128 s,__mmask8 k,___m128 a, _m128, int r); 
VSQRTSS __m128 _mm_maskz_sqrt_round_ss(___mmask8 k, __m128 a,__m128, int r); 
SQRTSS __m128 __mm_sqrt_ss(__m128 a) 


SIMD Floating-Point Exceptions 
Invalid, Precision, Denormal 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions”. 


SQRTSS—Compute Square Root of Scalar Single-Precision Value 


Vol. 2B 


4-661 


INSTRUCTION SET REFERENCE, M-U 


STAC—Set AC Flag in EFLAGS Register 


Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
NP OF 01 CB ZO VN SMAP Set the AC flag in the EFLAGS register. 
STAC 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Sets the AC flag bit in EFLAGS register. This may enable alignment checking of user-mode data accesses. This 
allows explicit supervisor-mode data accesses to user-mode pages even if the SMAP bit is set in the CR4 register. 


This instruction's operation is the same in non-64-bit modes and 64-bit mode. Attempts to execute STAC when 
CPL > 0 cause #UD. 


Operation 


EFLAGS.AC := 1; 


Flags Affected 
AC set. Other flags are unaffected. 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


Virtual-8086 Mode Exceptions 
#UD The STAC instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If the CPL > 0. 
If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
F9 STC ZO | Valid Valid Set CF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Sets the CF flag in the EFLAGS register. Operation is the same in all modes. 


Operation 
CF := 1; 


Flags Affected 


The CF flag is set. The OF, ZF, SF, AF, and PF flags are unaffected. 


Exceptions (All Operating Modes) 


#UD 


STC—Set Carry Flag 


If the LOCK prefix is used. 
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STD—Set Direction Flag 


Opcode Instruction Op/ | 64-bit Compat/ |Description 
En |Mode Leg Mode 
FD STD ZO | Valid Valid Set DF flag. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Sets the DF flag in the EFLAGS register. When the DF flag is set to 1, string operations decrement the index regis- 
ters (ESI and/or EDI). Operation is the same in all modes. 


Operation 
DF := 1; 


Flags Affected 


The DF flag is set. The CF, OF, ZF, SF, AF, and PF flags are unaffected. 


Exceptions (All Operating Modes) 


#UD 


4-664 Vol. 2B 


If the LOCK prefix is used. 


STD—Set Direction Flag 


INSTRUCTION SET REFERENCE, M-U 


STl—Set Interrupt Flag 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
FB STI ZO | Valid Valid Set interrupt flag; external, maskable 
interrupts enabled at the end of the next 
instruction. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


In most cases, STI sets the interrupt flag (IF) in the EFLAGS register. This allows the processor to respond to mask- 
able hardware interrupts. 


If IF = 0, maskable hardware interrupts remain inhibited on the instruction boundary following an execution of STI. 
(The delayed effect of this instruction is provided to allow interrupts to be enabled just before returning from a 
procedure or subroutine. For instance, if an STI instruction is followed by an RET instruction, the RET instruction is 
allowed to execute before external interrupts are recognized. No interrupts can be recognized if an execution of CLI 
immediately follow such an execution of STI.) The inhibition ends after delivery of another event (e.g., exception) 
or the execution of the next instruction. 


The IF flag and the STI and CLI instructions do not prohibit the generation of exceptions and nonmaskable inter- 
rupts (NMIs). However, NMIs (and system-management interrupts) may be inhibited on the instruction boundary 
following an execution of STI that begins with IF = 0. 


Operation is different in two modes defined as follows: 
¢ PVI mode (protected-mode virtual interrupts): CRO.PE = 1, EFLAGS.VM = 0, CPL = 3, and CR4.PVI = 1; 
° VME mode (virtual-8086 mode extensions): CRO.PE = 1, EFLAGS.VM = 1, and CR4.VME = 1. 


If IOPL < 3, EFLAGS.VIP = 1, and either VME mode or PVI mode is active, STI sets the VIF flag in the EFLAGS 
register, leaving IF unaffected. 


Table 4-24 indicates the action of the STI instruction depending on the processor operating mode, IOPL, CPL, and 
EFLAGS.VIP. 


Table 4-24. Decision Table for STI Results 


Mode IOPL EFLAGS.VIP STI Result 
Real-address x! X IF=1 
Protected, not PVI@ ai ‘ a 
<CPL X #GP fault 
3 X IF =1 
Protected, PVI? as 0 VIF = 1 
1 #GP fault 
Virtual-8086, not VME? : * — 
0-2 X #GP fault 
3 X IF = 1 
Virtual-8086, VME? ae 0 VIF = 1 
1 #GP fault 


NOTES: 
1. X = This setting has no effect on instruction operation. 
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2. For this table, “protected mode” applies whenever CRO.PE = 1 and EFLAGS.VM = 0; it includes compatibility mode and 64-bit mode. 
3. PVI mode and virtual-8086 mode each imply CPL = 3. 


Operation 


IF CRO.PE = O (* Executing in real-address mode *) 
THEN IF := 1; (* Set Interrupt Flag *) 
ELSE 
IF IOPL > CPL (* CPL = 3 if EFLAGS.VM = 1 *) 
THEN IF := 1; (* Set Interrupt Flag *) 


ELSE 
IF VME mode OR PVI mode 
THEN 
IF EFLAGS.VIP = 0 
THEN VIF := 1; (* Set Virtual Interrupt Flag *) 
ELSE #GP(0); 
FI; 
ELSE #GP(0); 
FI; 
FI; 
FI; 
Flags Affected 


Either the IF flag or the VIF flag is set to 1. Other flags are unaffected. 


Protected Mode Exceptions 


#GP(0) If CPL is greater than IOPL and PVI mode is not active. 
If CPL is greater than IOPL and EFLAGS.VIP = 1. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If IOPL is less than 3 and VME mode is not active. 
If IOPLis less than 3 and EFLAGS.VIP = 1. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 


4-666 Vol. 2B STl—Set Interrupt Flag 


STMXCSR—Store MXCSR Register State 


INSTRUCTION SET REFERENCE, M-U 


Opcode*/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF AE /3 M VIV SSE Store contents of MXCSR register to m32. 
STMXCSR m32 
VEX.LZ.0F.WIG AE /3 M VV AVX Store contents of MXCSR register to m32. 
VSTMXCSR m32 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the contents of the MXCSR control and status register to the destination operand. The destination operand 
is a 32-bit memory location. The reserved bits in the MXCSR register are stored as Os. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


VEX.L must be 0, otherwise instructions will #UD. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 
m32 := MXCSR; 


Intel C/C++ Compiler Intrinsic Equivalent 


_mm_getcsr(void) 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


See Table 2-22, “Type 5 Class Exception Conditions”; additionally: 


#UD If VEX.L= 1, 
If VEX.vvvv # 1111B. 
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STOS/STOSB/STOSW/STOSD/STOSQ—Store String 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

AA STOS m8 NA | Valid Valid For legacy mode, store AL at address ES:(€)DI; 
For 64-bit mode store AL at address RDI or 
EDI. 

AB STOS m16 NA | Valid Valid For legacy mode, store AX at address ES:(E)DI; 
For 64-bit mode store AX at address RDI or 
EDI. 

AB STOS m32 NA | Valid Valid For legacy mode, store EAX at address 
ES:(€)DI; For 64-bit mode store EAX at address 
RDI or EDI. 

REX.W + AB STOS m64 NA | Valid N.E. Store RAX at address RDI or EDI. 

AA STOSB NA | Valid Valid For legacy mode, store AL at address ES:(€)DI; 
For 64-bit mode store AL at address RDI or 
EDI. 

AB STOSW NA | Valid Valid For legacy mode, store AX at address ES:(E)DI; 
For 64-bit mode store AX at address RDI or 
EDI. 

AB STOSD NA | Valid Valid For legacy mode, store EAX at address 
ES:(€)DI; For 64-bit mode store EAX at address 
RDI or EDI. 

REX.W + AB STOSQ NA | Valid N.E. Store RAX at address RDI or EDI. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
NA NA NA NA NA 
Description 


In non-64-bit and default 64-bit mode; stores a byte, word, or doubleword from the AL, AX, or EAX register 
(respectively) into the destination operand. The destination operand is a memory location, the address of which is 
read from either the ES:EDI or ES:DI register (depending on the address-size attribute of the instruction and the 
mode of operation). The ES segment cannot be overridden with a segment override prefix. 


At the assembly-code level, two forms of the instruction are allowed: the “explicit-operands” form and the “no- 
operands” form. The explicit-operands form (specified with the STOS mnemonic) allows the destination operand to 
be specified explicitly. Here, the destination operand should be a symbol that indicates the size and location of the 
destination value. The source operand is then automatically selected to match the size of the destination operand 
(the AL register for byte operands, AX for word operands, EAX for doubleword operands). The explicit-operands 
form is provided to allow documentation; however, note that the documentation provided by this form can be 
misleading. That is, the destination operand symbol must specify the correct type (size) of the operand (byte, 
word, or doubleword), but it does not have to specify the correct location. The location is always specified by the 
ES:(E)DI register. These must be loaded correctly before the store string instruction is executed. 


The no-operands form provides “short forms” of the byte, word, doubleword, and quadword versions of the STOS 
instructions. Here also ES:(E)DI is assumed to be the destination operand and AL, AX, or EAX is assumed to be the 
source operand. The size of the destination and source operands is selected by the mnemonic: STOSB (byte read 
from register AL), STOSW (word from AX), STOSD (doubleword from EAX). 


After the byte, word, or doubleword is transferred from the register to the memory location, the (E)DI register is 
incremented or decremented according to the setting of the DF flag in the EFLAGS register. If the DF flag is 0, the 
register is incremented; if the DF flag is 1, the register is decremented (the register is incremented or decremented 
by 1 for byte operations, by 2 for word operations, by 4 for doubleword operations). 


4-668 Vol. 2B STOS/STOSB/STOSW/STOSD/STOSQ—Store String 


INSTRUCTION SET REFERENCE, M-U 


NOTE: To improve performance, more recent processors support modifications to the processor’s operation during 
the string store operations initiated with STOS and STOSB. See Section 7.3.9.3 in the Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 1 for additional information on fast-string operation. 


In 64-bit mode, the default address size is 64 bits, 32-bit address size is supported using the prefix 67H. Using a 
REX prefix in the form of REX.W promotes operation on doubleword operand to 64 bits. The promoted no-operand 
mnemonic is STOSQ. STOSQ (and its explicit operands variant) store a quadword from the RAX register into the 
destination addressed by RDI or EDI. See the summary chart at the beginning of this section for encoding data and 
limits. 

The STOS, STOSB, STOSW, STOSD, STOSQ instructions can be preceded by the REP prefix for block stores of ECX 
bytes, words, or doublewords. More often, however, these instructions are used within a LOOP construct because 
data needs to be moved into the AL, AX, or EAX register before it can be stored. See “REP/REPE/REPZ 
/REPNE/REPNZ—Repeat String Operation Prefix” in this chapter for a description of the REP prefix. 


Operation 
Non-64-bit Mode: 


IF (Byte store) 
THEN 
DEST := AL; 
THEN IF DF = 0 
THEN (€)DI := (E)DI + 1; 
ELSE (€)DI := (€)DI - 1; 
Fl; 
ELSE IF (Word store) 
THEN 
DEST := AX; 
THEN IF DF = 0 
THEN (€)DI := (E)DI + 2; 
ELSE (€)DI := (€)DI - 2; 
Fl; 
Fl; 
ELSE IF (Doubleword store) 
THEN 
DEST := EAX; 
THEN IF DF = 0 
THEN (€)DI := (E)DI + 4; 
ELSE (€)DI := (€)DI - 4; 
Fl; 
Fl; 
FI; 


64-bit Mode: 


IF (Byte store) 
THEN 
DEST := AL; 
THEN IF DF = 0 
THEN (RJE)DI := (RJE)DI + 1; 
ELSE (RIE)DI := (RJE)DI - 1; 
Fl; 
ELSE IF (Word store) 
THEN 
DEST := AX; 
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THEN IF DF = 0 
THEN (RIE)DI := (RIE)DI + 2; 
ELSE (RIE)DI := (RIE)DI - 2; 


Fl; 
FI; 
ELSE IF (Doubleword store) 
THEN 
DEST := EAX; 
THEN IF DF = 0 
THEN (RIE)DI := (RJE)DI + 4; 
ELSE (RIE)DI := (RIE)DI - 4; 
FI; 
FI; 
ELSE IF (Quadword store using REX.W ) 
THEN 
DEST := RAX; 
THEN IF DF = 0 
THEN (RIE)DI := (RJE)DI + 8; 
ELSE (RIE)DI := (RIE)DI - 8; 
Fl; 
FI; 
FI; 
Flags Affected 
None. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the limit of the ES segment. 
If the ES register contains a NULL segment selector. 

#PF(fault-code) If a page fault occurs. 


#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP If a memory operand effective address is outside the ES segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the ES segment limit. 
#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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STR—Store Task Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 00/1 STR r/m16 M Valid Valid Stores segment selector from TR in r/m16. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Stores the segment selector from the task register (TR) in the destination operand. The destination operand can be 
a general-purpose register or a memory location. The segment selector stored with this instruction points to the 
task state segment (TSS) for the currently running task. 


When the destination operand is a 32-bit register, the 16-bit segment selector is copied into the lower 16 bits of the 
register and the upper 16 bits of the register are cleared. When the destination operand is a memory location, the 
segment selector is written to memory as a 16-bit quantity, regardless of operand size. 


In 64-bit mode, operation is the same. The size of the memory operand is fixed at 16 bits. In register stores, the 2- 
byte TR is zero extended if stored to a 64-bit register. 


The STR instruction is useful only in operating-system software. It can only be executed in protected mode. 


Operation 
DEST := TR(SegmentSelector); 


Flags Affected 


None. 


Protected Mode Exceptions 


#GP(0) If the destination is a memory operand that is located in a non-writable segment or if the 
effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 


selector. 
If CR4.UMIP = 1 and CPL > O. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If a page fault occurs. 
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The STR instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The STR instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 
If CR4.UMIP = 1 and CPL > O. 

#SS(0) If the stack address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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SUB—Subtract 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

2C ib SUB AL, imm8 | Valid Valid Subtract imm8 from AL. 

2D iw SUB AX, imm16 | Valid Valid Subtract imm16 from AX. 

2D id SUB EAX, imm32 | Valid Valid Subtract imm32 from EAX. 

REX.W + 2D id SUB RAX, imm32 | Valid N.E. Subtract imm32 sign-extended to 64-bits 
from RAX. 

80/5 ib SUB r/m8, imm8 MI Valid Valid Subtract imm8 from r/m8. 

REX + 80 /5 ib SUB r/m8*, imm8 MI Valid N.E. Subtract imm8 from r/m8. 

81/5 iw SUB r/m16, imm16 MI Valid Valid Subtract imm16 from r/m76. 

81 /5 id SUB r/m32, imm32 MI Valid Valid Subtract imm32 from r/m32. 

REX.W + 81 /5 id SUB r/m64, imm32 MI Valid N.E. Subtract imm32 sign-extended to 64-bits 
from r/m64. 

83 /5 ib SUB r/m16, imm8 MI Valid Valid Subtract sign-extended imm8 from r/m16. 

83 /5 ib SUB r/m32, imm8 MI Valid Valid Subtract sign-extended imm8 from r/m32. 

REX.W + 83 /5 ib SUB r/m64, imm8 MI Valid N.E. Subtract sign-extended imm8 from r/m64. 

28 /r SUB r/m8, r8 MR | Valid Valid Subtract r8 from r/m8. 

REX + 28 /r SUB r/m8&*, r8* MR | Valid N.E. Subtract r8 from r/m8. 

29/r SUB r/m16, r16 MR | Valid Valid Subtract 776 from r/m16. 

29/r SUB r/m32, r32 MR | Valid Valid Subtract r32 from r/m32. 

REX.W + 29 /r SUB r/m64, r64 MR | Valid N.E. Subtract r64 from r/m64. 

2A/r SUB r8, r/m8& RM_ | Valid Valid Subtract r/m8 from ré. 

REX + 2A/r SUB r8*, r/m8* RM | Valid N.E. Subtract r/m8 from ré. 

2B/r SUB 716, r/m16 RM_ | Valid Valid Subtract r/m16 from r76. 

2B/r SUB r32, r/m32 RM_ | Valid Valid Subtract r/m32 from r32. 

REX.W + 2B /r SUB r64, r/m64 RM | Valid N.E. Subtract r/m64 from r64. 

NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Subtracts the second operand (source operand) from the first operand (destination operand) and stores the result 
in the destination operand. The destination operand can be a register or a memory location; the source operand 
can be an immediate, register, or memory location. (However, two memory operands cannot be used in one 
instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination 
operand format. 
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The SUB instruction performs integer subtraction. It evaluates the result for both signed and unsigned integer 
operands and sets the OF and CF flags to indicate an overflow in the signed or unsigned result, respectively. The SF 
flag indicates the sign of the signed result. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


Operation 
DEST := (DEST - SRC); 


Flags Affected 
The OF, SF, ZF, AF, PF, and CF flags are set according to the result. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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SUBPD—Subtract Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
66 OF 5C /r A VIV SSE2 Subtract packed double-precision floating-point values 
SUBPD xmm1, xmm2/m128 in xmm2/mem from xmm1 and store result in xmm1. 
VEX.128.66.0F.WIG 5C /r B VV AVX Subtract packed double-precision floating-point values 
VSUBPD xmm1,xmm_2, xmm3/m128 in xmm3/mem from xmm2 and store result in xmm1. 
VEX.256.66.0F.WIG SC /r B VV AVX Subtract packed double-precision floating-point values 
VSUBPD ymm1, ymm2, ymm3/m256 in ymm3/mem from ymmz and store result in ymm1. 
EVEX.128.66.0F.W1 5C /r C VIV AVX512VL | Subtract packed double-precision floating-point values 
VSUBPD xmm1 {k1}{z}, xmm2, AVX512F from xmm3/m128/m64bcst to xmm_z and store result 
xmm3/m128/m64bcst in xmm1 with writemask k1. 
EVEX.256.66.0F.W1 5C /r C VIV AVX512VL | Subtract packed double-precision floating-point values 
VSUBPD ymm1 {k1}{z}, ymm2, AVX512F from ymm3/m256/m64bcst to ymm2 and store result 
ymm3/m256/m64bcst in ymm1 with writemask k1. 
EVEX.512.66.0F.W1 5C /r C VIV AVX512F Subtract packed double-precision floating-point values 
VSUBPD zmm1 {k1}{z}, zmm2, from zmm3/m512/m64bcst to zmm_2 and store result in 
zmm3/m512/m64bcst{er} zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a SIMD subtract of the two, four or eight packed double-precision floating-point values of the second 
Source operand from the first Source operand, and stores the packed double-precision floating-point results in the 
destination operand. 


VEX.128 and EVEX.128 encoded versions: The second source operand is an XMM register or an 128-bit memory 
location. The first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corre- 
sponding destination register are zeroed. 


VEX.256 and EVEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory 
location. The first source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corre- 
sponding destination register are zeroed. 


EVEX.512 encoded version: The second source operand is a ZMM register, a 512-bit memory location or a 512-bit 
vector broadcasted from a 64-bit memory location. The first source operand and destination operands are ZMM 
registers. The destination operand is conditionally updated according to the writemask. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VSUBPD (EVEX encoded versions) when src2 operand is a vector register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC1[i+63:i] - SRC2[i+63:i] 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSUBPD (EVEX encoded versions) when src2 operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) 
THEN = DEST[i+63:i] := SRC1[i+63:i] - SRC2[63:0); 
ELSE EST[i+63:i] = SRC1[i+63:i] - SRC2[i+63:i]; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSUBPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] - SRC2[63:0] 
DEST[127:64] := SRC1[127:64] - SRC2[127:64] 
DEST[191:128] := SRC1[191:128] - SRC2[191:128] 
DEST[255:192] := SRC1[255:192] - SRC2[255:192] 
DEST[MAXVL-1:256] := 0 
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VSUBPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC2[63:0] 
DEST[127:64] := SRC1[127:64] - SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


SUBPD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] - SRC[63:0] 
DEST[127:64] := DEST[127:64] - SRC[127:64] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSUBPD __m512d_mm512_sub_pd (__m512d a,__m512db); 
VSUBPD __m512d_mm512_mask_sub_pd (__m512ds, 


mmask8 k, 


m512da,__m512d b); 


VSUBPD __m512d_mm512_maskz_sub_pd (__mmask8 k,__m512da,__m512d b); 


VSUBPD __m512d_mm512_sub_round_pd (__m512d a, 


m512d , int); 


VSUBPD __m512d_mm512_mask_sub_round_pd (__m512ds,__mmask8 k,__m512d a,__m512db, int); 


VSUBPD __m512d_mm512_maskz_sub_round_pd (__mmask8 k,___m512da, 


VSUBPD __m256d __mm256_sub_pd (__m256d a, __m256d b); 
VSUBPD __m256d __mm256_mask_sub_pd (__m256d s, 


SUBPD __m128d_mm_sub_pd (__m128d a, _m128d b); 


mmask8 k, 
VSUBPD __m256d __mm256_maskz_sub_pd (__mmask8 k,__ m256d a, 


m512d b, int); 


m256d a, 
m256d b); 


m256d b); 


VSUBPD __m128d_mm_mask_sub_pd (__m128ds,__ mmask8 k,___m128d a,__m128d b); 


VSUBPD __m128d __mm_maskz_sub_pd (__mmask8 k,__m128d a, 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


m128d b); 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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SUBPS—Subtract Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 5C /r A VV SSE Subtract packed single-precision floating-point values 
SUBPS xmm1, xmm2/m128 in xmm2/mem from xmm1 and store result in xmm1. 
VEX.128.0F.WIG 5C /r B VV AVX Subtract packed single-precision floating-point values 
VSUBPS xmm1,xmm2, xmm3/m128 in xmm3/mem from xmmcz and stores result in xmm1. 
VEX.256.0F.WIG 5C /r B VIV AVX Subtract packed single-precision floating-point values 
VSUBPS ymm1, ymm2, ymm3/m256 in ymm3/mem from ymmz2 and stores result in ymm1. 
EVEX.128.0F.WO SC /r C VIV AVX512VL_ | Subtract packed single-precision floating-point values 
VSUBPS xmm1 {k1}{z}, xmm2, AVX512F from xmm3/m128/m32bcst to xmm_2 and stores 
xmm3/m128/m32bcst result in xmm1 with writemask k1. 
EVEX.256.0F.WO SC /r C VV AVX512VL_ | Subtract packed single-precision floating-point values 
VSUBPS ymm1 {k1}{z}, ymm2, AVX512F from ymm3/m256/m32bcst to ymm2 and stores 
ymm3/m256/m32bcst result in ymm1 with writemask k1. 
EVEX.512.0F.WO SC /r C VV AVX512F Subtract packed single-precision floating-point values 
VSUBPS zmm1 {k1}{z}, zmm2, in zmm3/m512/m32bcst from zmm_2 and stores result 
zmm3/m512/m32bcst{er} in zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 

B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Performs a SIMD subtract of the packed single-precision floating-point values in the second Source operand from 
the First Source operand, and stores the packed single-precision floating-point results in the destination operand. 


VEX.128 and EVEX.128 encoded versions: The second source operand is an XMM register or an 128-bit memory 
location. The first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corre- 


sponding destination register are zeroed. 


VEX.256 and EVEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory 
location. The first source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corre- 


sponding destination register are zeroed. 


EVEX.512 encoded version: The second source operand is a ZMM register, a 512-bit memory location or a 512-bit 
vector broadcasted from a 32-bit memory location. The first source operand and destination operands are ZMM 


registers. The destination operand is conditionally updated according to the writemask. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding 


register destination are unmodified. 
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Operation 


VSUBPS (EVEX encoded versions) when src2 operand is a vector register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC1[i+31:i] - SRC2[i+31:1] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VSUBPS (EVEX encoded versions) when src2 operand is a memory source 
(KL, VL) = (4, 128), (8, 256),(16, 512) 
FOR j:=0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) 
THEN = DEST[i+31:i] = SRC1[i+31:i] - SRC2[3 1:0]; 
ELSE DEST[i+31:i] = SRC1[i+31:i] - SRC2[i+31:i]; 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


VSUBPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[63:32] := SRC1[63:32] - SRC2[63:32] 
DEST[95:64] := SRC1[95:64] - SRC2[95:64] 
DEST[127:96] := SRC1[127:96] - SRC2[127:96] 
DEST[159:128] := SRC1[159:1 28] - SRC2[159:128] 
DEST[191:160] := SRC1[191:160] - SRC2[191:160] 
DEST[223:192] := SRC1[223:192] - SRC2[223:192] 
DEST[255:224] := SRC1[255:224] - SRC2[255:224]. 
DEST[MAXVL-1:256] := 0 
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VSUBPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[63:32] := SRC1[63:32] - SRC2[63:32] 
DEST[95:64] := SRC1[95:64] - SRC2[95:64] 
DEST[127:96] := SRC1[127:96] - SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


SUBPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[63:32] := SRC1[63:32] - SRC2[63:32] 
DEST[95:64] := SRC1[95:64] - SRC2[95:64] 
DEST[127:96] := SRC1[1 27:96] - SRC2[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSUBPS __m512 _mm512_sub_ps (__m512 a,__m512 b); 
VSUBPS __m512 _mm512_mask_sub_ps (_m512s, 


mmask16 k, 


m512a, 


m512 b); 


VSUBPS __m512 _mm512_maskz_sub_ps (__mmask16 k,__m512 a,__m512 b); 


VSUBPS __m512 _mm512_sub_round_ps (__m512 a, 
VSUBPS __m512 __mm512_mask_sub_round_ps (__m512 s, 
VSUBPS __m512 __mm512_maskz_sub_round_ps (__mmask16 k, 
VSUBPS __m256 _mm256_sub_ps (__m256 a,__m256 b); 

VSUBPS __m256 _mm256_mask_sub_ps (__m256 s, 


mmask8 k, 


m512 b, int); 
mmask16 k,__m512a,__m512 b, int); 


m512 a,__m512 5, int); 


m256 a,__m256 b); 


VSUBPS __m256 _mm256_maskz_sub_ps (__mmask16 k,__m256 a,__ m256 b); 


SUBPS __m128_mm_sub_ps (_m128a,__m128 b); 


VSUBPS __m128 _mm_mask_sub_ps (__m128s,__mmask8 k,_m128 a,__m128 b); 


VSUBPS __m128 _mm_maskz_sub_ps (__mmask16 k,__m128 a, 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


m128 b); 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 


EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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SUBSD—Subtract Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F2 OF 5C /r A VIV SSE2 Subtract the low double-precision floating-point value in 
SUBSD xmm1, xmm2/m64 xmm2/m64 from xmm1 and store the result in xmm1. 
VEX.LIG.F2.0F.WIG 5C /r B VIV AVX Subtract the low double-precision floating-point value in 
VSUBSD xmm1,xmm2, xmm3/m64 xmm3/m64 from xmmc2 and store the result in xmm1. 
EVEX.LLIG.F2.0F.W1 5C /r C VIV AVX512F | Subtract the low double-precision floating-point value in 
VSUBSD xmm1 {k1}{z}, xmm_2, xmm3/m64 from xmmz and store the result in xmm1 
xmm3/m64{er} under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Subtract the low double-precision floating-point value in the second source operand from the first source operand 
and stores the double-precision floating-point result in the low quadword of the destination operand. 


The second source operand can be an XMM register or a 64-bit memory location. The first source and destination 
operands are XMM registers. 


128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:64) of the 
corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded versions: Bits (127:64) of the XMM register destination are copied from corresponding 
bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination operand is updated according to the 
writemask. 


Software should ensure VSUBSD is encoded with VEX.L=0. Encoding VSUBSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 
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Operation 


VSUBSD (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN  DEST[63:0] := SRC1[63:0] - SRC2[63:0] 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VSUBSD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] - SRC2[63:0] 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


SUBSD (128-bit Legacy SSE version) 
DEST[63:0] := DEST[63:0] - SRC[63:0] 
DEST[MAXVL-1:64] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSUBSD __m128d_mm_mask_sub_sd (__m128ds,__mmask8 k,__m128d a, 
VSUBSD __m128d_mm_maskz_sub_sd (__mmask8 k,___m128d a,__m128d b); 

VSUBSD __m128d_mm_sub_round_sd (__m128d a,__m128d 5, int); 

VSUBSD __m128d_mm_mask_sub_round_sd (__m128ds,__ mmask8 k,__m128da,_m128d 5, int); 
VSUBSD __m128d _mm_maskz_sub_round_sd (__mmask8 k,__m128d a,__m128db, int); 

SUBSD __m128d __mm_sub_sd (__m128d a,___m128d b); 


m128d b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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SUBSS—Subtract Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
F3 OF 5C /r A VIV SSE Subtract the low single-precision floating-point value in 
SUBSS xmm1, xmm2/m32 xmm2/m32 from xmm1 and store the result in xmm1. 
VEX.LIG.F3.0F.WIG 5C /r B VIV AVX Subtract the low single-precision floating-point value in 
VSUBSS xmm1,xmm2, xmm3/m32 xmm3/m32 from xmm2 and store the result in xmm1. 
EVEX.LLIG.F3.0F.WO 5C /r C VV AVX512F | Subtract the low single-precision floating-point value in 
VSUBSS xmm1 {k1}{z}, xmm2, xmm3/m32 from xmmz and store the result in xmm1 
xmm3/m32{er} under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Subtract the low single-precision floating-point value from the second source operand and the first source operand 
and store the double-precision floating-point result in the low doubleword of the destination operand. 


The second source operand can be an XMM register or a 32-bit memory location. The first source and destination 
operands are XMM registers. 


128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:32) of the 
corresponding destination register remain unchanged. 


VEX.128 and EVEX encoded versions: Bits (127:32) of the XMM register destination are copied from corresponding 
bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX encoded version: The low doubleword element of the destination operand is updated according to the 
writemask. 


Software should ensure VSUBSS is encoded with VEX.L=0. Encoding VSUBSD with VEX.L=1 may encounter unpre- 
dictable behavior across different processor generations. 


4-684 Vol. 2B SUBSS—Subtract Scalar Single-Precision Floating-Point Value 


Operation 


VSUBSS (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := SRC1[31:0] - SRC2[31:0] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


VSUBSS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] - SRC2[31:0] 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


SUBSS (128-bit Legacy SSE version) 
DEST[31:0] := DEST[31:0] - SRC[31:0] 
DEST[MAXVL-1:32] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VSUBSS __m128_mm_mask_sub_ss (_m128s,__mmask8k,__m128 a, 
VSUBSS __m128_mm_maskz_sub_ss (__mmask8 k,__m128 a,__m128 b); 

VSUBSS __m128_mm_sub_round_ss (__m128 a,__m128 b, int); 

VSUBSS __m128_mm_mask_sub_round_ss (__m128s,__mmask8 k,__m128 a,__m128 5, int); 
VSUBSS __m128_mm_maskz_sub_round_ss (__mmask8 k,__m128 a,__m128, int); 

SUBSS __m128 _mm_sub_ss (_m128a,__m128 b); 


m128 b); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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SWAPGS—Swap GS Base Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 01 F8 SWAPGS ZO | Valid Invalid Exchanges the current GS base register value 
with the value contained in MSR address 
C0000102H. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


SWAPGS exchanges the current GS base register value with the value contained in MSR address CO000102H 
(IA32_KERNEL_GS_BASE). The SWAPGS instruction is a privileged instruction intended for use by system soft- 
ware. 


When using SYSCALL to implement system calls, there is no kernel stack at the OS entry point. Neither is there a 
straightforward method to obtain a pointer to kernel structures from which the kernel stack pointer could be read. 
Thus, the kernel cannot save general purpose registers or reference memory. 


By design, SWAPGS does not require any general purpose registers or memory operands. No registers need to be 
saved before using the instruction. SWAPGS exchanges the CPL 0 data pointer from the IA32_KERNEL_GS_ BASE 
MSR with the GS base register. The kernel can then use the GS prefix on normal memory references to access 
kernel data structures. Similarly, when the OS kernel is entered using an interrupt or exception (where the kernel 
stack is already set up), SWAPGS can be used to quickly get a pointer to the kernel data structures. 


The IA32_KERNEL_GS_BASE MSR itself is only accessible using RDMSR/WRMSR instructions. Those instructions 
are only accessible at privilege level 0. The WRMSR instruction ensures that the IA32_KERNEL_GS_ BASE MSR 
contains a canonical address. 


Operation 


IF CS.L # 1 (* Not in 64-Bit Mode *) 
THEN 
#UD; Fl; 


IF CPL#0 
THEN #GP(0); Fl; 


tmp := GS.base; 
GS.base := IA32_KERNEL_GS_BASE; 
IA32_KERNEL_GS_BASE := tmp; 


Flags Affected 


None 


Protected Mode Exceptions 
#UD If Mode # 64-Bit. 


Real-Address Mode Exceptions 
#UD If Mode + 64-Bit. 


Virtual-8086 Mode Exceptions 
#UD If Mode 4 64-Bit. 
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Compatibility Mode Exceptions 
#UD If Mode 4 64-Bit. 


64-Bit Mode Exceptions 
#GP(0) If CPL#0. 
#UD If the LOCK prefix is used. 
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SYSCALL—Fast System Call 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 05 SYSCALL ZO | Valid Invalid Fast call to privilege level O system 
procedures. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


SYSCALL invokes an OS system-call handler at privilege level 0. It does so by loading RIP from the IA32_LSTAR 
MSR (after saving the address of the instruction following SYSCALL into RCX). (The WRMSR instruction ensures 
that the IA32_LSTAR MSR always contain a canonical address.) 


SYSCALL also saves RFLAGS into Rii and then masks RFLAGS using the IA32_FMASK MSR (MSR address 
C0000084Hh); specifically, the processor clears in RFLAGS every bit corresponding to a bit that is set in the 
IA32_FMASK MSR. 


SYSCALL loads the CS and SS selectors with values derived from bits 47:32 of the IA32_STAR MSR. However, the 
CS and SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. 
Instead, the descriptor caches are loaded with fixed values. See the Operation section for details. It is the respon- 
sibility of OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values corre- 
spond to the fixed values loaded into the descriptor caches; the SYSCALL instruction does not ensure this 
correspondence. 


The SYSCALL instruction does not save the stack pointer (RSP). If the OS system-call handler will change the stack 
pointer, it is the responsibility of software to save the previous value of the stack pointer. This might be done prior 
to executing SYSCALL, with software restoring the stack pointer with the instruction following SYSCALL (which will 
be executed after SYSRET). Alternatively, the OS system-call handler may save the stack pointer and restore it 
before executing SYSRET. 


When shadow stacks are enabled at a privilege level where the SYSCALL instruction is invoked, the SSP is saved to 
the IA32_PL3_SSP MSR. If shadow stacks are enabled at privilege level 0, the SSP is loaded with O. Refer to 
Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Technology 
(CET)” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for additional CET details. 


Instruction ordering. Instructions following a SYSCALL may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSCALL have 
completed execution (the later instructions may execute before data stored by the earlier instructions have become 
globally visible). 


Operation 


IF (CS.L # 1 ) or (IA32_EFER.LMA 1) or (IA32_EFER.SCE # 1) 

(* Not in 64-Bit Mode or SYSCALL/SYSRET not enabled in [A32_EFER *) 
THEN #UD; 

Fl; 


RCX := RIP; (* Will contain address of next instruction *) 
RIP := [A32_LSTAR; 

R11 := RFLAGS; 

RFLAGS := RFLAGS AND NOT(IA32_FMASK); 


CS.Selector := IA32_STAR[47:32] AND FFFCH (* Operating system provides CS; RPL forced to 0 *) 
(* Set rest of CS to a fixed value *) 
CS.Base := 0; (* Flat segment *) 
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CS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
CS.Type := 11; (* Execute/read code, accessed *) 

CSS := 1; 

CS.DPL := 0; 

CS.P := 1; 

CS.L:= 1; (* Entry is to 64-bit mode *) 

CS.D := 0; (* Required if CS.L = 1 *) 

CS.G := 1; (* 4-KByte granularity *) 


IF ShadowStackEnabled(CPL) 
THEN (* adjust so bits 63:N get the value of bit N-1, where N is the CPU's maximum linear-address width *) 
IA32_PL3_SSP := LA_adjust(SSP); 
(* With shadow stacks enabled the system call is supported from Ring 3 to Ring 0 *) 
(* OS supporting Ring O to Ring O system calls or Ring 1/2 to ring O system call *) 
(* Must preserve the contents of [A32_PL3_SSP to avoid losing ring 3 state *) 
Fl; 


CPL := 0; 


IF ShadowStackEnabled(CPL) 
SSP := 0; 

FI; 

IF EndbranchEnabled(CPL) 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 


FI; 

SS.Selector := [A32_STAR[47:32] + 8; (* SS just above CS *) 

(* Set rest of SS to a fixed value *) 

SS.Base := 0; (* Flat segment *) 

SS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
SS.Type := 3; (* Read/write data, accessed *) 
SSS := 1; 

SS.DPL := 0; 

SSP := 1; 

SS.B := 1; (* 32-bit stack segment *) 
SS.G::= 1; (* 4-KByte granularity *) 
Flags Affected 

All. 


Protected Mode Exceptions 
#UD The SYSCALL instruction is not recognized in protected mode. 


Real-Address Mode Exceptions 
#UD The SYSCALL instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The SYSCALL instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD The SYSCALL instruction is not recognized in compatibility mode. 
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64-Bit Mode Exceptions 
#UD If IA32_EFER.SCE = 0. 
If the LOCK prefix is used. 
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SYSENTER—Fast System Call 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 34 SYSENTER ZO | Valid Valid Fast call to privilege level O system 
procedures. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Executes a fast call to a level O system procedure or routine. SYSENTER is a companion instruction to SYSEXIT. The 
instruction is optimized to provide the maximum performance for system calls from user code running at privilege 
level 3 to operating system or executive procedures running at privilege level 0. 


When executed in IA-32e mode, the SYSENTER instruction transitions the logical processor to 64-bit mode; other- 
wise, the logical processor remains in protected mode. 


Prior to executing the SYSENTER instruction, software must specify the privilege level 0 code segment and code 
entry point, and the privilege level 0 stack segment and stack pointer by writing values to the following MSRs: 


° IA32_SYSENTER_CS (MSR address 174H) — The lower 16 bits of this MSR are the segment selector for the 
privilege level 0 code segment. This value is also used to determine the segment selector of the privilege level 
0 stack segment (see the Operation section). This value cannot indicate a null selector. 


® IA32_SYSENTER_EIP (MSR address 176H) — The value of this MSR is loaded into RIP (thus, this value 
references the first instruction of the selected operating procedure or routine). In protected mode, only 
bits 31:0 are loaded. 


¢ IA32_SYSENTER_ESP (MSR address 175H) — The value of this MSR is loaded into RSP (thus, this value 
contains the stack pointer for the privilege level 0 stack). This value cannot represent a non-canonical address. 
In protected mode, only bits 31:0 are loaded. 


These MSRs can be read from and written to using RDMSR/WRMSR. The WRMSR instruction ensures that the 
IA32_SYSENTER_EIP and IA32_SYSENTER_ESP MSRs always contain canonical addresses. 


While SYSENTER loads the CS and SS selectors with values derived from the IA32_SYSENTER_CS MSR, the CS and 
SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. Instead, 
the descriptor caches are loaded with fixed values. See the Operation section for details. It is the responsibility of 
OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values correspond to the 
fixed values loaded into the descriptor caches; the SYSENTER instruction does not ensure this correspondence. 


The SYSENTER instruction can be invoked from all operating modes except real-address mode. 


The SYSENTER and SYSEXIT instructions are companion instructions, but they do not constitute a call/return pair. 
When executing a SYSENTER instruction, the processor does not save state information for the user code (e.g., the 
instruction pointer), and neither the SYSENTER nor the SYSEXIT instruction supports passing parameters on the 
stack. 


To use the SYSENTER and SYSEXIT instructions as companion instructions for transitions between privilege level 3 
code and privilege level 0 operating system procedures, the following conventions must be followed: 


¢ The segment descriptors for the privilege level 0 code and stack segments and for the privilege level 3 code and 
stack segments must be contiguous in a descriptor table. This convention allows the processor to compute the 
segment selectors from the value entered in the SYSENTER_CS_MSR MSR. 


° The fast system call “stub” routines executed by user code (typically in shared libraries or DLLS) must save the 
required return IP and processor state information if a return to the calling procedure is required. Likewise, the 
operating system or executive procedures called with SYSENTER instructions must have access to and use this 
saved return and state information when returning to the user code. 
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The SYSENTER and SYSEXIT instructions were introduced into the IA-32 architecture in the Pentium II processor. 
The availability of these instructions on a processor is indicated with the SYSENTER/SYSEXIT present (SEP) feature 
flag returned to the EDX register by the CPUID instruction. An operating system that qualifies the SEP flag must 
also qualify the processor family and model to ensure that the SYSENTER/SYSEXIT instructions are actually 
present. For example: 


IF CPUID SEP bit is set 
THEN IF (Family = 6) and (Model < 3) and (Stepping < 3) 
THEN 
SYSENTER/SYSEXIT_Not_Supported; FI; 
ELSE 
SYSENTER/SYSEXIT_Supported; FI; 
Fl; 


When the CPUID instruction is executed on the Pentium Pro processor (model 1), the processor returns a the SEP 
flag as set, but does not support the SYSENTER/SYSEXIT instructions. 


When shadow stacks are enabled at privilege level where SYSENTER instruction is invoked, the SSP is saved to the 
IA32_PL3_SSP MSR. If shadow stacks are enabled at privilege level 0, the SSP is loaded with 0. Refer to Chapter 6, 
“Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement Technology (CET)” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for additional CET details. 


Instruction ordering. Instructions following a SYSENTER may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSENTER have 
completed execution (the later instructions may execute before data stored by the earlier instructions have become 
globally visible). 


Operation 
IF CRO.PE = 0 OR IA32_SYSENTER_CS[15:2] = 0 THEN #GP(0); Fl; 


RFLAGS.VM := 0; (* Ensures protected mode execution *) 
RFLAGSL.IF := 0; (* Mask interrupts *) 
IF in IA-32e mode 

THEN 


RSP := IA32_SYSENTER_ESP; 
RIP := IA32_SYSENTER_EIP; 
ELSE 
ESP := IA32_SYSENTER_ESP[31:0]; 
EIP := |A32_SYSENTER_EIP[31:0]; 
Fl; 


CS.Selector := [A32_SYSENTER_CS[15:0] AND FFFCH; 
(* Operating system provides CS; RPL forced to 0 *) 
(* Set rest of CS to a fixed value *) 


CS.Base := 0; (* Flat segment *) 
CS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
CS.Type := 11; (* Execute/read code, accessed *) 
CSS := 1; 
CS.DPL := 0; 
CS.P := 1; 
IF in IA-32e mode 
THEN 
CS.L:= 1; (* Entry is to 64-bit mode *) 
CS.D := 0; (* Required if CS.L = 1 *) 
ELSE 
CS.L := 0; 
CS.D:= 1; (* 32-bit code segment”) 
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FI; 
CS.G:= 1; (* 4-KByte granularity *) 


IF ShadowStackEnabled(CPL) 
THEN 
IF IA32_EFER.LMA = 0 
THEN IA32_PL3_SSP := SSP; 
ELSE (* adjust so bits 63:N get the value of bit N-1, where N is the CPU’s maximum linear-address width *) 
IA32_PL3_SSP := LA_adjust(SSP); 
Fl; 
FI; 


CPL := 0; 


IF ShadowStackEnabled(CPL) 
SSP := 0; 

FI; 

IF EndbranchEnabled(CPL) 
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH 
IA32_S_CET.SUPPRESS = 0 


FI; 

SS.Selector := CS.Selector + 8; (* SS just above CS *) 

(* Set rest of SS to a fixed value *) 

SS.Base := 0; (* Flat segment *) 

SS. Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
SS.Type := 3; (* Read/write data, accessed *) 
SSS := 1; 

SS.DPL := 0; 

SSP := 1; 

SS.B := 1; (* 32-bit stack segment*) 
SS.G:= 1; (* 4-KByte granularity *) 
Flags Affected 


VM, IF (see Operation above) 


Protected Mode Exceptions 
#GP(0) If IA32_SYSENTER_CS[15:2] = 0. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP The SYSENTER instruction is not recognized in real-address mode. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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SYSEXIT—Fast Return from Fast System Call 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 35 SYSEXIT ZO | Valid Valid Fast return to privilege level 3 user code. 
REX.W + OF 35 SYSEXIT ZO | Valid Valid Fast return to 64-bit mode privilege level 3 
user code. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Executes a fast return to privilege level 3 user code. SYSEXIT is a companion instruction to the SYSENTER instruc- 
tion. The instruction is optimized to provide the maximum performance for returns from system procedures 
executing at protections levels 0 to user procedures executing at protection level 3. It must be executed from code 
executing at privilege level 0. 


With a 64-bit operand size, SYSEXIT remains in 64-bit mode; otherwise, it either enters compatibility mode (if the 
logical processor is in IA-32e mode) or remains in protected mode (if it is not). 


Prior to executing SYSEXIT, software must specify the privilege level 3 code segment and code entry point, and the 

privilege level 3 stack segment and stack pointer by writing values into the following MSR and general-purpose 

registers: 

° IA32_SYSENTER_CS (MSR address 174H) — Contains a 32-bit value that is used to determine the segment 
selectors for the privilege level 3 code and stack segments (see the Operation section) 


¢ RDX — The canonical address in this register is loaded into RIP (thus, this value references the first instruction 
to be executed in the user code). If the return is not to 64-bit mode, only bits 31:0 are loaded. 


° ECX — The canonical address in this register is loaded into RSP (thus, this value contains the stack pointer for 
the privilege level 3 stack). If the return is not to 64-bit mode, only bits 31:0 are loaded. 


The IA32_SYSENTER_CS MSR can be read from and written to using RDMSR and WRMSR. 


While SYSEXIT loads the CS and SS selectors with values derived from the IA32_SYSENTER_CS MSR, the CS and 
SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. Instead, 
the descriptor caches are loaded with fixed values. See the Operation section for details. It is the responsibility of 
OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values correspond to the 
fixed values loaded into the descriptor caches; the SYSEXIT instruction does not ensure this correspondence. 


The SYSEXIT instruction can be invoked from all operating modes except real-address mode and virtual-8086 
mode. 


The SYSENTER and SYSEXIT instructions were introduced into the IA-32 architecture in the Pentium II processor. 
The availability of these instructions on a processor is indicated with the SYSENTER/SYSEXIT present (SEP) feature 
flag returned to the EDX register by the CPUID instruction. An operating system that qualifies the SEP flag must 
also qualify the processor family and model to ensure that the SYSENTER/SYSEXIT instructions are actually 
present. For example: 


IF CPUID SEP bit is set 
THEN IF (Family = 6) and (Model < 3) and (Stepping < 3) 
THEN 
SYSENTER/SYSEXIT_Not_Supported; FI; 
ELSE 
SYSENTER/SYSEXIT_Supported; FI; 
Fl; 
When the CPUID instruction is executed on the Pentium Pro processor (model 1), the processor returns a the SEP 
flag as set, but does not support the SYSENTER/SYSEXIT instructions. 
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When shadow stacks are enabled at privilege level 3 the instruction loads SSP with value from IA32_PL3_SSP MSR. 
Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement 
Technology (CET)” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for additional 
CET details. 


Instruction ordering. Instructions following a SYSEXIT may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSEXIT have 
completed execution (the later instructions may execute before data stored by the earlier instructions have 
become globally visible). 


Operation 
IF IA32_SYSENTER_CS[15:2] = 0 OR CRO.PE = 0 OR CPL# O THEN #GP(0); Fl; 


IF operand size is 64-bit 
THEN = (* Return to 64-bit mode *) 


RSP := RCX; 
RIP := RDX; 
ELSE (* Return to protected mode or compatibility mode *) 
RSP := ECX; 
RIP := EDX; 
Fl; 
IF operand size is 64-bit (* Operating system provides CS; RPL forced to 3 *) 
THEN CS.Selector := IA32_SYSENTER_CS[15:0] + 32; 
ELSE CS.Selector := IA32_SYSENTER_CS[15:0] + 16; 
Fl; 
CS.Selector := CS.Selector OR 3; (* RPL forced to 3 *) 
(* Set rest of CS to a fixed value *) 
CS.Base := 0; (* Flat segment *) 
CS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
CS.Type := 11; (* Execute/read code, accessed *) 
CSS := 1; 
CS.DPL := 3; 
CS.P := 1; 


IF operand size is 64-bit 
THEN = (* return to 64-bit mode *) 


CS.L:= 1; (* 64-bit code segment *) 
CS.D := 0; (* Required if CS.L = 1 *) 
ELSE (* return to protected mode or compatibility mode *) 
CS.L:= 0; 
CS.D:= 1; (* 32-bit code segment”*) 
Fl; 
CS.G := 1; (* 4-KByte granularity *) 
CPL := 3; 


IF ShadowStackEnabled(CPL) 
THEN SSP := [A32_PL3_SSP; 


FI; 

SS.Selector := CS.Selector + 8; (* SS just above CS *) 

(* Set rest of SS to a fixed value *) 

SS.Base := 0; (* Flat segment *) 

SS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
SS.Type := 3; (* Read/write data, accessed *) 

SSS := 1; 

SS.DPL := 3; 
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SS.P := 1; 

SS.B := 1; (* 32-bit stack segment*) 
SS.G := 1; (* 4-KByte granularity *) 
Flags Affected 

None. 


Protected Mode Exceptions 


#GP(0) If IA32_SYSENTER_CS[15:2] = 0. 
If CPL 40. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#GP The SYSEXIT instruction is not recognized in real-address mode. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The SYSEXIT instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) If IA32_SYSENTER_CS = 0. 

If CPL 40. 

If RCX or RDX contains a non-canonical address. 
#UD If the LOCK prefix is used. 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 07 SYSRET ZO | Valid Invalid Return to compatibility mode from fast 
system call 
REX.W + OF 07 SYSRET ZO | Valid Invalid Return to 64-bit mode from fast system call 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


SYSRET is a companion instruction to the SYSCALL instruction. It returns from an OS system-call handler to user 
code at privilege level 3. It does so by loading RIP from RCX and loading RFLAGS from R11.! With a 64-bit operand 
size, SYSRET remains in 64-bit mode; otherwise, it enters compatibility mode and only the low 32 bits of the regis- 
ters are loaded. 


SYSRET loads the CS and SS selectors with values derived from bits 63:48 of the IA32_STAR MSR. However, the 
CS and SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. 
Instead, the descriptor caches are loaded with fixed values. See the Operation section for details. It is the respon- 
sibility of OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values corre- 
spond to the fixed values loaded into the descriptor caches; the SYSRET instruction does not ensure this 
correspondence. 


The SYSRET instruction does not modify the stack pointer (ESP or RSP). For that reason, it is necessary for soft- 
ware to switch to the user stack. The OS may load the user stack pointer (if it was saved after SYSCALL) before 
executing SYSRET; alternatively, user code may load the stack pointer (if it was saved before SYSCALL) after 
receiving control from SYSRET. 


If the OS loads the stack pointer before executing SYSRET, it must ensure that the handler of any interrupt or 
exception delivered between restoring the stack pointer and successful execution of SYSRET is not invoked with the 
user stack. It can do so using approaches such as the following: 


¢ External interrupts. The OS can prevent an external interrupt from being delivered by clearing EFLAGS.IF 
before loading the user stack pointer. 


¢ Nonmaskable interrupts (NMIs). The OS can ensure that the NMI handler is invoked with the correct stack by 
using the interrupt stack table (IST) mechanism for gate 2 (NMI) in the IDT (see Section 6.14.5, “Interrupt 
Stack Table,” in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). 


° General-protection exceptions (#GP). The SYSRET instruction generates #GP(0) if the value of RCX is not 
canonical. The OS can address this possibility using one or more of the following approaches: 


— Confirming that the value of RCX is canonical before executing SYSRET. 
— Using paging to ensure that the SYSCALL instruction will never save a non-canonical value into RCX. 
— Using the IST mechanism for gate 13 (#GP) in the IDT. 


When shadow stacks are enabled at privilege level 3 the instruction loads SSP with value from IA32_PL3_SSP MSR. 
Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 18, “Control-Flow Enforcement 
Technology (CET)” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for additional 
CET details. 


1. Regardless of the value of R11, the RF and VM flags are always O in RFLAGS after execution of SYSRET. In addition, all reserved bits 
in RFLAGS retain the fixed values. 
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Instruction ordering. Instructions following a SYSRET may be fetched from memory before earlier instructions 
complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSRET have 
completed execution (the later instructions may execute before data stored by the earlier instructions have become 


globally visible). 


Operation 


IF (CS.L# 1 ) or (IA32_EFER.LMA # 1) or (IA32_EFERSCE ¥ 1) 

(* Not in 64-Bit Mode or SYSCALL/SYSRET not enabled in |A32_EFER *) 
THEN #UD; Fl; 

IF (CPL # 0) THEN #GP(O); Fl; 


IF (operand size is 64-bit) 
THEN (* Return to 64-Bit Mode *) 
IF (RCX is not canonical) THEN #GP(0); 
RIP := RCX; 
ELSE (* Return to Compatibility Mode *) 
RIP := ECX; 
FI; 
RFLAGS := (R11 & 3C7FD7H) | 2; (* Clear RF, VM, reserved bits; set bit 1 *) 


IF (operand size is 64-bit) 
THEN CS.Selector := 1[A32_STAR[63:48]+16; 
ELSE CS.Selector := [A32_STAR[63:48]; 
FI; 
CS.Selector := CS.Selector OR 3; (* RPL forced to 3 *) 
(* Set rest of CS to a fixed value *) 
CS.Base := 0; (* Flat segment *) 
CS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
CS.Type := 11; (* Execute/read code, accessed *) 
CSS := 1; 
CS.DPL := 3; 
CSP := 1; 
IF (operand size is 64-bit) 
THEN (* Return to 64-Bit Mode *) 


CS.L:= 1; (* 64-bit code segment *) 
CS.D := 0; (* Required if CS.L = 1 *) 
ELSE (* Return to Compatibility Mode *) 
CS.L:= 0; (* Compatibility mode *) 
CS.D:= 1; (* 32-bit code segment *) 
FI; 
CS.G := 1; (* 4-KByte granularity *) 
CPL := 3; 


IF ShadowStackEnabled(CPL) 
SSP := IA32_PL3_SSP; 
FI; 


SS.Selector := (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *) 
(* Set rest of SS to a fixed value *) 


SS.Base := 0; (* Flat segment *) 

SS.Limit := FFFFFH; (* With 4-KByte granularity, implies a 4-GByte limit *) 
SS.Type := 3; (* Read/write data, accessed *) 

SSS := 1; 

SS.DPL := 3; 

SSP := 1; 

SS.B := 1; (* 32-bit stack segment*) 
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SS.G := 1; (* 4-KByte granularity *) 
Flags Affected 
All. 


Protected Mode Exceptions 
#UD The SYSRET instruction is not recognized in protected mode. 


Real-Address Mode Exceptions 
#UD The SYSRET instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The SYSRET instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD The SYSRET instruction is not recognized in compatibility mode. 


64-Bit Mode Exceptions 


#UD If IA32_EFER.SCE = 0. 
If the LOCK prefix is used. 
#GP(0) If CPL#0. 


If the return is to 64-bit mode and RCX contains a non-canonical address. 
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TEST—Logical Compare 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

A8 ib TEST AL, imm8& | Valid Valid AND imm8 with AL; set SF, ZF, PF according to 
result. 

AS iw TEST AX, imm16 | Valid Valid AND imm76 with AX; set SF, ZF, PF according 
to result. 

AQ id TEST EAX, imm32 | Valid Valid AND imm32 with EAX; set SF, ZF, PF according 
to result. 

REX.W + AQ id TEST RAX, imm32 | Valid N.E. AND imm32 sign-extended to 64-bits with 
RAX; set SF, ZF, PF according to result. 

F6 /O ib TEST r/m8, imm8 MI Valid Valid AND imm8 with r/m&; set SF, ZF, PF according 
to result. 

REX + F6 /0 ib TEST r/m8*, imm8 MI | Valid N.E. AND imm8 with r/m&; set SF, ZF, PF according 
to result. 

F7 /0 iw TEST r/m16, imm16 MI | Valid Valid AND imm16 with r/m16; set SF, ZF, PF 
according to result. 

F7 /0 id TEST r/m32, imm32 MI | Valid Valid AND imm32 with r/m32, set SF, ZF, PF 
according to result. 

REX.W + F7 /O id TEST r/m64, imm32 MI | Valid N.E. AND imm32 sign-extended to 64-bits with 
r/m64; set SF, ZF, PF according to result. 

84 /r TEST r/m8, r8 MR | Valid Valid AND r8 with r/m&; set SF, ZF, PF according to 
result. 

REX + 84 /r TEST r/m8*, r8* MR | Valid N.E. AND r8 with r/m&; set SF, ZF, PF according to 
result. 

85 /r TEST r/m16, r16 MR | Valid Valid AND r76 with r/m16; set SF, ZF, PF according 
to result. 

85 /r TEST r/m32, r32 MR | Valid Valid AND r32 with r/m32, set SF, ZF, PF according 
to result. 

REX.W + 85 /r TEST r/m64, r64 MR | Valid N.E. AND r64 with r/m64; set SF, ZF, PF according 
to result. 

NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
MI ModRM:r/m (r) imm8/16/32 NA NA 
MR ModRM:r/m (r) ModRM:reg (r) NA NA 
Description 


Computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) 


and sets the SF, ZF, and PF status flags according to the result. The result is then discarded. 


In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). Using a 
REX prefix in the form of REX.W promotes operation to 64 bits. See the summary chart at the beginning of this 


section for encoding data and limits. 
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Operation 


TEMP := SRC1 AND SRC2; 
SF := MSB(TEMP); 


IF TEMP = 0 
THEN ZF := 1; 
ELSE ZF := 0; 
FI: 
PF := BitwiseXNOR(TEMP[0:7)); 
CF := 0; 
OF := 0; 


(* AF is undefined *) 


Flags Affected 


The OF and CF flags are set to 0. The SF, ZF, and PF flags are set according to the result (See the “Operation” 
section above). The state of the AF flag is undefined. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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TPAUSE—Timed PAUSE 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
66 OF AE /6 A VIV WAITPKG_ | Directs the processor to enter an implementation- 
TPAUSE r32, <edx>, <eax> dependent optimized state until the TSC reaches the value 
in EDX:EAX. 


Instruction Operand Encoding! 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (r) NA NA NA 
Description 


TPAUSE instructs the processor to enter an implementation-dependent optimized state. There are two such opti- 
mized states to choose from: light-weight power/performance optimized state, and improved power/performance 
optimized state. The selection between the two is governed by the explicit input register bit{O0] source operand. 


TPAUSE is available when CPUID.7.0:ECX.WAITPKG[bit 5] is enumerated as 1. TPAUSE may be executed at any 
privilege level. This instruction’s operation is the same in non-64-bit modes and in 64-bit mode. 


Unlike PAUSE, the TPAUSE instruction will not cause an abort when used inside a transactional region, described in 
the chapter Chapter 16, “Programming with Intel® Transactional Synchronization Extensions,” of the Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 1. 

The input register contains information such as the preferred optimized state the processor should enter as 
described in the following table. Bits other than bit 0 are reserved and will result in #GP if non-zero. 


Table 4-25. TPAUSE Input Register Bit Definitions 


Bit Value State Name Wakeup Time Power Savings Other Benefits 

bit[O] = 0 C0.2 Slower Larger Improves performance of the other SMT thread(s) 
on the same core. 

bit[O] = 1 CO.1 Faster Smaller NA 

bits[31:1] NA NA NA Reserved 


The instruction execution wakes up when the time-stamp counter reaches or exceeds the implicit EDX:EAX 64-bit 
input value. 


Prior to executing the TPAUSE instruction, an operating system may specify the maximum delay it allows the 
processor to suspend its operation. It can do so by writing TSC-quanta value to the following 32-bit MSR 
(IA32_UMWAIT_CONTROL at MSR index E1H): 

¢ TA32_UMWAIT_CONTROL[31:2] — Determines the maximum time in TSC-quanta that the processor can reside 


in either CO.1 or CO.2. A zero value indicates no maximum time. The maximum time value is a 32-bit value 
where the upper 30 bits come from this field and the lower two bits are zero. 


¢ [A32_UMWAIT_CONTROL[1] — Reserved. 


¢ JTA32_UMWAIT_CONTROL[0] — CO.2 is not allowed by the OS. Value of “1” means all CO.2 requests revert to 
Co.1. 


If the processor that executed a TPAUSE instruction wakes due to the expiration of the operating system time-limit, 
the instructions sets RFLAGS.CF; otherwise, that flag is cleared. 


The following additional events cause the processor to exit the implementation-dependent optimized state: a store 
to the read-set range within the transactional region, an NMI or SMI, a debug exception, a machine check excep- 
tion, the BINIT# signal, the INIT# signal, and the RESET# signal. 


1. The Mod field of the ModR/M byte must have value 11B. 
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Other implementation-dependent events may cause the processor to exit the implementation-dependent opti- 
mized state proceeding to the instruction following TPAUSE. In addition, an external interrupt causes the processor 
to exit the implementation-dependent optimized state regardless of whether maskable-interrupts are inhibited 
(EFLAGS.IF =0). It should be noted that if maskable-interrupts are inhibited execution will proceed to the instruc- 


tion following TPAUSE. 


Operation 
os_deadline := TSC+(lIA32_MWAIT_CONTROL[31:2]<<2) 
instr_deadline := UINT64(EDX:EAX) 


IF os_deadline < instr_deadline: 
deadline := os_deadline 
using_os_deadline := 1 

ELSE: 
deadline := instr_deadline 


using_os_deadline := 0 


WHILE TSC < deadline: 
implementation_dependent_optimized_state(Source register, deadline, [A32_UMWAIT_CONTROL[0}]) 


IF using_os_deadline AND TSC > deadline: 


RFLAGS.CF := 1 
ELSE: 
RFLAGS.CF := 0 


RFLAGS.AF,PF,SF,ZF,OF := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
TPAUSE uint8_t _tpause(uint32_t control, uint64_t counter); 


Numeric Exceptions 
None. 


Exceptions (All Operating Modes) 


#GP(0) If src[31:1] !=0. 
If CR4.TSD = 1 and CPL != 0. 
#UD If CPUID.7.0:ECX.WAITPKG[bit 5]=0. 
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TZCNT — Count the Number of Trailing Zero Bits 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode Flag 
F3 OF BC /r A VIV BMI1 Count the number of trailing zero bits in r/m76, return result in r76. 
TZCNT 16, r/m16 
F3 OF BC /r A VIV BMI1 Count the number of trailing zero bits in r/m32, return result in r32. 
TZCNT r32, r/m32 
F3 REX.W OF BC /r A V/N.E. BMI1 Count the number of trailing zero bits in r/m64, return result in r64. 
TZCNT 164, r/m64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
A ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


TZCNT counts the number of trailing least significant zero bits in source operand (second operand) and returns the 
result in destination operand (first operand). TZCNT is an extension of the BSF instruction. The key difference 
between TZCNT and BSF instruction is that TZCNT provides operand size as output when source operand is zero 
while in the case of BSF instruction, if source operand is zero, the content of destination operand are undefined. On 
processors that do not support TZCNT, the instruction byte encoding is executed as BSF. 


Operation 


temp := 0 
DEST := 0 
DO WHILE ( (temp < OperandSize) and (SRC[ temp] = 0) ) 


temp := temp +1 
DEST := DEST+ 1 
OD 


IF DEST = OperandSize 
CF :=1 
ELSE 


Fl 
IF DEST = 0 

ZF = 1 
ELSE 


Fl 


Flags Affected 


ZF is set to 1 in case of zero output (least significant bit of the source is set), and to 0 otherwise, CF is set to 1 if 
the input was zero and cleared otherwise. OF, SF, PF and AF flags are undefined. 


Intel C/C++ Compiler Intrinsic Equivalent 
TZCNT: unsigned __int32 _tzcnt_u32(unsigned __int32 src); 
TZCNT: unsigned __int64 _tzcnt_u64(unsigned __int64 src); 
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Protected Mode Exceptions 


#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null segment 
selector. 

#SS(0) For an illegal address in the SS segment. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 
#SS(0) For an illegal address in the SS segment. 
#UD If LOCK prefix is used. 


Virtual 8086 Mode Exceptions 


#GP(0) If any part of the operand lies outside of the effective address space from 0 to OFFFFH. 

#SS(0) For an illegal address in the SS segment. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in Protected Mode. 


64-Bit Mode Exceptions 


#GP(0) If the memory address is in a non-canonical form. 

#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#PF (fault-code) For a page fault. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If LOCK prefix is used. 
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UCOMISD—Unordered Compare Scalar Double-Precision Floating-Point Values and Set EFLAGS 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 2E /r A VIV SSE2 Compare low double-precision floating-point values in 
UCOMISD xmm1, xmm2/m64 xmm1 and xmm2/mem64 and set the EFLAGS flags 
accordingly. 
VEX.LIG.66.0F.WIG 2E /r A VIV AVX Compare low double-precision floating-point values in 
VUCOMISD xmm1, xmm2/m64 xmm1 and xmm2/mem64 and set the EFLAGS flags 
accordingly. 
EVEX.LLIG.66.0F.W1 2E /r B VIV AVX512F | Compare low double-precision floating-point values in 
VUCOMISD xmm1, xmm2/m64{sae} xmm1 and xmm2/m64 and set the EFLAGS flags 
accordingly. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Performs an unordered compare of the double-precision floating-point values in the low quadwords of operand 1 
(first operand) and operand 2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according 
to the result (unordered, greater than, less than, or equal). The OF, SF and AF flags in the EFLAGS register are set 
to 0. The unordered result is returned if either source operand is a NaN (QNaN or SNaN). 

Operand 1 is an XMM register; operand 2 can be an XMM register or a 64 bit memory 

location. 

The UCOMISD instruction differs from the COMISD instruction in that it signals a SIMD floating-point invalid oper- 
ation exception (#1) only when a source operand is an SNaN. The COMISD instruction signals an invalid operation 
exception only if a source operand is either an SNaN or a QNaN. 

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated. 

Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCOMISD is encoded with VEX.L=0. Encoding VCOMISD with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 


(V)UCOMISD (all versions) 
RESULT := UnorderedCompare(DEST[63:0] <> SRC[63:0]) { 
(* Set EFLAGS *) CASE (RESULT) OF 
UNORDERED: ZF,PF,CF := 111; 
GREATER_THAN: ZF,PF,CF := 000; 
LESS_THAN: ZF,PF,CF := 001; 
EQUAL: ZF,PF,CF := 100; 
ESAC; 
OF, AF, SF := 0; } 
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VUCOMISD int __mm_comi_round_sd(__m128d a, ___m128d b, int imm, int sae); 
UCOMISD int __mm_ucomieq_sd(__m128d a, ___m128d b) 

UCOMISD int _mm_ucomilt_sd(__m128d a, ___m128d b) 

UCOMISD int __mm_ucomile_sd(__m128d a,___m128d b) 

UCOMISD int _mm_ucomigt_sd(__m128d a,_m128d b) 

UCOMISD int _mm_ucomige_sd(__m128d a,__m128d b) 

UCOMISD int _mm_ucomineg_sd(__m128d a, ___m128d b) 


SIMD Floating-Point Exceptions 
Invalid (if SNaN operands), Denormal 


Other Exceptions 
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VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”; additionally: 


#UD If VEX.vvvv != 1111B. 


EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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UCOMISS—Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF 2E /r A VIV SSE Compare low single-precision floating-point values in 


UCOMISS xmm1, xmm2/m32 xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 
Compare low single-precision floating-point values in 
xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 
Compare low single-precision floating-point values in 
xmm1 and xmm2/mem32 and set the EFLAGS flags 
accordingly. 


VEX.LIG.OF.WIG 2E /r A VV AVX 
VUCOMISS xmm1, xmm2/m32 


EVEX.LLIG.OF.WO 2€E /r B VV 
VUCOMISS xmm1, xmm2/m32{sae} 


AVX512F 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Compares the single-precision floating-point values in the low doublewords of operand 1 (first operand) and 
operand 2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unor- 
dered, greater than, less than, or equal). The OF, SF and AF flags in the EFLAGS register are set to 0. The unor- 
dered result is returned if either source operand is a NaN (QNaN or SNaN). 

Operand 1 is an XMM register; operand 2 can be an XMM register or a 32 bit memory location. 

The UCOMISS instruction differs from the COMISS instruction in that it signals a SIMD floating-point invalid opera- 
tion exception (#1) only if a source operand is an SNaN. The COMISS instruction signals an invalid operation excep- 
tion when a source operand is either a QNaN or SNaN. 

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated. 

Note: VEX.vvvv and EVEX.vvvwv are reserved and must be 1111b, otherwise instructions will #UD. 


Software should ensure VCOMISS is encoded with VEX.L=0. Encoding VCOMISS with VEX.L=1 may encounter 
unpredictable behavior across different processor generations. 


Operation 


(V)UCOMISS (all versions) 
RESULT := UnorderedCompare(DEST[31:0] <> SRC[31:0]) { 
(* Set EFLAGS *) CASE (RESULT) OF 
UNORDERED: ZF,PF,CF := 111; 
GREATER_THAN: ZF,PF,CF := 000; 
LESS_THAN: ZF,PF,CF := 001; 
EQUAL: ZF,PF,CF := 100; 
ESAC; 
OF, AF, SF := 0; } 
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Intel C/C++ Compiler Intrinsic Equivalent 


VUCOMISS 
UCOMISS 
UCOMISS 
UCOMISS 
UCOMISS 
UCOMISS 
UCOMISS 


int 
int 
int 
int 
int 
int 
int 


mm. 


comi_round_ss(__m128 a,__m128 5, int imm, int sae); 


mm. 


mm. 


ucomieq_ss(__m128 a,__m128 b); 
ucomilt_ss(__m128 a,__m128 b); 


mm. 


ucomile_ss(__m128 a,__m128 b); 


mm. 


ucomigt_ss(__m128 a, ___m128 b); 


mm. 


ucomige_ss(__m128 a,__m128 b); 


_mm_! 


ucomineq_ss(__m128 a,_m128b); 


SIMD Floating-Point Exceptions 


Invalid (if SNaN Operands), Denormal 


Other Exceptions 


VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”; additionally: 


#UD 


EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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UD—Undefined Instruction 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF FF /r UDOT r32, r/m32 RM _ | Valid Valid Raise invalid opcode exception. 
OF B9 /r UD1 r32, r/m32 RM _ | Valid Valid Raise invalid opcode exception. 
OF OB UD2 ZO | Valid Valid Raise invalid opcode exception. 
NOTES: 


1. Some processors decode the UDO instruction without a ModR/M byte. As a result, those processors would deliver an invalid-opcode 
exception instead of a fault on instruction fetch when the instruction with a ModR/M byte (and any implied bytes) would cross a page 
or segment boundary. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


Generates an invalid opcode exception. This instruction is provided for software testing to explicitly generate an 
invalid opcode exception. The opcodes for this instruction are reserved for this purpose. 


Other than raising the invalid opcode exception, this instruction has no effect on processor state or memory. 


Even though it is the execution of the UD instruction that causes the invalid opcode exception, the instruction 
pointer saved by delivery of the exception references the UD instruction (and not the following instruction). 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


#UD (* Generates invalid opcode exception *); 


Flags Affected 


None. 


Exceptions (All Operating Modes) 
#UD Raises an invalid opcode exception in all operating modes. 
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UMONITOR—User Level Set Up Monitor Address 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 OF AE /6 A VIV WAITPKG | Sets up a linear address range to be monitored by 
UMONITOR r16/r32/r64 hardware and activates the monitor. The address range 
should be a write-back memory caching type. The 
address is contained in r16/r32/r64. 


Instruction Operand Encoding! 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (r) NA NA NA 
Description 


The UMONITOR instruction arms address monitoring hardware using an address specified in the source register 
(the address range that the monitoring hardware checks for store operations can be determined by using the 
CPUID monitor leaf function, EAX=05H). A store to an address within the specified address range triggers the 
monitoring hardware. The state of monitor hardware is used by UMWAIT. 


The content of the source register is an effective address. By default, the DS segment is used to create a linear 
address that is monitored. Segment overrides can be used. The address range must use memory of the write-back 
type. Only write-back memory is guaranteed to correctly trigger the monitoring hardware. Additional information 
on determining what address range to use in order to prevent false wake-ups is described in Chapter 8, “Multiple- 
Processor Management” of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


The UMONITOR instruction is ordered as a load operation with respect to other memory transactions. The instruc- 
tion is subject to the permission checking and faults associated with a byte load. Like a load, UMONITOR sets the 
A-bit but not the D-bit in page tables. 


UMONITOR and UMWAIT are available when CPUID.7.0:ECX.WAITPKG[bit 5] is enumerated as 1. UMONITOR and 
UMWAIT may be executed at any privilege level. Except for the width of the source register, the instruction’s oper- 
ation is the same in non-64-bit modes and in 64-bit mode. 


UMONITOR does not interoperate with the legacy MWAIT instruction. If UMONITOR was executed prior to executing 
MWAIT and following the most recent execution of the legacy MONITOR instruction, MWAIT will not enter an opti- 
mized state. Execution will continue to the instruction following MWAIT. 


The UMONITOR instruction causes a transactional abort when used inside a transactional region. 
The width of the source register (16b, 32b or 64b) is determined by the effective addressing width, which is 


affected in the standard way by the machine mode settings and 67 prefix. 
Operation 


UMONITOR sets up an address range for the monitor hardware using the content of source register as an effective 
address and puts the monitor hardware in armed state. A store to the specified address range will trigger the 
monitor hardware. 


Intel C/C++ Compiler Intrinsic Equivalent 
UMONITOR void _umonitor(void *address); 


Numeric Exceptions 
None 


1. The Mod field of the ModR/M byte must have value 11B. 
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Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#UD 


If the specified segment is not SS and the source register is outside the specified segment 
limit. 

If the specified segment register contains a NULL segment selector. 

If the specified segment is SS and the source register is outside the SS segment limit. 

For a page fault. 

If CPUID.7.0:ECX.WAITPKG[bit 5]=0. 


Real Address Mode Exceptions 


#GP 


#SS 


#UD 


If the specified segment is not SS and the source register is outside of the effective address 
space from O to FFFFH. 


If the specified segment is SS and the source register is outside of the effective address space 
from 0 to FFFFH. 


If CPUID.7.0:ECX.WAITPKG[bit 5]=0. 


Virtual 8086 Mode Exceptions 
Same exceptions as in real address mode; additionally: 


#PF(fault-code) 


For a page fault. 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 

#SS(0) 
#PF(fault-code) 
#UD 
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If the specified segment is not SS and the linear address is in non-canonical form. 
If the specified segment is SS and the source register is in non-canonical form. 
For a page fault. 

If CPUID.7.0:ECX.WAITPKG[bit 5]=0. 


UMONITOR—User Level Set Up Monitor Address 


INSTRUCTION SET REFERENCE, M-U 


UMWAIT—User Level Monitor Wait 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F2 OF AE /6 A VV WAITPKG_ | A hint that allows the processor to stop instruction 
UMWAIT r32, <edx>, <eax> execution and enter an implementation-dependent 
optimized state until occurrence of a class of events. 


Instruction Operand Encoding! 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (r) NA NA NA 
Description 


UMWAIT instructs the processor to enter an implementation-dependent optimized state while monitoring a range 
of addresses. The optimized state may be either a light-weight power/performance optimized state or an improved 
power/performance optimized state. The selection between the two states is governed by the explicit input register 
bit[O] source operand. 

UMWAIT is available when CPUID.7.0:ECX.WAITPKG[bit 5] is enumerated as 1. UMWAIT may be executed at any 
privilege level. This instruction’s operation is the same in non-64-bit modes and in 64-bit mode. 


The input register contains information such as the preferred optimized state the processor should enter as 
described in the following table. Bits other than bit 0 are reserved and will result in #GP if nonzero. 


Table 4-26. UMWAIT Input Register Bit Definitions 


Bit Value | State Name | Wakeup Time | Power Savings | Other Benefits 

bitjO]} =O | CO2 Slower Larger Improves performance of the other SMT thread(s) on the same core. 
bitjO]=1 | CO.1 Faster Smaller NA 

bits[31:1] | NA NA NA Reserved 


The instruction wakes up when the time-stamp counter reaches or exceeds the implicit EDX:EAX 64-bit input value 
(if the monitoring hardware did not trigger beforehand). 


Prior to executing the UMWAIT instruction, an operating system may specify the maximum delay it allows the 
processor to suspend its operation. It can do so by writing TSC-quanta value to the following 32bit MSR 
(IA32_UMWAIT_CONTROL at MSR index E1H): 


° JTA32_UMWAIT_CONTROL[31:2] — Determines the maximum time in TSC-quanta that the processor can reside 
in either CO.1 or CO.2. A zero value indicates no maximum time. The maximum time value is a 32-bit value 
where the upper 30 bits come from this field and the lower two bits are zero. 

° TA32_UMWAIT_CONTROL[1] — Reserved. 

¢ = =1A32_UMWAIT_CONTROL[0] — CO.2 is not allowed by the OS. Value of “1” means all CO.2 requests revert to 
co.1. 

If the processor that executed a UMWAIT instruction wakes due to the expiration of the operating system time- 

limit, the instructions sets RFLAGS.CF; otherwise, that flag is cleared. 

The UMWAIT instruction causes a transactional abort when used inside a transactional region. 

The UMWAIT instruction operates with the UMONITOR instruction. The two instructions allow the definition of an 

address at which to wait (UMONITOR) and an implementation-dependent optimized operation to perform while 

waiting (UMWAIT). The execution of UMWAIT is a hint to the processor that it can enter an implementation-depen- 


dent-optimized state while waiting for an event or a store operation to the address range armed by UMONITOR. 
The UMWAIT instruction will not wait (will not enter an implementation-dependent optimized state) if any of the 


1. The Mod field of the ModR/M byte must have value 11B. 
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following instructions were executed before UMWAIT and after the most recent execution of UMONITOR: IRET, 
MONITOR, SYSEXIT, SYSRET, and far RET (the last if it is changing CPL). 

The following additional events cause the processor to exit the implementation-dependent optimized state: a store 
to the address range armed by the UMONITOR instruction, an NMI or SMI, a debug exception, a machine check 
exception, the BINIT# signal, the INIT# signal, and the RESET# signal. Other implementation-dependent events 
may also cause the processor to exit the implementation-dependent optimized state. 

In addition, an external interrupt causes the processor to exit the implementation-dependent optimized state 
regardless of whether maskable-interrupts are inhibited (EFLAGS.IF =0). 

Following exit from the implementation-dependent-optimized state, control passes to the instruction after the 
UMWAIT instruction. A pending interrupt that is not masked (including an NMI or an SMI) may be delivered before 
execution of that instruction. 

Unlike the HLT instruction, the UMWAIT instruction does not restart at the UMWAIT instruction following the 
handling of an SMI. 

If the preceding UMONITOR instruction did not successfully arm an address range or if UMONITOR was not 
executed prior to executing UMWAIT and following the most recent execution of the legacy MONITOR instruction 


(UMWAIT does not interoperate with MONITOR), then the processor will not enter an optimized state. Execution will 
continue to the instruction following UMWAIT. 


A store to the address range armed by the UMONITOR instruction will cause the processor to exit UMWAIT if either 
the store was originated by other processor agents or the store was originated by a non-processor agent. 


Operation 
os_deadline := TSC+(IA32_MWAIT_CONTROL[31:2]<<2) 
instr_deadline := UINT64(EDX:EAX) 


IF os_deadline < instr_deadline: 
deadline := os_deadline 
using_os_deadline := 1 

ELSE: 
deadline := instr_deadline 
using_os_deadline := 0 


WHILE monitor hardware armed AND TSC < deadline: 
implementation_dependent_optimized_state(Source register, deadline, |A32_UMWAIT_CONTROL[0] ) 


IF using_os_deadline AND TSC > deadline: 


RFLAGS.CF := 1 
ELSE: 
RFLAGS.CF := 0 


RFLAGS.AF,PF,SF,ZF,OF := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
UMWAIT uint8_t _umwait(uint32_t control, uint64_t counter); 


Numeric Exceptions 
None 


Exceptions (All Operating Modes) 


#GP(0) If src[31:1] != 0. 
If CR4.TSD = 1 and CPL != 0. 
#UD If CPUID.7.0:ECX.WAITPKG[bit 5]=0. 
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UNPCKHPD—Unpack and Interleave High Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
66 OF 15 /r A VIV SSE2 Unpacks and Interleaves double-precision floating-point 
UNPCKHPD xmm1, xmm2/m128 values from high quadwords of xmm1 and 
xmm2/m128. 
VEX.128.66.0F.WIG 15 /r B VIN AVX Unpacks and Interleaves double-precision floating-point 
VUNPCKHPD xmm1,xmm2, values from high quadwords of xmm2 and 
xmm3/m128 xmm3/m1 28. 
VEX.256.66.0F.WIG 15 /r B VV AVX Unpacks and Interleaves double-precision floating-point 
VUNPCKHPD ymm1,ymm2, values from high quadwords of ymm2 and 
ymm3/m256 ymm3/m256. 
EVEX.128.66.0F.W1 15 /r C VIV AVX512VL_ | Unpacks and Interleaves double precision floating-point 
VUNPCKHPD xmm1 {k1}{z}, xmm2, AVX512F values from high quadwords of xmm2 and 
xmm3/m128/m64bcst xmm3/m128/m64bcst subject to writemask k1. 
EVEX.256.66.0F.W1 15 /r C VIV AVX512VL_ | Unpacks and Interleaves double precision floating-point 
VUNPCKHPD ymm1 {k1}{z}, ymm2, AVX512F values from high quadwords of ymm2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst subject to writemask k1. 
EVEX.512.66.0F.W1 15 /r C VIV AVX512F Unpacks and Interleaves double-precision floating-point 
VUNPCKHPD zmm1 {k1}{z}, zmm2, values from high quadwords of zmm2 and 
zmm3/m512/m64bcst zmm3/m512/m64bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an interleaved unpack of the high double-precision floating-point values from the first source operand 
and the second source operand. See Figure 4-15 in the Intel® 64 and IA-32 Architectures Software Developer's 
Manual, Volume 2B. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. When unpacking from a memory operand, an implementation may fetch 
only the appropriate 64 bits; however, alignment to 16-byte boundary and normal segment checking will still be 
enforced. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register, a 512-bit memory location, or a 512-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM 
register, a 256-bit memory location, or a 256-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a YMM register, conditionally updated using writemask k1. 

EVEX.128 encoded version: The first source operand is a XMM register. The second source operand is a XMM 
register, a 128-bit memory location, or a 128-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a XMM register, conditionally updated using writemask k1. 
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Operation 


VUNPCKHPD (EVEX encoded versions when SRC2 is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF VL >= 128 

TMP_DEST[63:0] := SRC1[127:64] 

TMP_DEST[127:64] := SRC2[127:64] 
Fl; 
IF VL >= 256 

TMP_DEST[191:128] := SRC1[255:192] 

TMP_DEST[255:192] := SRC2[255:192] 
Fl; 
IF VL >= 512 

TMP_DEST[319:256] := SRC1[383:320] 

TMP_DEST[383:320] := SRC2[383:320] 

TMP_DEST[447:384] := SRC1[51 1:448] 

TMP_DEST[51 1:448] := SRC2[51 1:448] 
Fl; 
FOR j :=0 TO KL-1 

i:=j* 64 

IF k1[j] OR *no writemask* 

THEN DEST{[i+63:i] := TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 

Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VUNPCKHPD (EVEX encoded version when SRC2 is memory) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) 
THEN TMP_SRC2[i+63:i] = SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] :-= SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL >= 128 
TMP_DEST[63:0] := SRC1[127:64] 
TMP_DEST[127:64] := TMP_SRC2[127:64] 
Fl; 
IF VL >= 256 
TMP_DEST[191:1 28] := SRC1[255:192] 
TMP_DEST[255:192] := TMP_SRC2[255:192] 
Fl; 
IF VL >= 512 
TMP_DEST[319:256] := SRC1[383:320] 
TMP_DEST[383:320] := TMP_SRC2[383:320] 
TMP_DEST[447:384] := SRC1[511:448] 
TMP_DEST[51 1:448] := TMP_SRC2[511:448] 
Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VUNPCKHPD (VEX.256 encoded version) 
DEST[63:0] := SRC1[127:64] 

DEST[127:64] := SRC2[127:64] 
DEST[191:128] := SRC1[255:192] 
DEST[255:192] := SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VUNPCKHPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[127:64] 

DEST[127:64] := SRC2[127:64] 
DEST[MAXVL-1:128] := 0 


UNPCKHPD (128-bit Legacy SSE version) 
DEST[63:0] := SRC1[127:64] 

DEST[127:64] := SRC2[127:64] 
DEST[MAXVL-1:128] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VUNPCKHPD __m512d_mm512_unpackhi_pd(__m512da,__m512d b); 
VUNPCKHPD __m512d_mm512_mask_unpackhi_pd(__m512ds,__mmask8 k, 
VUNPCKHPD __m512d_mm512_maskz_unpackhi_pd(__mmask8 k,__m512d a, 
VUNPCKHPD __m256d _mm256_unpackhi_pd(__m256d a, ___ m256d b) 
VUNPCKHPD __m256d __mm256_mask_unpackhi_pd(__m256ds,__ mmask8 k,___m256d a, ___ m256d b); 
VUNPCKHPD __m256d __mm256_maskz_unpackhi_pd(__mmask8 k,__ m256d a, ___m256d b); 
UNPCKHPD __m128d __mm_unpackhi_pd(__m128d a,_m128d b) 
VUNPCKHPD __m128d __mm_mask_unpackhi_pd(__m128d s,___ mmask8 k, 
VUNPCKHPD __m128d_mm_maskz_unpackhi_pd(__mmask8 k, __m128d a, 


m512da,__m512d b); 
m512d b); 


m128d a, 
m128d b); 


m128d b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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UNPCKHPS—Unpack and Interleave High Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
NP OF 15 /r A VIV SSE Unpacks and Interleaves single-precision floating-point 
UNPCKHPS xmm1, xmm2/m128 values from high quadwords of xmm1 and xmm2/m128. 
VEX.128.0F.WIG 15 /r B VIV AVX Unpacks and Interleaves single-precision floating-point 
VUNPCKHPS xmm1, xmm2, values from high quadwords of xmm2 and xmm3/m128. 
xmm3/m128 
VEX.256.0F.WIG 15 /r B VIV AVX Unpacks and Interleaves single-precision floating-point 
VUNPCKHPS ymm1, ymm2, values from high quadwords of ymm2 and ymm3/m256. 
ymm3/m256 
EVEX.128.0F.WO 15 /r C VIV AVX512VL | Unpacks and Interleaves single-precision floating-point 
VUNPCKHPS xmm1 {k1}{z}, xmm_2, AVX512F values from high quadwords of xmm2 and 
xmm3/m128/m32bcst xmm3/m128/m32bcst and write result to xmm1 subject to 
writemask k1. 
EVEX.256.0F.WO 15 /r C VIV AVX512VL | Unpacks and Interleaves single-precision floating-point 
VUNPCKHPS ymm1 {k1}{z}, ymm2, AVX512F values from high quadwords of ymm2 and 
ymm3/m256/m32bcst ymm3/m256/m32bcst and write result to ymm1 subject to 
writemask k1. 
EVEX.512.0F.WO 15 /r C VIV AVX512F Unpacks and Interleaves single-precision floating-point 
VUNPCKHPS zmm1 {k1}{z}, zmm2, values from high quadwords of zmm2 and 
zmm3/m512/m32bcst zmm3/m512/m32bcst and write result to zmm1 subject to 
writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an interleaved unpack of the high single-precision floating-point values from the first source operand and 
the second source operand. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. When unpacking from a memory operand, an implementation may fetch 
only the appropriate 64 bits; however, alignment to 16-byte boundary and normal segment checking will still be 
enforced. 

VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 

VEX.256 encoded version: The second source operand is an YMM register or an 256-bit memory location. The first 
source operand and destination operands are YMM registers. 
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srci] x7 X6 X5 x4 X3 X2 x1 XO 
sRc2]Y7 Y6 Y5 Y4 Y3 Y2 v1 YO 
Dest] 7 X7 Y6 X6 Y3 X3 Y2 X2 


Figure 4-27. VUNPCKHPS Operation 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a ZMM register, conditionally updated using writemask k1. 

EVEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM 
register, a 256-bit memory location, or a 256-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a YMM register, conditionally updated using writemask k1. 

EVEX.128 encoded version: The first source operand is a XMM register. The second source operand is a XMM 
register, a 128-bit memory location, or a 128-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a XMM register, conditionally updated using writemask k1. 


Operation 


VUNPCKHPS (EVEX encoded version when SRC2 is a register) 

(KL, VL) = (4, 128), (8, 256), (16, 512) 

IF VL >= 128 
TMP_DEST[31:0] := SRC1[95:64] 
TMP_DEST[63:32] := SRC2[95:64] 
TMP_DEST[95:64] := SRC1[127:96] 
TMP_DEST[127:96] := SRC2[127:96] 

Fl; 

IF VL >= 256 
TMP_DEST[159:1 28] := SRC1[223:192] 
TMP_DEST[191:160] := SRC2[223:192] 
TMP_DEST[223:192] := SRC1[255:224] 
TMP_DEST[255:224] := SRC2[255:224] 

Fl; 

IF VL >=512 
TMP_DEST[287:256] := SRC1[351:320] 
TMP_DEST[319:288] := SRC2[351:320] 
TMP_DEST[351:320] := SRC1[383:352] 
TMP_DEST[383:352] := SRC2[383:352] 
TMP_DEST[415:384] := SRC1[479:448] 
TMP_DEST[447:416] := SRC2[479:448] 
TMP_DEST[479:448] := SRC1[51 1:480] 
TMP_DEST[51 1:480] := SRC2[51 1:480] 

Fl; 
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FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VUNPCKHPS (EVEX encoded version when SRC2 is memory) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL >= 128 
TMP_DEST[31:0] := SRC1[95:64] 
TMP_DEST[63:32] := TMP_SRC2[95:64] 
TMP_DEST[95:64] := SRC1[1 27:96] 
TMP_DEST[127:96] := TMP_SRC2[127:96] 
Fl; 
IF VL >= 256 
TMP_DEST[159:1 28] := SRC1[223:192] 
TMP_DEST[191:160] := TMP_SRC2[223:192] 
TMP_DEST[223:192] := SRC1[255:224] 
TMP_DEST[255:224] := TMP_SRC2[255:224] 
Fl; 
IF VL >= 512 
TMP_DEST[287:256] := SRC1[351:320] 
TMP_DEST[319:288] := TMP_SRC2[351:320] 
TMP_DEST[351:320] := SRC1[383:352] 
TMP_DEST[383:352] := TMP_SRC2[383:352] 
TMP_DEST[415:384] := SRC1[479:448] 
TMP_DEST[447:416] := TMP_SRC2[479:448] 
TMP_DEST[479:448] := SRC1[511:480] 
TMP_DEST[51 1:480] := TMP_SRC2[511:480] 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 


DEST[i+31:i] := 0 
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Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VUNPCKHPS (VEX.256 encoded version) 
DEST[31:0] := SRC1[95:64] 

DEST[63:32] := SRC2[95:64] 

DEST[95:64] := SRC1[127:96] 
DEST[127:96] := SRC2[127:96] 
DEST[159:128] := SRC1[223:192] 
DEST[191:160] := SRC2[223:192] 
DEST[223:192] := SRC1[255:224] 
DEST[255:224] := SRC2[255:224] 
DEST[MAXVL-1:256] := 0 


VUNPCKHPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[95:64] 

DEST[63:32] := SRC2[95:64] 

DEST[95:64] := SRC1[127:96] 
DEST[127:96] := SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


UNPCKHPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[95:64] 

DEST[63:32] := SRC2[95:64] 

DEST[95:64] := SRC1[127:96] 
DEST[127:96] := SRC2[127:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VUNPCKHPS __m512 _mm512_unpackhi_ps( 


m512 b); 


VUNPCKHPS __m512 _mm512_mask_unpackhi_ps( 


m512 s,__mmask16 k, 


m512a,__m512b); 


VUNPCKHPS __m512 _mm512_maskz_unpackhi_ps( 


VUNPCKHPS __m256 _mm256_unpackhi_ps ( 


mmask16 k,__m512 a,__m512 b); 


m256 b); 


VUNPCKHPS __m256 _mm256_mask_unpackhi_ps(__m256 s,__ mmask8 k,___m256 a,__m256 b); 


VUNPCKHPS __m256 _mm256_maskz_unpackhi_ps( 


mmask8 k, 


m256 a,__m256 b); 


UNPCKHPS __m128 _mm_unpackhi_ps (__m128 a,__m128 b); 


VUNPCKHPS __m128 _mm_mask_unpackhi_ps( 


VUNPCKHPS __m128 _mm_maskz_unpackhi_ps( 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 


mmask8 k,_m128 a,__m128 b); 


mmask8 k,__m128a,__m128 b); 


" 


EVEX-encoded instructions, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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UNPCKLPD—Unpack and Interleave Low Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
66 OF 14 /r A VV SSE2 Unpacks and Interleaves double-precision floating-point 
UNPCKLPD xmm1, xmm2/m128 values from low quadwords of xmm1 and xmm2/m128. 
VEX.128.66.0F.WIG 14 /r B VV AVX Unpacks and Interleaves double-precision floating-point 
VUNPCKLPD xmm1,xmm2z, values from low quadwords of xmm2 and xmm3/m128. 
xmm3/m128 
VEX.256.66.0F.WIG 14 /r B VV AVX Unpacks and Interleaves double-precision floating-point 
VUNPCKLPD ymm1,ymmc2, values from low quadwords of ymm2 and ymm3/m256. 
ymm3/m256 
EVEX.128.66.0F.W1 14 /r C VIV AVX512VL_ | Unpacks and Interleaves double precision floating-point 
VUNPCKLPD xmm1 {k1}{z}, xmm2, AVX512F values from low quadwords of xmm2 and 
xmm3/m128/m64bcst xmm3/m128/m64bcst subject to write mask k1. 
EVEX.256.66.0F.W1 14 /r C VIV AVX512VL_ | Unpacks and Interleaves double precision floating-point 
VUNPCKLPD ymm1 {k1}{z}, ymm2, AVX512F values from low quadwords of ymm2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst subject to write mask k1. 
EVEX.512.66.0F.W1 14 /r C VV AVX512F Unpacks and Interleaves double-precision floating-point 


zmm3/m512/m64bcst 


VUNPCKLPD zmm1 {k1}{z}, zmm2, 


Instruction Operand Encoding 


values from low quadwords of zmm2 and 
zmm3/m512/m64bcst subject to write mask k1. 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an interleaved unpack of the low double-precision floating-point values from the first source operand and 
the second source operand. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. When unpacking from a memory operand, an implementation may fetch 
only the appropriate 64 bits; however, alignment to 16-byte boundary and normal segment checking will still be 
enforced. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register, a 512-bit memory location, or a 512-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM 
register, a 256-bit memory location, or a 256-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a YMM register, conditionally updated using writemask k1. 


EVEX.128 encoded version: The first source operand is an XMM register. The second source operand is a XMM 
register, a 128-bit memory location, or a 128-bit vector broadcasted from a 64-bit memory location. The destina- 
tion operand is a XMM register, conditionally updated using writemask k1. 
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Operation 


VUNPCKLPD (EVEX encoded versions when SRC2 is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF VL >= 128 
TMP_DEST[63:0] := SRC1[63:0] 
TMP_DEST[127:64] := SRC2[63:0] 
Fl; 
IF VL >= 256 
TMP_DEST[191:128] := SRC1[191:128] 
TMP_DEST[255:192] := SRC2[191:128] 
Fl; 
IF VL >= 512 
TMP_DEST[319:256] := SRC1[319:256] 
TMP_DEST[383:320] := SRC2[319:256] 
TMP_DEST[447:384] := SRC1[447:384] 
TMP_DEST[51 1:448] := SRC2[447:384] 
Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VUNPCKLPD (EVEX encoded version when SRC2 is memory) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) 
THEN TMP_SRC2[i+63:i] = SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] :-= SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL >= 128 
TMP_DEST[63:0] := SRC1[63:0] 
TMP_DEST[127:64] := TMP_SRC2[63:0] 
Fl; 
IF VL >= 256 
TMP_DEST[191:1 28] := SRC1[191:128] 
TMP_DEST[255:192] := TMP_SRC2[191:128] 
Fl; 
IF VL >= 512 
TMP_DEST[319:256] := SRC1[319:256] 
TMP_DEST[383:320] := TMP_SRC2[319:256] 
TMP_DEST[447:384] := SRC1[447:384] 
TMP_DEST[51 1:448] := TMP_SRC2[447:384] 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VUNPCKLPD (VEX.256 encoded version) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[191:128] := SRC1[191:128] 
DEST[255:192] := SRC2[191:128] 
DEST[MAXVL-1:256] := 0 


VUNPCKLPD (VEX.128 encoded version) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[MAXVL-1:128] := 0 


UNPCKLPD (128-bit Legacy SSE version) 
DEST[63:0] := SRC1[63:0] 

DEST[127:64] := SRC2[63:0] 
DEST[MAXVL-1:128] (Unmodified) 
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Intel C/C++ Compiler Intrinsic Equivalent 


VUNPCKLPD __m512d_mm512_unpacklo_pd(__m512da,__m512d b); 
VUNPCKLPD __m512d_mm512_mask_unpacklo_pd(__m512ds,__mmask8 k,__m512da, 
VUNPCKLPD __m512d_mm512_maskz_unpacklo_pd(__mmask8 k,___m512da,__m512d b); 
VUNPCKLPD __m256d_mm256_unpacklo_pd(__m256d a, ___ m256d b) 

VUNPCKLPD __m256d__mm256_mask_unpacklo_pd(__m256d s,__ mmask8 k,__ m256d a, ___m256d b); 
VUNPCKLPD __m256d__mm256_maskz_unpacklo_pd(__mmask8 k, __m256d a, __ m256d b); 
UNPCKLPD __m128d_mm_unpacklo_pd(__m128d a,__m128d b) 
VUNPCKLPD __m128d_mm_mask_unpacklo_pd(__m128d s,___mmask8 k, 
VUNPCKLPD __m128d_mm_maskz_unpacklo_pd(__mmask8 k,___m128d a, 


m512d b); 


m128d a,__m128d b); 
m128d b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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UNPCKLPS—Unpack and Interleave Low Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
NP OF 14 /r A VIV SSE Unpacks and Interleaves single-precision floating-point 
UNPCKLPS xmm1, xmm2/m128 values from low quadwords of xmm1 and xmm2/m128. 
VEX.128.0F.WIG 14 /r B VIV AVX Unpacks and Interleaves single-precision floating-point 
VUNPCKLPS xmm1,xmm2z, values from low quadwords of xmm2 and xmm3/m128. 
xmm3/m128 
VEX.256.0F.WIG 14 /r B VIV AVX Unpacks and Interleaves single-precision floating-point 
VUNPCKLPS values from low quadwords of ymm2 and ymm3/m256. 
ymm1,ymm2,ymm3/m256 
EVEX.128.0F.WO 14 /r C VIV AVX512VL_ | Unpacks and Interleaves single-precision floating-point 
VUNPCKLPS xmm1 {k1}{z}, xmm2, AVX512F values from low quadwords of xmm2 and xmm3/mem and 
xmm3/m128/m32bcst write result to xmm1 subject to write mask k1. 
EVEX.256.0F.WO 14 /r C VIV AVX512VL_ | Unpacks and Interleaves single-precision floating-point 
VUNPCKLPS ymm1 {k1}{z}, ymm2, AVX512F values from low quadwords of ymm2 and ymm3/mem and 
ymm3/m256/m32bcst write result to ymm1 subject to write mask k1. 
EVEX.512.0F.WO 14 /r C VIV AVX512F Unpacks and Interleaves single-precision floating-point 
VUNPCKLPS zmm1 {k1}{z}, zmm2, values from low quadwords of zmm2 and 
zmm3/m512/m32bcst zmm3/m512/m32bcst and write result to zmm1 subject 

to write mask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an interleaved unpack of the low single-precision floating-point values from the first source operand and 
the second source operand. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
ZMM register destination are unmodified. When unpacking from a memory operand, an implementation may fetch 
only the appropriate 64 bits; however, alignment to 16-byte boundary and normal segment checking will still be 
enforced. 


VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM 
register or a 128-bit memory location. The destination operand is a XMM register. The upper bits (MAXVL-1:128) of 
the corresponding ZMM register destination are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM 
register or a 256-bit memory location. The destination operand is a YMM register. 
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srcil X7 X6 X5 x4 X3 X2 x1 x0 
SRC2|Y7 Y6 Y5 Y3 Y2 v1 YO 
DEST) Y5 X5 Y4 x4 Y1 x1 YO x0 


Figure 4-28. VUNPCKLPS Operation 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a ZMM register, conditionally updated using writemask k1. 

EVEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM 
register, a 256-bit memory location, or a 256-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a YMM register, conditionally updated using writemask k1. 

EVEX.128 encoded version: The first source operand is an XMM register. The second source operand is a XMM 
register, a 128-bit memory location, or a 128-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a XMM register, conditionally updated using writemask k1. 


Operation 


VUNPCKLPS (EVEX encoded version when SRC2 is a ZMM register) 

(KL, VL) = (4, 128), (8, 256), (16, 512) 

IF VL >= 128 
TMP_DEST[31:0] := SRC1[31:0] 
TMP_DEST[63:32] := SRC2[31:0] 
TMP_DEST[95:64] := SRC1[63:32] 
TMP_DEST[127:96] := SRC2[63:32] 

Fl; 

IF VL >= 256 
TMP_DEST[159:1 28] := SRC1[159:1 28] 
TMP_DEST[191:160] := SRC2[159:128] 
TMP_DEST[223:192] := SRC1[191:160] 
TMP_DEST[255:224] := SRC2[191:160] 

Fl; 

IF VL >=512 
TMP_DEST[287:256] := SRC1[287:256] 
TMP_DEST[319:288] := SRC2[287:256] 
TMP_DEST[351:320] := SRC1[319:288] 
TMP_DEST[383:352] := SRC2[319:288] 
TMP_DEST[415:384] := SRC1[415:384] 
TMP_DEST[447:416] := SRC2[415:384] 
TMP_DEST[479:448] := SRC1[447:416] 
TMP_DEST[51 1:480] := SRC2[447:416] 

Fl; 

FOR j :=0 TO KL-1 
i:=j* 32 
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IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VUNPCKLPS (EVEX encoded version when SRC2 is memory) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 31 
IF (EVEX.b = 1) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL >= 128 
TMP_DEST[31:0] := SRC1[31:0] 
TMP_DEST[63:32] := TMP_SRC2[31:0] 
TMP_DEST[95:64] := SRC1[63:32] 
TMP_DEST[1 27:96] := TMP_SRC2[63:32] 
Fl; 
IF VL >= 256 
TMP_DEST[159:1 28] := SRC1[159:1 28] 
TMP_DEST[191:160] := TMP_SRC2[159:1 28] 
TMP_DEST[223:192] := SRC1[191:160] 
TMP_DEST[255:224] := TMP_SRC2[191:160] 
Fl; 
IF VL >= 512 
TMP_DEST[287:256] := SRC1[287:256] 
TMP_DEST[319:288] := TMP_SRC2[287:256] 
TMP_DEST[351:320] := SRC1[319:288] 
TMP_DEST[383:352] := TMP_SRC2[319:288] 
TMP_DEST[415:384] := SRC1[415:384] 
TMP_DEST[447:416] := TMP_SRC2[415:384] 
TMP_DEST[479:448] := SRC1[447:416] 
TMP_DEST[51 1:480] := TMP_SRC2[447:416] 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 


Fl; 
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ENDFOR 
DEST[MAXVL-1:VL] := 0 


UNPCKLPS (VEX.256 encoded version) 
DEST[31:0] := SRC1[31:0] 

DEST[63:32] := SRC2[31:0] 

DEST[95:64] := SRC1[63:32] 
DEST[127:96] := SRC2[63:32] 
DEST[159:128] := SRC1[159:128] 
DEST[191:160] := SRC2[159:128] 
DEST[223:192] := SRC1[191:160] 
DEST[255:224] := SRC2[191:160] 
DEST[MAXVL-1:256] := 0 


VUNPCKLPS (VEX.128 encoded version) 
DEST[31:0] := SRC1[31:0] 

DEST[63:32] := SRC2[31:0] 

DEST[95:64] := SRC1[63:32] 
DEST[127:96] := SRC2[63:32] 
DEST[MAXVL-1:128] := 0 


UNPCKLPS (128-bit Legacy SSE version) 
DEST[31:0] := SRC1[31:0] 

DEST[63:32] := SRC2[31:0] 

DEST[95:64] := SRC1[63:32] 
DEST[127:96] := SRC2[63:32] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VUNPCKLPS __m512_mm512_unpacklo_ps(__m512 a,__m512 b); 

VUNPCKLPS __m512_mm512_mask_unpacklo_ps(__m512s,__mmask16k,__m512 a,__m512 b); 
VUNPCKLPS __m512_mm512_maskz_unpacklo_ps(__mmask16 k,__m512 a,__m512 b); 
VUNPCKLPS __m256 _mm256_unpacklo_ps (__m256 a, ___m256 b); 

VUNPCKLPS __m256 __mm256_mask_unpacklo_ps(__m256 s,__ mmask8 k,__m256 a,__m256 b); 
VUNPCKLPS __m256 __mm256_maskz_unpacklo_ps(__mmask8 k,___m256 a,__m256 b); 
UNPCKLPS __m128_mm_unpacklo_ps (_m128 a,__m128 b); 

VUNPCKLPS __m128_mm_mask_unpacklo_ps(__m128s,__mmask8 k,__m128 a,__m128 b); 
VUNPCKLPS __m128 __mm_maskz_unpacklo_ps(__mmask8 k,__m128 a,__m128 b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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5.1 TERNARY BIT VECTOR LOGIC TABLE 


VPTERNLOGD/VPTERNLOGQ instructions operate on dword/qword elements and take three bit vectors of the 
respective input data elements to form a set of 32/64 indices, where each 3-bit value provides an index into an 8- 
bit lookup table represented by the imm8 byte of the instruction. The 256 possible values of the immé8 byte is 
constructed as a 16x16 boolean logic table. The 16 rows of the table uses the lower 4 bits of imm§8 as row index. 
The 16 columns are referenced by imm8[7:4]. The 16 columns of the table are present in two halves, with 8 
columns shown in Table 5-1 for the column index value between 0:7, followed by Table 5-2 showing the 8 columns 
corresponding to column index 8:15. This section presents the two-halves of the 256-entry table using a short- 
hand notation representing simple or compound boolean logic expressions with three input bit source data. 

The three input bit source data will be denoted with the capital letters: A, B, C; where A represents a bit from the 
first source operand (also the destination operand), B and C represent a bit from the 2nd and 3rd source operands. 
Each map entry takes the form of a logic expression consisting of one of more component expressions. Each 
component expression consists of either a unary or binary boolean operator and associated operands. Each binary 
boolean operator is expressed in lowercase letters, and operands concatenated after the logic operator. The unary 
operator ‘not’ is expressed using ‘!’. Additionally, the conditional expression “A?B:C” expresses a result returning B 
if A is set, returning C otherwise. 

A binary boolean operator is followed by two operands, e.g. andAB. For a compound binary expression that contain 
commutative components and comprising the same logic operator, the 2nd logic operator is omitted and three 
operands can be concatenated in sequence, e.g. andABC. When the 2nd operand of the first binary boolean expres- 
sion comes from the result of another boolean expression, the 2nd boolean expression is concatenated after the 
uppercase operand of the first logic expression, e.g. norBnandAC. When the result is independent of an operand, 
that operand is omitted in the logic expression, e.g. zeros or norCB. 

The 3-input expression “majorABC” returns 0 if two or more input bits are 0, returns 1 if two or more input bits are 
1. The 3-input expression “minorABC” returns 1 if two or more input bits are 0, returns 0 if two or more input bits 
are 1. 

The building-block bit logic functions used in Table 5-1 and Table 5-2 include: 

* Constants: TRUE (1), FALSE (0); 

¢ Unary function: Not (!); 

¢ Binary functions: and, nand, or, nor, xor, xnor; 

* Conditional function: Select (?:); 


¢ Tertiary functions: major, minor. 
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Table 5-1. Low 8 columns of the 16x16 Map of VPTERNLOG Boolean Logic Operations 


Imm [7:4] 
[3:0] | OH 1H 2H 3H 4H 5H 6H 7H 
OOH | FALSE andAnorBC norBnandAC_ | andA!B norCnandBA | andA!C andAxorBC andAnandBC 
O1H_ | norABC norCB norBxorAC A?!B:norBC norCxorBA A?!C:norBC A?xorBC:norB | A?nandBC:no 
C rBC 
02H _ | andCnorBA norBxnorAC | andC!B norBnorAC C?norBA:and | C?norBA:A C?!B:andBA C7IB:A 
BA 
03H _ | norBA norBandAC C7IB:norBA IB C?norBA:xnor | A?IC:!B A?xorBC:!B A?nandBC:!B 
BA 
04H _ | andBnorAC norCxnorBA | B?norAC:and | B?norAC:A andBIC norCnorBA B?!C:andAC B7IC:A 
AC 
O5H_ | norCA norCandBA B?norAC:xnor | A?!B:IC B?!IC:norAC IC A?xorBC:!C A?nandBC:!c 
AC 
OGH | norAxnorBC | A?norBC:xorB | B?norAC:C xorBorAC C?norBA:B xorCorBA xorCB B?IC:orAC 
C 
O7H_ | norAandBC minorABC C7IB:IA nandBorAC B?ICIA nandCorBA A?xorBC:nan | nandCB 
dBC 
O8H | norAnandBC | A?norBC:and | andCxorBA A?!B:andBC andBxorAC A?z!C:andBC A?xorBC:and | xorAandBC 
BC BC 
O9H_ | norAxorBC A?norBC:xnor | C?xorBA:norB | A7!B:xnorBC | B?xorAC:norA | A?!C:xnorBC | xnorABC A?nandBC:xn 
BC A C orBC 
OAH | andClA A?norBC:C andCnandBA | A?!B:C C7IA:andBA xorCA xorCandBA A?nandBC:C 
OBH_ | C?!A:norBA C7IA:IB C?nandBA:no | C?nandBA:!B_ | B?xorAC:!A B?xorAC:nan | C?nandBA:xn | nandBxnorAC 
rBA dAC orBA 
OCH | andBlA A?norBC:B B?!A:andAC xorBA andBnandAC | A?!C:B xorBandAC A?nandBc:B 
ODH_ | B?lIA:norAC B?IA:IC B?IA:xnorAC_ | C?xorBA:nan | B?nandAC:no | B?nandAC:!IC | B?nandAC:xn | nandCxnorBA 
dBA rAC orAC 
OEH | norAnorBC xorAorBC B?IA:C A?!B:orBC C7IA:B A?!C:orBC B?nandAC:C — | A?nandBC:or 
BC 
OFH |/A nandAorBC C?nandBA:!A | nandBA B?nandAC:lA | nandCA nandAxnorBC | nandABC 


Table 5-2 shows the half of 256-entry map corresponding to column index values 8:15. 
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Table 5-2. Low 8 columns of the 16x16 Map of VPTERNLOG Boolean Logic Operations 


Imm [7:4] 
[3:0] | 08H O9H OAH OBH OCH ODH OEH OFH 
OOH _ | andABC andAxnorBC_ | andCA B?andAC:A andBA C?andBA:A andAorBC A 
O1H_ | A?andBC:nor | B?andAC!c A?C:norBC C?A:IB A?B:norBC B?PA:IC xnorAorBC orAnorBC 
BC 
02H | andCxnorBA | B?andAC:xor | B?andAC:C B?andAC:orA | C?xnorBA:an_ | B?A:xorAC B?A:C B?A:orAC 
AC C dBA 
03H _ | A?andBC:!B xnorBandAC | A?C!B nandBnandA | xnorBA B?A:nandAC | A?orBC:!B orA!B 
C 
O4H | andBxnorAC | C?andBA:xor | B?xnorAC:an | B?xnorAC:A C?andBA:B C?andBA:orB | C?A:B C?A:orBA 
BA dAC A 
O5H_= | A?andBC!c XnorCandBA | xnorCA C?A:nandBA | A?B:!C nandCnandB_ | A?orBC:!C orA!IC 
A 
O6H_ | A?andBC:xor | xorABC A?C:xorBC B?xnorAC:orA | A?B:xorBC C?xnorBA:orB | A?orBC:xorBC | orAxorBC 
BC C A 
O7H | xnorAandBC | A?xnorBC:na | A?C:inandBC | nandBxorAC | A?B:nandBC | nandCxorBA | A?orBCnandB | orAnandBC 
ndBC C 
08H | andCB ArxnorBC:an | andCorAB B?C:A andBorAC C?B:A majorABC orAandBC 
dBC 
O9H_ | B?C:norAC XnorcB XnorCorBA C?orBA:!B XnorBorAC B?orAC!IC A?orBC:xnorB | orAxnorBC 
C 
OAH | A?andBC:C A?xnorBC:C C B?C:orAC A?B:C B?orAC:xorAC | orCandBA orCA 
OBH | B?CiA B?C:nandAC — | orCnorBA orC!B B?orACA B?orAC:nand | orCxnorBA nandBnorAC 
AC 
OCH | A?andBC:B A?xnorBC:B | A?C:B C?orBA:xorBA | B C?B:orBA orBandAC orBA 
ODH | C?BIA C?B:nandBA C?orBA:!A C?orBA:nand_ | orBnorAC orB!IC orBxnorAC nandCnorBA 
BA 
OEH | A?andBC:orB | A?xnorBC:orB | A?C:orBC orCxorBA A?B:orBC orBxorAC orCB orABC 
C C 
OFH | nandAnandB | nandAxorBC | orClA orCnandBA orBIA orBnandAC nandAnorBC_ | TRUE 
C 


Table 5-1 and Table 5-2 translate each of the possible value of the imm8 byte to a Boolean expression. These tables 
can also be used by software to translate Boolean expressions to numerical constants to form the imm8 value 
needed to construct the VPTERNLOG syntax. There is a unique set of three byte constants (FOH, CCH, AAH) that 
can be used for this purpose as input operands in conjunction with the Boolean expressions defined in those tables. 
The reverse mapping can be expressed as: 


Result_imm8 = Table_Lookup_Entry( OFOH, OCCH, OAAH) 
Table_Lookup_Entry is the Boolean expression defined in Table 5-1 and Table 5-2. 
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5.2 INSTRUCTIONS (V-Z) 


Chapter 5 continues an alphabetical discussion of Intel® 64 and IA-32 instructions (V-Z). See also: Chapter 3, 
“Instruction Set Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
2A, and Chapter 4, “Instruction Set Reference, M-U,” in the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 2B. 
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VALIGND/VALIGNQ—Align Doubleword/Quadword Vectors 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 03 /r ib A VIV AVX512VL | Shift right and merge vectors xmm_2 and 
VALIGND xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m32bcst with double-word granularity 
xmm3/m128/m32bcst, imm8 using imm8 as number of elements to shift, and store the 
final result in xmm1, under writemask. 
EVEX.128.66.0F3A.W1 03 /r ib A VIV AVX512VL | Shift right and merge vectors xmm_2 and 
VALIGNQ xmm1 {k1}{z}, xmm_2, AVX512F xmm3/m128/m64bcst with quad-word granularity using 
xmm3/m128/m64bcst, imm8 imm8 as number of elements to shift, and store the final 
result in xmm1, under writemask. 
EVEX.256.66.0F3A.WO 03 /r ib A VIV AVX512VL | Shift right and merge vectors ymm2 and 
VALIGND ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst with double-word granularity 
ymm3/m256/m32bcst, imm8 using imm8 as number of elements to shift, and store the 
final result in ymm1, under writemask. 
EVEX.256.66.0F3A.W1 03 /r ib A VIV AVX512VL | Shift right and merge vectors ymm2 and 
VALIGNQ ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst with quad-word granularity using 
ymm3/m256/m64bcst, imm8 imm8 as number of elements to shift, and store the final 
result in ymm1, under writemask. 
EVEX.512.66.0F3A.WO 03 /r ib A VIV AVX512F Shift right and merge vectors zmm2 and 
VALIGND zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst with double-word granularity 
zmm3/m51 2/m32bcst, imm8 using imm8 as number of elements to shift, and store the 
final result in zmm1, under writemask. 
EVEX.512.66.0F3A.W1 03 /r ib A VIV AVX512F Shift right and merge vectors zmm2 and 
VALIGNQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst with quad-word granularity using 
zmm3/m512/m64bcst, imm8 imm8 as number of elements to shift, and store the final 
result in zmm1, under writemask. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Concatenates and shifts right doubleword/quadword elements of the first source operand (the second operand) 
and the second source operand (the third operand) into a 1024/512/256-bit intermediate vector. The low 
512/256/128-bit of the intermediate vector is written to the destination operand (the first operand) using the 
writemask ki. The destination and first source operands are ZMM/YMM/XMM registers. The second source operand 
can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted 
from a 32/64-bit memory location. 
This instruction is writemasked, so only those elements with the corresponding bit set in vector mask register k1 


are computed and stored into zmm1. Elements in zmmi with the corresponding bit clear in ki retain their previous 
values (merging-masking) or are set to 0 (zeroing-masking). 
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Operation 


VALIGND (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


IF (SRC2 *is memory*) (AND EVEX.b = 1) 
THEN 
FOR j := 0 TO KL-1 
i:=j* 32 
src[i+3 1:1] := SRC2[31:0] 
ENDFOR; 
ELSE src := SRC2 
Fl 
; Concatenate sources 
tmp[VL-1:0] := src[VL-1:0] 
tmp[2VL-1:VL] := SRC1[VL-1:0] 
; Shift right doubleword elements 
IF VL= 128 
THEN SHIFT = imm8[1:0] 
ELSE 
IF VL = 256 
THEN SHIFT = imm8[2:0] 
ELSE SHIFT = imm8[3:0] 
Fl 
Fl; 
tmp[2VL-1:0] := tmp[2VL-1:0] >> (32*SHIFT) 
; Apply writemask 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] := tmp[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VALIGNQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256),(8, 512) 
IF (SRC2 *is memory*) (AND EVEX.b = 1) 
THEN 
FOR j := 0 TO KL-1 
i:=j* 64 
src[i+63:i] := SRC2[63:0] 
ENDFOR; 
ELSE src := SRC2 
Fl 
; Concatenate sources 
tmp[VL-1:0] := src[VL-1:0] 
tmp[2VL-1:VL] := SRC1[VL-1:0] 
; Shift right quadword elements 
IF VL= 128 
THEN SHIFT = imm8[0] 
ELSE 
IF VL = 256 
THEN SHIFT = imm8[1:0] 
ELSE SHIFT = imm8[2:0] 
Fl 
Fl; 
tmp[2VL-1:0] := tmp[2VL-1:0] >> (64*SHIFT) 
; Apply writemask 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := tmp[i+63:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VALIGND __m512i_mm512_alignr_epi32(__m512ia,___m512i 5, int cnt); 

VALIGND __m512i_mm512_mask_alignr_epi32(__m512is,__mmask16k,___m512i a, 
VALIGND __m512i_mm512_maskz_alignr_epi32(__mmask16 k,___m512ia,__m512ib, int cnt); 
VALIGND __m256i __mm256_mask_alignr_epi32(__m256is,__ mmask8 k,___ m256i a,__ m256i b, int cnt); 
VALIGND __m256i _mm256_maskz_alignr_epi32(__mmask8 k,___ m256i a,__ m256i b, int cnt); 
VALIGND __m128i __mm_mask_alignr_epi32(__m128is,__ mmask8 k,___m128ia,__m128i, int cnt); 
VALIGND __m128i __mm_maskz_alignr_epi32(__mmask8 k,___m128i a, ___m128i b, int cnt); 

VALIGNQ __m512i_mm512_alignr_epi64(__m512i a, __m512i b, int cnt); 

VALIGNQ __m512i_mm512_mask_alignr_epi64(__m512is,__ mmask8 k, __m512i a,__m512ib, int cnt); 
VALIGNQ __m512i __mm512_maskz_alignr_epi64(_mmask8 k, __m512i a,__m512ib, int cnt); 
VALIGNQ __m256i__mm256_mask_alignr_epi64(__m256i s, __mmask8 k, __m256i a,___m256i b, int cnt); 
VALIGNQ __m256i __mm256_maskz_alignr_epi64(__mmask8 k, __m256i a,__m256i b, int cnt); 
VALIGNQ __m128i __mm_mask_alignr_epi64(__m128i s,___mmask8 k, __m128i a, ___m128i b, int cnt); 
VALIGNQ __m128i __mm_maskz_alignr_epi64(__mmask8 k, __m128i a, ___m128i, int cnt); 


m512ib, int cnt); 


Exceptions 
See Table 2-50, “Type E4NF Class Exception Conditions”. 
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VBLENDMPD/VBLENDMPS—Blend Float64/Float32 Vectors Using an OpMask Control 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 65 /r A VV AVX512VL | Blend double-precision vector xmm_2 and double-precision 
VBLENDMPD xmm1 {k1}{Z}, AVX512F vector xmm3/m128/m64bcst and store the result in xmm1, 
xmm_2, xmm3/m128/m64bcst under control mask. 
EVEX.256.66.0F38.W1 65 /r A VIV AVX512VL | Blend double-precision vector ymm2 and double-precision 
VBLENDMPD ymm1 {k1}{Z}, AVX512F vector ymm3/m256/m64bcst and store the result in ymm1, 
ymm_2, ymm3/m256/m64bcst under control mask. 
EVEX.512.66.0F38.W1 65 /r A VIV AVX512F Blend double-precision vector zmm2 and double-precision 
VBLENDMPD zmm1 {k1}{z}, vector zmm3/m512/m64bcst and store the result in zmm1, 
zmm2, zmm3/m512/m64bcst under control mask. 
EVEX.128.66.0F38.W0O 65 /r A VIV AVX512VL | Blend single-precision vector xmm2 and single-precision 
VBLENDMPS xmm1 {k1}{Z}, AVX512F vector xmm3/m128/m32bcst and store the result in xmm1, 
xmm2, xmm3/m1 28/m32bcst under control mask. 
EVEX.256.66.0F38.W0 65 /r A VIV AVX512VL | Blend single-precision vector ymm2 and single-precision 
VBLENDMPS ymm1 {k1}{Z}, AVX512F vector ymm3/m256/m32bcst and store the result in ymm1, 
ymm_2, ymm3/m256/m32bcst under control mask. 
EVEX.512.66.0F38.W0 65 /r A VIV AVX512F Blend single-precision vector zmme2 and single-precision 
VBLENDMPS zmm1 {k1}{Z}, vector zmm3/m512/m32bcst using k1 as select control and 
zmm2, zmm3/m512/m32bcst store the result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an element-by-element blending between float64/float32 elements in the first source operand (the 
second operand) with the elements in the second source operand (the third operand) using an opmask register as 
select control. The blended result is written to the destination register. 


The destination and first source operands are ZMM/YMM/XMM registers. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. 


The opmask register is not used as a writemask for this instruction. Instead, the mask is used as an element 
selector: every element of the destination is conditionally selected between first source or second source using the 
value of the related mask bit (0 for first source operand, 1 for second source operand). 


If EVEX.z is set, the elements with corresponding mask bit value of 0 in the destination operand are zeroed. 


VBLENDMPD/VBLENDMPS—Blend Float64/Float32 Vectors Using an OpMask Control Vol.2C 5-9 


INSTRUCTION SET REFERENCE, V-Z 


Operation 

VBLENDMPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no controlmask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+63:i] = SRC2[63:0] 
ELSE 
DEST[i+63:i] := SRC2[i+63:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN DEST{[i+63:i] = SRC1[i+63:i] 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 

VBLENDMPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no controlmask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] = SRC2[31:0] 
ELSE 
DEST[i+31:i] := SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN DEST{[i+31:i] = SRC1[i+31:i] 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VBLENDMPD 
VBLENDMPD 
VBLENDMPD 
VBLENDMPS 
VBLENDMPS 
VBLENDMPS 


m512d_mm512_mask_blend_pd(__mmask8 k,___m512da,__m512d b); 


m256d __mm256_mask_blend_pd(__mmask8 k,__ m256d a,___ m256d b); 
m128d __mm_mask_blend_pd(__mmask8 k,___m128da,__m128d b); 


m512_mm512_mask_blend_ps(__mmask16 k,__m512 a,__m512 b); 


m256 _mm256_mask_blend_ps(__mmask8 k,___m256 a, ___m256 b); 


m128 __mm_mask_blend_ps(__mmask8 k,__m128 a,__m128 b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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VBROADCAST—Load with Broadcast Floating-Point Data 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Feature 

Mode Flag 

Support 
VEX.128.66.0F38.WO 18 /r A VIV AVX Broadcast single-precision floating-point element in 
VBROADCASTSS xmm1, m32 mem to four locations in xmm1. 
VEX.256.66.0F38.W0O 18 /r A VIV AVX Broadcast single-precision floating-point element in 
VBROADCASTSS ymm1, m32 mem to eight locations in ymm1. 
VEX.256.66.0F38.W0 19 /r A VIV AVX Broadcast double-precision floating-point element in 
VBROADCASTSD ymm1, m64 mem to four locations in ymm1. 
VEX.256.66.0F38.W0 1A /r A VIV AVX Broadcast 128 bits of floating-point data in mem to 
VBROADCASTF128 ymm1, m128 low and high 128-bits in ymm1. 
VEX.128.66.0F38.W0 18/r A VIV AVX2 Broadcast the low single-precision floating-point 
VBROADCASTSS xmm1, xmm2 element in the source operand to four locations in 

xmm1. 

VEX.256.66.0F38.W0 18 /r A VV AVX2 Broadcast low single-precision floating-point element 
VBROADCASTSS ymm1, xmm2 in the source operand to eight locations in ymm1. 
VEX.256.66.0F38.W0 19 /r A VIV AVX2 Broadcast low double-precision floating-point element 
VBROADCASTSD ymm1, xmm2 in the source operand to four locations in ymm1. 
EVEX.256.66.0F38.W1 19 /r B VIV AVX512VL | Broadcast low double-precision floating-point element 
VBROADCASTSD ymm1 {k1}{z}, AVX512F in xmm2/m64 to four locations in ymm1 using 
xmm2/m64 writemask k1. 
EVEX.512.66.0F38.W1 19 /r B VIV AVX512F Broadcast low double-precision floating-point element 
VBROADCASTSD zmm1 {k1}{Z}, in xmm2/m64 to eight locations in zmm1 using 
xmm2/m64 writemask k1. 
EVEX.256.66.0F38.W0 19 /r C VIV AVX512VL | Broadcast two single-precision floating-point elements 
VBROADCASTF32X2 ymm1 {k1}{Z}, AVX512DQ | in xmm2/m64 to locations in ymm1 using writemask 
xmm2/m64 k1. 
EVEX.512.66.0F38.W0 19 /r C VIN AVX512DQ | Broadcast two single-precision floating-point elements 
VBROADCASTF32X2 zmm1 {k1}{Z}, in xmm2/m64 to locations in zmm1 using writemask 
xmm2/m64 k1. 
EVEX.128.66.0F38.W0 18 /r B VIV AVX512VL | Broadcast low single-precision floating-point element 
VBROADCASTSS xmm1 {k1}{z}, AVX512F in xmm2/m32 to all locations in xmm1 using 
xmm2/m32 writemask k1. 
EVEX.256.66.0F38.W0 18 /r B VIV AVX512VL | Broadcast low single-precision floating-point element 
VBROADCASTSS ymm1 {k1}{z}, AVX512F in xmm2/m32 to all locations in ymm1 using 
xmm2/m32 writemask k1. 
EVEX.512.66.0F38.W0 18 /r B VIV AVX512F Broadcast low single-precision floating-point element 
VBROADCASTSS zmm1 {k1}{Z}, in xmm2/m32 to all locations in zmm1 using 
xmm2/m32 writemask k1. 
EVEX.256.66.0F38.W0 1A /r D VIV AVX512VL | Broadcast 128 bits of 4 single-precision floating-point 
VBROADCASTF32X4 ymm1 {k1}{z}, AVX512F data in mem to locations in ymm1 using writemask k1. 
m128 
EVEX.512.66.0F38.W0 1A /r D VIV AVX512F Broadcast 128 bits of 4 single-precision floating-point 
VBROADCASTF32X4 zmm1 {k1}{Z}, data in mem to locations in zmm1 using writemask k1. 
m128 
EVEX.256.66.0F38.W1 1A /r C VIV AVX512VL | Broadcast 128 bits of 2 double-precision floating-point 
VBROADCASTF64X2 ymm1 {k1}{Z}, AVX512DQ | data in mem to locations in ymm1 using writemask k1. 


mi28 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Feature 

Mode Flag 

Support 
EVEX.512.66.0F38.W1 1A /r C VIN AVX512DQ | Broadcast 128 bits of 2 double-precision floating-point 
VBROADCASTF64X2 zmm1 {k1}{Z}, data in mem to locations in zmm1 using writemask k1. 
m128 
EVEX.512.66.0F38.W0 1B /r E VIN AVX512DQ | Broadcast 256 bits of 8 single-precision floating-point 
VBROADCASTF32X8 zmm1 {k1}{Z}, data in mem to locations in zmm1 using writemask k1. 
m256 
EVEX.512.66.0F38.W1 1B /r D VIV AVX512F Broadcast 256 bits of 4 double-precision floating-point 
VBROADCASTF64X4 zmm1 {k1}{Z}, data in mem to locations in zmm1 using writemask k1. 
m256 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
C Tuple2 ModRM:reg (w) ModRM:r/m (r) NA NA 
D Tuple4 ModRM:reg (w) ModRM:r/m (r) NA NA 
E Tuple8 ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


VBROADCASTSD/VBROADCASTSS/VBROADCASTF128 load floating-point values as one tuple from the source 
operand (second operand) in memory and broadcast to all elements of the destination operand (first operand). 


VEX256-encoded versions: The destination operand is a YMM register. The source operand is either a 32-bit, 64- 
bit, or 128-bit memory location. Register source encodings are reserved and will #UD. Bits (MAXVL-1:256) of the 
destination register are zeroed. 


EVEX-encoded versions: The destination operand is a ZMM/YMM/XMM register and updated according to the 
writemask ki. The source operand is either a 32-bit, 64-bit memory location or the low doubleword/quadword 
element of an XMM register. 
VBROADCASTF32X2/VBROADCASTF32X4/VBROADCASTF64X2/VBROADCASTF32X8/VBROADCASTF64X4 load 
floating-point values as tuples from the source operand (the second operand) in memory or register and broadcast 
to all elements of the destination operand (the first operand). The destination operand is a YMM/ZMM register 
updated according to the writemask ki. The source operand is either a register or 64-bit/128-bit/256-bit memory 
location. 

VBROADCASTSD and VBROADCASTF128,F32x4 and F64x2 are only supported as 256-bit and 512-bit wide 
versions and up. VBROADCASTSS is supported in 128-bit, 256-bit and 512-bit wide versions. F32x8 and F64x4 are 
only supported as 512-bit wide versions. 


VBROADCASTF32X2/VBROADCASTF32X4/VBROADCASTF32X8 have 32-bit granularity. VBROADCASTF64X2 and 
VBROADCASTF64X4 have 64-bit granularity. 


Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


If VBROADCASTSD or VBROADCASTF128 is encoded with VEX.L= 0, an attempt to execute the instruction encoded 
with VEX.L= 0 will cause an #UD exception. 
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DES] xo x0 x0 x0 x0 x0 XO x0 


Figure 5-1. VBROADCASTSS Operation (VEX.256 encoded version) 


m32 x0 


DES ) 0 0 ) Xo Xo Xo XO 


Figure 5-2. VBROADCASTSS Operation (VEX.128-bit version) 


m64 xo 
X0 x0 X0 X0 


Figure 5-3. VBROADCASTSD Operation (VEX.256-bit version) 


DEST| 


m128 xO 


XO x 


DEST| 0 


Figure 5-4. VBROADCASTF1 28 Operation (VEX.256-bit version) 
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m256 


XO 


DEST| xo 


XO 


Figure 5-5. VBROADCASTF64X4 Operation (512-bit version with writemask all 1s) 


Operation 


VBROADCASTSS (128 bit version VEX and legacy) 
temp := SRC[31:0] 

DEST[31:0] := temp 

DEST[63:32] := temp 

DEST[95:64] := temp 

DEST[127:96] := temp 

DEST[MAXVL-1:128] := 0 


VBROADCASTSS (VEX.256 encoded version) 
temp := SRC[31:0] 
DEST[31:0] := temp 
DEST[63:32] := temp 
DEST[95:64] := temp 
DEST[127:96] := temp 
DEST[159:1 28] := temp 
DEST[191:160] := temp 
DEST[223:192] := temp 
DEST[255:224] := temp 
DEST[MAXVL-1:256] := 0 


VBROADCASTSS (EVEX encoded versions) 
(KL, VL) (4, 128), (8, 256),= (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[31:0] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VBROADCASTSD (VEX.256 encoded version) 
temp := SRC[63:0] 

DEST[63:0] := temp 

DEST[127:64] := temp 

DEST[191:128] := temp 

DEST[255:192] := temp 

DEST[MAXVL-1:256] := 0 


VBROADCASTSD (EVEX encoded versions) 
(KL, VL) = (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[63:0] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VBROADCASTF32x2 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
n:= (j mod 2) * 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[n+31:n] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VBROADCASTF1 28 (VEX.256 encoded version) 
temp := SRC[127:0] 

DEST[127:0] := temp 

DEST[255:1 28] := temp 

DEST[MAXVL-1:256] := 0 
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VBROADCAST—Load with Broadcast Floating-Point Data 


VBROADCASTF32X4 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
n:= (j modulo 4) * 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[n+31:n] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VBROADCASTF64X2 (EVEX encoded versions) 
(KL, VL) = (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
n:= (j modulo 2) * 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[n+63:n] 


ELSE 

IF *merging-masking* ; mMerging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] = 0 
Fl 
Fl; 
ENDFOR; 


VBROADCASTF32X8 (EVEX.U1.512 encoded version) 
FOR j:=0TO15 
i:=j* 32 
n:= (j modulo 8) * 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[n+31:n] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VBROADCASTF64X4 (EVEX.512 encoded version) 
FOR j :=OTO7 
i:=j* 64 
n:= (j modulo 4) * 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[n+63:n] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VBROADCASTF32x2 __m512_mm512_broadcast_f32x2(__m128 a); 
VBROADCASTF32x2 __m512 _mm512_mask_broadcast_f32x2(__m512 s,__mmask16 k, 
VBROADCASTF32x2 __m512_mm512_maskz_broadcast_f32x2(__mmask16 k,__m128 a); 
VBROADCASTF32x2 __m256 _mm256_broadcast_f32x2(__m128 a); 

VBROADCASTF32x2 __m256 __mm256_mask_broadcast_f32x2(__m256 s,__ mmask8 k,__m128 a); 
VBROADCASTF32x2 __m256 __mm256_maskz_broadcast_f32x2(__mmask8 k,__m128 a); 
VBROADCASTF32x4 __m512_mm512_broadcast_f32x4(__m128 a); 
VBROADCASTF32x4 __m512 _mm512_mask_broadcast_f32x4(__m512 s,__mmask16 k, 
VBROADCASTF32x4 __m512_mm512_maskz_broadcast_f32x4(__mmask16 k,__m128 a); 
VBROADCASTF32x4 __m256 _mm256_broadcast_f32x4(__m128 a); 

VBROADCASTF32x4 __m256 _mm256_mask_broadcast_f32x4(__m256 s,___ mmask8 k,__m128 a); 
VBROADCASTF32x4 __m256 _mm256_maskz_broadcast_f32x4(__mmask8 k,___m128 a); 
VBROADCASTF32x8 __m512_mm512_broadcast_f32x8(__m256 a); 
VBROADCASTF32x8 __m512 _mm512_mask_broadcast_f32x8(__m512 s,__mmask16 k, 
VBROADCASTF32x8 __m512_mm512_maskz_broadcast_f32x8(__mmask16 k,___m256 a); 
VBROADCASTF64x2 __m512d_mm512_broadcast_f64x2(__m128d a); 

VBROADCASTF64x2 __m512d_mm512_mask_broadcast_f64x2(__m512ds,__mmask8 k,__m128d a); 
VBROADCASTF64x2 __m512d_mm512_maskz_broadcast_f64x2(__mmask8 k,__m128d a); 
VBROADCASTF64x2 __m256d_mm256_broadcast_f64x2(__m128d a); 
VBROADCASTF64x2 __m256d __mm256_mask_broadcast_f64x2(__m256d s, 
VBROADCASTF64x2 __m256d __mm256_maskz_broadcast_f64x2(__mmask8 k, 
VBROADCASTF64x4 __m512d_mm512_broadcast_f64x4(__m256d a); 
VBROADCASTF64x4 __m512d_mm512_mask_broadcast_f64x4(__m512ds,__mmask8 k,__m256d a); 
VBROADCASTF64x4 __m512d_mm512_maskz_broadcast_f64x4(__mmask8 k,__m256d a); 
VBROADCASTSD __m512d_mm512_broadcastsd_pd(__m128d a); 
VBROADCASTSD __m512d_mm512_mask_broadcastsd_pd(__m512d s, 
VBROADCASTSD __m512d_mm512_maskz_broadcastsd_pd(__mmask8 k, 
VBROADCASTSD __m256d __mm256_broadcastsd_pd(__m128d a); 
VBROADCASTSD __m256d __mm256_mask_broadcastsd_pd(__m256d s,__ mmask8 k,__m128d a); 
VBROADCASTSD __m256d __mm256_maskz_broadcastsd_pd(__mmask8 k, __m128d a); 
VBROADCASTSD __m256d __mm256_broadcast_sd(double *a); 

VBROADCASTSS __m512 _mm512_broadcastss_ps(__m128 a); 

VBROADCASTSS __m512 _mm512_mask_broadcastss_ps(__m512 s,__mmask16 k,__m128 a); 
VBROADCASTSS __m512 _mm512_maskz_broadcastss_ps(__mmask16 k,___m128 a); 
VBROADCASTSS __m256 _mm256_broadcastss_ps(__m128 a); 
VBROADCASTSS __m256 _mm256_mask_broadcastss_ps(__m256 s, 
VBROADCASTSS __m256 __mm256_maskz_broadcastss_ps(__mmask8 k, 


m128 a); 


m128 a); 


m256 a); 


mmask8 k, __m128d a); 
m128d a); 


mmask8 k, 
m128d a); 


m1 28d a); 


mmask8 k, 
m128 a); 


m128 a); 
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VBROADCASTSS __m128 _mm_broadcastss_ps(__m128 a); 

VBROADCASTSS __m128 __mm_mask_broadcastss_ps(__m128s,__mmask8 k,__m128 a); 
VBROADCASTSS __m128 __mm_maskz_broadcastss_ps(__mmask8 k,___m128 a); 
VBROADCASTSS __m128_mm_broadcast_ss(float *a); 

VBROADCASTSS __m256 __mm256_broadcast_ss(float *a); 

VBROADCASTF128 __m256 _mm256_broadcast_ps(__m128 * a); 

VBROADCASTF128 __m256d _mm256_broadcast_pd(__m1 28d * a); 


Exceptions 

VEX-encoded instructions, see Table 2-23, “Type 6 Class Exception Conditions”. 

EVEX-encoded instructions, see Table 2-53, “Type E6 Class Exception Conditions”. 

Additionally: 

#UD If VEX.L = 0 for VBROADCASTSD or VBROADCASTF128. 
If EVEX.L’L = 0 for VBROADCASTSD/VBROADCASTF32X2/VBROADCASTF32X4/VBROADCASTF64X2. 
If EVEX.L’L < 10b for VBROADCASTF32X8/VBROADCASTF64X4. 


VBROADCAST—Load with Broadcast Floating-Point Data Vol.2C 5-19 


INSTRUCTION SET REFERENCE, V-Z 


VCOMPRESSPD-—Store Sparse Packed Double-Precision Floating-Point Values into Dense 


Memory 

Opcode/ Op/ | 64/32 CPUID Description 

Instruction En bit Mode | Feature 

Support | Flag 

EVEX.128.66.0F38.W1 8A /r A VIV AVX512VL | Compress packed double-precision floating-point 

VCOMPRESSPD xmm1/m128 {k1}{z}, AVX512F values from xmm2 to xmm1/m128 using writemask 

xmm2 k1. 

EVEX.256.66.0F38.W1 8A /r A VIV AVX512VL | Compress packed double-precision floating-point 

VCOMPRESSPD ymm1/m256 {k1}{Z}, AVX512F values from ymm2 to ymm1/m256 using writemask 

ymm2 k1. 

EVEX.512.66.0F38.W1 8A /r A VIV AVX512F Compress packed double-precision floating-point 

VCOMPRESSPD zmm1/m512 {k1}{Z}, values from zmm_2 using control mask k1 to 

zmm2 zmm1/m512. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 

Description 


Compress (store) up to 8 double-precision floating-point values from the source operand (the second operand) as 
a contiguous vector to the destination operand (the first operand) The source operand is aZMM/YMM/XMM register, 
the destination operand can be a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 

The opmask register ki selects the active elements (partial vector or possibly non-contiguous if less than 8 active 
elements) from the source operand to compress into a contiguous vector. The contiguous vector is written to the 
destination starting from the low element of the destination operand. 

Memory destination version: Only the contiguous vector is written to the destination memory location. EVEX.z 
must be zero. 

Register destination version: If the vector length of the contiguous vector is less than that of the input vector in the 
source operand, the upper bits of the destination register are unmodified if EVEX.z is not set, otherwise the upper 
bits are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VCOMPRESSPD (EVEX encoded versions) store form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
SIZE := 64 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+63:i] 
k:=k+ SIZE 
Fl; 


ENDFOR 
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VCOMPRESSPD (EVEX encoded versions) reg-reg form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
SIZE := 64 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+63:i] 
k:=k + SIZE 
Fl; 
ENDFOR 
IF *merging-masking* 
THEN *DEST[VL-1:k] remains unchanged* 
ELSE DEST[VL-1:k] := 0 
Fl 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCOMPRESSPD __m512d_mm512_mask_compress_pd(__m512ds,__ mmask8 k,__m512d a); 
VCOMPRESSPD __m512d_mm512_maskz_compress_pd(__mmask8 k,___m512d a); 
VCOMPRESSPD void __mm512_mask_compressstoreu_pd( void * d,__ mmask8 k,___m512d a); 
VCOMPRESSPD __m256d_mm256_mask_compress_pd(__m256ds,__ mmask8 k,___ m256d a); 
VCOMPRESSPD __m256d__mm256_maskz_compress_pd(__mmask8 k, __m256d a); 
VCOMPRESSPD void _mm256_mask_compressstoreu_pd( void * d,__ mmask8 k, __ m256d a); 
VCOMPRESSPD __m128d_mm_mask_compress_pd(__m128ds,__ mmask8 k,___m128d a); 
VCOMPRESSPD __m128d_mm_maskz_compress_pd(__mmask8 k,___m128d a); 
VCOMPRESSPD void _mm_mask_compressstoreu_pd( void * d,__ mmask8 k,___m128d a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


EVEX-encoded instructions, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”; 
additionally: 


#UD If EVEX.vvvv != 1111B. 
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VCOMPRESSPS-—Store Sparse Packed Single-Precision Floating-Point Values into Dense Memory 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0O 8A /r A VIV AVX512VL | Compress packed single-precision floating-point 
VCOMPRESSPS xmm1/m128 {k1}{z}, AVX512F values from xmm2 to xmm1/m128 using writemask 
xmm2 k1. 
EVEX.256.66.0F38.W0 8A /r A VIV AVX512VL | Compress packed single-precision floating-point 
VCOMPRESSPS ymm1/m256 {k1}{Z}, AVX512F values from ymm2 to ymm1/m256 using writemask 
ymm2 k1. 
EVEX.512.66.0F38.W0 8A /r A VIV AVX512F Compress packed single-precision floating-point 
VCOMPRESSPS zmm1/m512 {k1}{z}, values from zmm_2 using control mask k1 to 
zmm2 zmmi/m512. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Compress (stores) up to 16 single-precision floating-point values from the source operand (the second operand) to 
the destination operand (the first operand). The source operand is a ZMM/YMM/XMM register, the destination 
operand can be a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 

The opmask register k1 selects the active elements (a partial vector or possibly non-contiguous if less than 16 
active elements) from the source operand to compress into a contiguous vector. The contiguous vector is written to 
the destination starting from the low element of the destination operand. 

Memory destination version: Only the contiguous vector is written to the destination memory location. EVEX.z 
must be zero. 

Register destination version: If the vector length of the contiguous vector is less than that of the input vector in the 
source operand, the upper bits of the destination register are unmodified if EVEX.z is not set, otherwise the upper 
bits are zeroed. 

EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VCOMPRESSPS (EVEX encoded versions) store form 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
SIZE := 32 
k:=0 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+31:i] 
k:=k+ SIZE 
Fl; 


ENDFOR; 
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VCOMPRESSPS (EVEX encoded versions) reg-reg form 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
SIZE := 32 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+31:i] 
k:=k + SIZE 
Fl; 
ENDFOR 
IF *merging-masking* 
THEN *DEST[VL-1:k] remains unchanged* 
ELSE DEST[VL-1:k] := 0 
Fl 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCOMPRESSPS __m512_mm512_mask_compress_ps(__m512s,__ mmask16 k,__m512 a); 
VCOMPRESSPS __m512_mm512_maskz_compress_ps(__mmask16 k,___m512 a); 
VCOMPRESSPS void _mm512_mask_compressstoreu_ps( void * d,__ mmask16 k,__m512 a); 
VCOMPRESSPS __m256 _mm256_mask_compress_ps(__m256s,__ mmask8 k,___m256 a); 
VCOMPRESSPS __m256 __mm256_maskz_compress_ps(__mmask8 k, __m256 a); 
VCOMPRESSPS void _mm256_mask_compressstoreu_ps( void * d,__ mmask8 k,___m256 a); 
VCOMPRESSPS __m128_mm_mask_compress_ps(__m128s,__ mmask8 k,__m128 a); 
VCOMPRESSPS __m128_mm_maskz_compress_ps(__mmask8 k, __m128 a); 
VCOMPRESSPS void _mm_mask_compressstoreu_ps( void * d,__ mmask8 k,___m128 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


EVEX-encoded instructions, see Exceptions Type E4.nb. in Table 2-49, “Type E4 Class Exception Conditions”; 
additionally: 


#UD If EVEX.vvvv != 1111B. 
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VCVTNE2PS2BF 16—Convert Two Packed Single Data to One Packed BF16 Data 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 

Support 
EVEX.128.F2.0F38.W0 72 /r A VIV AVX512VL Convert packed single data from xmm2 and 
VCVTNE2PS2BF16 xmm1{k1}{Z}, AVX512_BF16 xmm3/m128/m32bcst to packed BF16 data in 
xmm2, xmm3/m1 28/m32bcst xmm1 with writemask k1. 
EVEX.256.F2.0F38.W0 72 /r A VIV AVX512VL Convert packed single data from ymm2 and 
VCVTNE2PS2BF16 ymm1{k1}{2}, AVX512_BF16 ymm3/m256/m32bcst to packed BF16 data in 
ymme2, ymm3/m256/m32bcst ymm1 with writemask k1. 
EVEX.512.F2.0F38.W0 72 /r A VIV AVX512F Convert packed single data from zmm2 and 
VCVTNE2PS2BF16 zmm1{k1}{z}, AVX512_BF16 zmm3/m512/m32bcst to packed BF16 data in 
zmm2, zmm3/m512/m32bcst zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts two SIMD registers of packed single data into a single register of packed BF16 data. 
This instruction does not support memory fault suppression. 
This instruction uses “Round to nearest (even)” rounding mode. Output denormals are always flushed to zero and 


input denormals are always treated as zero. MXCSR is not consulted nor updated. No floating-point exceptions are 
generated. 


Operation 


VCVTNE2PS2BF16 dest, src1, src2 
VL = (128, 256, 512) 
KL = VL/16 


origdest := dest 
FOR i := 0 to KL-1: 
IF k1[ i] or *no writemask*: 
IFi < KL/2: 
IF src2 is memory and evex.b == 1: 
= src2.fp32[0] 
ELSE: 
= src2.fp32[ i] 
ELSE: 
= srcl.fp32[ i-KL/2] 


// See VCVTNEPS2BF 16 for definition of convert helper function 
dest.word[i] := convert_fp32_to_bfloat16(t) 


ELSE IF *zeroing*: 
dest.word[ i ]:= 0 
ELSE: // Merge masking, dest element unchanged 
dest.word{ i ]:= origdest.word[ i ] 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VCVTNE2PS2BF16 __m128bh __mm_cvtne2ps_pbh (__m128, __m128); 


VCVTNE2PS2BF16 __m128bh __mm_mask_cvtne2ps_pbh (__m128bh, __mmask8, 
VCVTNE2PS2BF16 __m128bh _mm_maskz_cvtne2ps_pbh (__mmask8, __m128,__m128); 


VCVTNE2PS2BF16 __m256bh __mm256_cvtne2zps_pbh (__m256, __m256); 


VCVTNE2PS2BF16 __m256bh __mm256_mask_cvtne2ps_pbh (__m256bh, __ mmask16, 
VCVTNE2PS2BF16 __m256bh __mm256_maskz_cvtne2ps_ pbh (__mmask16, 


VCVTNE2PS2BF16 __m512bh_mm512_cvtne2ps_pbh (__m512,___m512); 


VCVTNE2PS2BF16 __m512bh_mm512_mask_cvtne2ps_pbh (__m512bh, __ mmask32, 


VCVTNE2PS2BF16 __m512bh __mm512_maskz_cvtne2ps_pbh (__mmask32, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-50, “Type E4NF Class Exception Conditions”. 


VCVTNE2PS2BF16—Convert Two Packed Single Data to One Packed BF16 Data 


INSTRUCTION SET REFERENCE, V-Z 


m128,__m128); 


m256, __m256); 


m512,__m512); 


Vol.2C 5-25 


INSTRUCTION SET REFERENCE, V-Z 


VCVTNEPS2BF 16—Convert Packed Single Data to Packed BF16 Data 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 

Support 
EVEX.128.F3.0F38.W0 72 /r A VIV AVX512VL Convert packed single data from xmm2/m128 
VCVTNEPS2BF16 xmm1{k1}{Z}, AVX512_BF16 to packed BF16 data in xmm1 with writemask 
xmm2/m128/m32bcst k1, 
EVEX.256.F3.0F38.W0 72 /r A VIV AVX512VL Convert packed single data from ymm2/m256 
VCVTNEPS2BF16 xmm1{k1}{Z}, AVX512_BF16 to packed BF16 data in xmm1 with writemask 
ymm2/m256/m32bcst k1. 
EVEX.512.F3.0F38.W0 72 /r A VIV AVX512F Convert packed single data from zmm2/m512 
VCVTNEPS2BF16 ymm1{k1}{Z}, AVX512_BF16 to packed BF16 data in ymm1 with writemask 
zmm2/m512/m32bcst k1, 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts one SIMD register of packed single data into a single register of packed BF16 data. 


This instruction uses “Round to nearest (even)” rounding mode. Output denormals are always flushed to zero and 
input denormals are always treated as zero. MXCSR is not consulted nor updated. 


As the instruction operand encoding table shows, the EVEX.vvvv field is not used for encoding an operand. 
EVEX.vvvv is reserved and must be 0b1111 otherwise instructions will #UD. 


Operation 


Define convert_fp32_to_bfloat1 6(x): 

IF x is zero or denormal: 
dest[15] := x[31] // sign preserving zero (denormal go to zero) 
dest[14:0] := 0 

ELSE IF x is infinity: 
dest[15:0] := x[31:16] 

ELSE IF x is NAN: 
dest[15:0] := x[31:16] // truncate and set MSB of the mantissa to force QNAN 
dest[6] := 1 

ELSE // normal number 
LSB := x[16] 
rounding_bias ‘= OxOO007FFF + LSB 
temp[31:0] := x[31:0] + rounding_bias // integer add 
dest[15:0] := temp[31:16] 

RETURN dest 


5-26 Vol. 2C VCVTNEPS2BF16—Convert Packed Single Data to Packed BF16 Data 


VCVTNEPS2BF16 dest, src 
VL = (128, 256, 512) 
KL =VL/16 


origdest := dest 
FOR i := 0 to KL/2-1: 
IF k1[ i] or *no writemask*: 
IF src is memory and evex.b == 1: 
t:= src.fp32[0] 
ELSE: 
= src.fp32[ i] 


dest.word[i] ‘= convert_fp32_to_bfloat16(t) 


ELSE IF *zeroing*: 
dest.word[ i]:= 0 
ELSE: // Merge masking, dest element unchanged 
dest.word[ i] := origdest.word[ i ] 
DEST[MAXVL-1:VL/2] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTNEPS2BF16 __m128bh __mm_cvtneps_pbh (__m128); 

VCVTNEPS2BF16 __m128bh _mm_mask_cvtneps_pbh (__m128bh, ___mmask8,__m128); 
VCVTNEPS2BF16 __m128bh __mm_maskz_cvtneps_pbh (__mmask8, __m128); 
VCVTNEPS2BF16 __m128bh __mm256_cvtneps_pbh (__m256); 

VCVTNEPS2BF16 __m128bh __mm256_mask_cvtneps_pbh (__m128bh, __mmask8, __m256); 
VCVTNEPS2BF16 __m128bh _mm256_maskz_cvtneps_pbh (__mmask8, __m256); 
VCVTNEPS2BF16 __m256bh __mm512_cvtneps_pbh (__m512); 

VCVTNEPS2BF16 __m256bh __mm512_mask_cvtneps_pbh (__m256bh, __mmask16, 
VCVTNEPS2BF16 __m256bh __mm512_maskz_cvtneps_pbh (__mmask16, __m512); 


m512); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 


VCVTNEPS2BF16—Convert Packed Single Data to Packed BF16 Data 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-27 


INSTRUCTION SET REFERENCE, V-Z 


VCVTPD2QQ—Convert Packed Double-Precision Floating-Point Values to Packed Quadword 


Integers 

Opcode/ Op/ | 64/32 CPUID Description 

Instruction En bit Mode | Feature 

Support | Flag 

EVEX.128.66.0F.W1 7B /r A VIV AVX512VL_ | Convert two packed double-precision floating-point values from 

VCVTPD2QQ xmm1 {k1}{Z}, AVX512DQ | xmm2/m128/m64bcst to two packed quadword integers in 

xmm2/m128/m64bcst xmm1 with writemask k1. 

EVEX.256.66.0F.W1 7B /r A VIN AVX512VL_ | Convert four packed double-precision floating-point values from 

VCVTPD2QQ ymm1 {k1}{Z}, AVX512DQ | ymm2/m256/m64bcst to four packed quadword integers in 

ymm2/m256/m64bcst ymm1 with writemask k1. 

EVEX.512.66.0F.W1 7B /r A VN AVX512DQ_ | Convert eight packed double-precision floating-point values 

VCVTPD2QQ zmm1 {k1}{Z}, from zmm2/m512/m64bcst to eight packed quadword integers 

zmm2/m512/m64bcst{er} in zmm1 with writemask k1. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 

Description 


Converts packed double-precision floating-point values in the source operand (second operand) to packed quad- 
word integers in the destination operand (first operand). 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operation is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the indefinite integer value 
(2-1, where w represents the number of bits in the destination format) is returned. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VCVTPD2QQ (EVEX encoded version) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL == 512) AND (EVEX.b == 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_QuadInteger(SRC[i+63:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPD2QQ (EVEX encoded version) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] = Convert_Double_Precision_Floating_Point_To_QuadInteger(SRC[63:0}) 
ELSE 
DEST[i+63:i] := Convert_Double_Precision_Floating_Point_To_QuadInteger(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPD2QQ—Convert Packed Double-Precision Floating-Point Values to Packed Quadword Integers 


Vol.2C 5-29 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPD2QQ __m512i__mm512_cvtpd_epi64(__m512d a); 

VCVTPD2QQ __m512i_mm512_mask_cvtpd_epi64(__m512is,__ mmask8 k, 
VCVTPD2QQ __m512i__mm512_maskz_cvtpd_epi64(__mmask8 k, __m512d a); 

VCVTPD2QQ __m512i__mm512_cvt_roundpd_epi64(_m512d a, int r); 

VCVTPD2QQ __m512i__mm512_mask_cvt_roundpd_epi64(_m512is,___mmask8 k,___m512d a, int r); 
VCVTPD2QQ __m512i __mm512_maskz_cvt_roundpd_epi64(__mmask8 k, __m512d a, int r); 
VCVTPD2QQ __m256i _mm256_mask_cvtpd_epi64(__m256i s, __ mmask8 k, __m256d a); 
VCVTPD2QQ __m256i _mm256_maskz_cvtpd_epi64(_mmask8 k, __m256d a); 

VCVTPD2QQ __m128i __mm_mask_cvtpd_epi64(__m128is, _mmask8 k, __m128d a); 

VCVTPD2QQ __m128i _mm_maskz_cvtpd_epi64(__mmask8 k, __m128d a); 

VCVTPD2QQ __m256i __mm256_cvtpd_epi64 (__m256d src) 

VCVTPD2QQ __m128i _mm_cvtpd_epi64 (__m128d src) 


m512d a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTPD2UDQ—Convert Packed Double-Precision Floating-Point Values to Packed Unsigned 
Doubleword Integers 


Opcode Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.0F.W1 79 /r A VIV AVX512VL_ | Convert two packed double-precision floating-point 
VCVTPD2UDQ xmm1 {k1}{z}, AVX512F values in xmm2/m128/m64bcst to two unsigned 
xmm2/m128/m64bcst doubleword integers in xmm1 subject to writemask k1. 
EVEX.256.0F.W1 79 /r A VIV AVX512VL_ | Convert four packed double-precision floating-point 
VCVTPD2UDQ xmm1 {k1}{z}, AVX512F values in ymnm2/m256/m64bcst to four unsigned 
ymm2/m256/m64bcst doubleword integers in xmm1 subject to writemask k1. 
EVEX.512.0F.W1 79 /r A VV AVX512F Convert eight packed double-precision floating-point 
VCVTPD2UDQ ymm1 {k1}{Z}, values in zmm2/m512/m64bcst to eight unsigned 
zmm2/m512/m64bcst{er} doubleword integers in ymm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed double-precision floating-point values in the source operand (the second operand) to packed 
unsigned doubleword integers in the destination operand (the first operand). 

When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2” - 1 is 
returned, where w represents the number of bits in the destination format. 

The source operand is aZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. The upper bits (MAXVL-1:256) of the corresponding destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


VCVTPD2UDQ—Convert Packed Double-Precision Floating-Point Values to Packed Unsigned Doubleword Integers Vol. 2C 5-31 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


VCVTPD2UDQ (EVEX encoded versions) when src2 operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_UlInteger(SRC[k+63:k]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTPD2UDQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Ulnteger(SRC[63:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_UInteger(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPD2UDQ __m256i __mm512_cvtpd_epu32(__m512d a); 

VCVTPD2UDQ __m256i __mm512_mask_cvtpd_epu32(__m256i s, __mmask8 k, __m512d a); 
VCVTPD2UDQ __m256i__mm512_maskz_cvtpd_epu32(__mmask8 k, __m512d a); 
VCVTPD2UDQ __m256i__mm512_cvt_roundpd_epu32(__m512da, int 1); 


VCVTPD2UDQ __m256i __mm512_mask_cvt_roundpd_epu32(__m256i s, __mmask8 k,___m512d a, int r); 


VCVTPD2UDQ __m256i __mm512_maskz_cvt_roundpd_epu32(__mmask8 k,__m512da, int 1); 
VCVTPD2UDQ __m128i __mm256_mask_cvtpd_epu32(__m128i s, __mmask8 k, __m256d a); 
VCVTPD2UDQ __m128i __mm256_maskz_cvtpd_epu32(__mmask8 k, __m256d a); 
VCVTPD2UDQ __m128i _mm_mask_cvtpd_epu32(__m128i s,__mmask8 k, __m128d a); 
VCVTPD2UDQ __m128i _mm_maskz_cvtpd_epu32(__mmask8 k, __m128d a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 


EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 


#UD If EVEX.vvvv != 1111B. 


VCVTPD2UDQ—Convert Packed Double-Precision Floating-Point Values to Packed Unsigned Doubleword Integers 


Vol. 2C 5-33 


INSTRUCTION SET REFERENCE, V-Z 


VCVTPD2UQQ—Convert Packed Double-Precision Floating-Point Values to Packed Unsigned 
Quadword Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F.W1 79 /r A VV AVX512VL_ | Convert two packed double-precision floating-point values from 
VCVTPD2UQQ xmm1 {k1}{2}, AVX512DQ | xmm2/mem to two packed unsigned quadword integers in 
xmm2/m128/m64bcst xmm1 with writemask k1. 
EVEX.256.66.0F.W1 79 /r A VV AVX512VL_ | Convert fourth packed double-precision floating-point values 
VCVTPD2UQQ ymm1 {k1}{z}, AVX512DQ_ | from ymm2/mem to four packed unsigned quadword integers 
ymm2/m256/m64bcst in ymm1 with writemask k1. 
EVEX.512.66.0F.W1 79 /r A VN AVX512DQ_ | Convert eight packed double-precision floating-point values 
VCVTPD2UQQ zmm1 {k1}{Z}, from zmm2/mem to eight packed unsigned quadword integers 
zmm2/m512/m64bcst{er} in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed double-precision floating-point values in the source operand (second operand) to packed 
unsigned quadword integers in the destination operand (first operand). 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2“ - 1 is 
returned, where w represents the number of bits in the destination format. 

The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operation 
is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VCVTPD2UQQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL == 512) AND (EVEX.b == 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_UQuadInteger(SRC[i+63:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPD2UQQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_UQuadInteger(SRC[63:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_UQuadInteger(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPD2UQQ—Convert Packed Double-Precision Floating-Point Values to Packed Unsigned Quadword Integers 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-35 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPD2UQQ __m512i_mm512_cvtpd_epu64(__m512d a); 

VCVTPD2UQQ __m512i_mm512_mask_cvtpd_epu64(__m512is,___mmask8 k,___m512d a); 
VCVTPD2UQQ __m512i_mm512_maskz_cvtpd_epu64(__mmask8 k, __m512d a); 
VCVTPD2UQQ __m512i__mm512_cvt_roundpd_epu64(__m512da, int r); 

VCVTPD2UQQ __m512i_mm512_mask_cvt_roundpd_epu64(__m512is, __mmask8 k,___m512d a, int r); 
VCVTPD2UQQ __m512i_mm512_maskz_cvt_roundpd_epu64( __mmask8 k, __m512d a, int r); 
VCVTPD2UQQ __m256i _mm256_mask_cvtpd_epu64(__m256i s,___mmask8 k, __m256d a); 
VCVTPD2UQQ __m256i _mm256_maskz_cvtpd_epu64(__mmask8 k, __m256d a); 
VCVTPD2UQQ __m128i __mm_mask_cvtpd_epu64(__m128i s, __ mmask8 k, __m128d a); 
VCVTPD2UQQ __m128i _mm_maskz_cvtpd_epu64(__mmask8 k, __m128d a); 

VCVTPD2UQQ __m256i _mm256_cvtpd_epu64 (__m256d src) 

VCVTPD2UQQ __m128i __mm_cvtpd_epu64 (__m128d src) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTPH2PS—Convert 16-bit FP values to Single-Precision FP values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W0 13 /r A VIV F16C Convert four packed half precision (16-bit) floating- 
VCVTPH2PS xmm1, xmm2/m64 point values in xmm2/m64 to packed single-precision 
floating-point value in xmm1. 
VEX.256.66.0F38.W0 13 /r A VIV F16C Convert eight packed half precision (16-bit) floating- 
VCVTPH2PS ymm1, xmm2/m128 point values in xmm2/m1 28 to packed single- 
precision floating-point value in ymm1. 
EVEX.128.66.0F38.W0 13 /r B VIV AVX512VL | Convert four packed half precision (16-bit) floating- 
VCVTPH2PS xmm1 {k1}{z}, xmm2/m64 AVX512F point values in xmm2/m64 to packed single-precision 
floating-point values in xmm1. 
EVEX.256.66.0F38.W0 13 /r B VIV AVX512VL | Convert eight packed half precision (16-bit) floating- 
VCVTPH2PS ymm1 {k1}{z}, AVX512F point values in xmm2/m1 28 to packed single- 
xmm2/m128 precision floating-point values in ymm1. 
EVEX.512.66.0F38.W0 13 /r B VIN AVX512F Convert sixteen packed half precision (16-bit) 
VCVTPH2PS zmm1 {k1}{Z}, floating-point values in ymm2/m256 to packed 
ymm2/m256 {sae} single-precision floating-point values in zmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Half Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed half precision (16-bits) floating-point values in the low-order bits of the source operand (the 
second operand) to packed single-precision floating-point values and writes the converted values into the destina- 


tion operand (the first operand). 


If case of a denormal operand, the correct normal result is returned. MXCSR.DAZ is ignored and is treated as if it 
0. No denormal exception is reported on MXCSR. 


VEX.128 version: The source operand is a XMM register or 64-bit memory location. The destination operand is a 
XMM register. The upper bits (MAXVL-1:128) of the corresponding destination register are zeroed. 


VEX.256 version: The source operand is a XMM register or 128-bit memory location. The destination operand is a 
YMM register. Bits (MAXVL-1:256) of the corresponding destination register are zeroed. 


EVEX encoded versions: The source operand is a YMM/XMM/XMM (low 64-bits) register or a 256/128/64-bit 
memory location. The destination operand is aZMM/YMM/XMM register conditionally updated with writemask k1. 


The diagram below illustrates how data is converted from four packed half precision (in 64 bits) to four single preci- 


sion (in 128 bits) FP values. 


Note: VEX.vvvv and EVEX.vvvv are reserved (must be 1111b). 
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VCVTPH2PS xmm1, xmm2/mem64, immé& 
127 96 95 64 +63 48 47 32 31 16 15 0 
VH3 VH2 VH1 VHO xmm2/mem64 
convert convert 
convert convert 
127 96 95 64 63 3231 0 
VS3 VS2 vs1 vso xmm1 


Figure 5-6. VCVTPH2PS (128-bit Version) 


Operation 
vCvt_h2s(SRC1[15:0]) 


{ 
RETURN Cvt_Half_Precision_To_Single_Precision(SRC1[15:0]); 


} 


VCVTPH2PS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 

i:=j* 32 

k:=j* 16 

IF k1[j] OR *no writemask* 

THEN DEST[i+31:i] = 
vCvt_h2s(SRC[k+1 5:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPH2PS (VEX.256 encoded version) 

DEST[31:0] := vCvt_h2s(SRC1[15:0)); 

DEST[63:32] := vCvt_h2s(SRC1[31:16)); 

DEST[95:64] := vCvt_h2s(SRC1[47:32]); 
DEST[127:96] := vCvt_h2s(SRC1[63:48)); 
DEST[159:128] := vCvt_h2s(SRC1[79:64)]); 
DEST[191:160] := vCvt_h2s(SRC1[95:80)]); 
DEST[223:192] := vCvt_h2s(SRC1[111:96]); 
DEST[255:224] := vCvt_h2s(SRC1[127:112]); 
DEST[MAXVL-1:256] := 0 
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VCVTPH2PS (VEX.128 encoded version) 
DEST[31:0] := vCvt_h2s(SRC1[15:0)); 
DEST[63:32] := vCvt_h2s(SRC1[31:16)); 
DEST[95:64] := vCvt_h2s(SRC1[47:32]); 
DEST[127:96] := vCvt_h2s(SRC1[63:48]); 
DEST[MAXVL-1:128] := 0 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPH2PS 


m512 


mm512_cvtph_ps( 


m256i a); 


VCVTPH2PS 


m512 


mm512_mask_cvtph_ps( 


VCVTPH2PS 


m512 


mm512_maskz_cvtph_ps( 


VCVTPH2PS 


m512 


mm512_cvt_roundph_ps( 


VCVTPH2PS 


m512 


mm512_mask_cvt_roundph_ps(__m512 s, 


m512s, 
mmask16 k, 
m256i a, int sae); 


INSTRUCTION SET REFERENCE, V-Z 


mmask16 k, 
m256i a); 


m256i a); 


mmask16 k, __m256i a, int sae); 


VCVTPH2PS 


m512 


mm512_maskz_cvt_roundph_ps( 


mmask16 k,___m256i a, int sae); 


VCVTPH2PS 


m256 


mm256_mask_cvtph_ps( 


VCVTPH2PS 


m256 


m256 s, 


mmask8 k, __m128i a); 


mm256_maskz_cvtph_ps(__mmask8 k, __m128i a); 


VCVTPH2PS 


m128 


mm_mask_cvtph_ps(__m128 s, 


VCVTPH2PS 


m128 


VCVTPH2PS 


m128 


mmask8 k, __m128i a); 


mm_maskz_cvtph_ps(__mmask8 k, __m128i a); 
mm_cvtph_ps (__m128i m1); 


VCVTPH2PS 


m256 


mm256_cvtph_ps ( 


m128i m1) 


SIMD Floating-Point Exceptions 


Invalid 


Other Exceptions 


VEX-encoded instructions, see Table 2-26, “Type 11 Class Exception Conditions” (do not report #AC). 


EVEX-encoded instructions, see Table 2-60, “Type E11 Class Exception Conditions”. 


Additionally: 
#UD 
#UD 


If VEX.W=1. 


If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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VCVTPS2PH—Convert Single-Precision FP value to 16-bit FP value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F3A.WO 1D /r ib A VIV F16C Convert four packed single-precision floating-point values 
VCVTPS2PH xmm1/m64, xmm2, in xmm2 to packed half-precision (16-bit) floating-point 
imm8s values in xmm1/m64. Imm8 provides rounding controls. 
VEX.256.66.0F3A.WO 1D /r ib A VIV F16C Convert eight packed single-precision floating-point values 
VCVTPS2PH xmm1/m128, ymm2, in ymm2 to packed half-precision (16-bit) floating-point 
imm8 values in xmm1/m128. Imm8 provides rounding controls. 
EVEX.128.66.0F3A.WO 1D /r ib B VIV AVX512VL | Convert four packed single-precision floating-point values 
VCVTPS2PH xmm1/m64 {k1}{Z}, AVX512F in xmm_2 to packed half-precision (16-bit) floating-point 
xmme2, imm8 values in xmm1/m64. Imm8 provides rounding controls. 
EVEX.256.66.0F3A.WO 1D /r ib B VIV AVX512VL | Convert eight packed single-precision floating-point values 
VCVTPS2PH xmm1/m1 28 {k1}{z}, AVX512F in ymm2 to packed half-precision (16-bit) floating-point 
ymme2, imm8 values in xmm1/m128. Imm8 provides rounding controls. 
EVEX.512.66.0F3A.WO 1D /r ib B VIV AVX512F Convert sixteen packed single-precision floating-point 
VCVTPS2PH ymm1/m256 {k1}{z}, values in zmm_2 to packed half-precision (16-bit) floating- 
zmme{sae}, imm8 point values in ymm1/m256. Imm8 provides rounding 
controls. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) Imm8 NA 
B Half Mem ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
Description 


Convert packed single-precision floating values in the source operand to half-precision (16-bit) floating-point 
values and store to the destination operand. The rounding mode is specified using the immediate field (imm8). 


Underflow results (i.e., tiny results) are converted to denormals. MXCSR.FTZ is ignored. If a source element is 
denormal relative to the input format with DM masked and at least one of PM or UM unmasked; a SIMD exception 
will be raised with DE, UE and PE set. 


VCVTPS2PH xmm 1/mem64, xmm2, imm8& 
127 96 95 64 «63 32.031 0 
VS3 Vvs2 vs1 vso xmm2 
rt 
convert convert conve convert 
127 96 95 64 63 48 47 32 31 16 15 0 
VH3 VH2 VH1 VHO xmm1/mem64 


Figure 5-7. VCVTPS2PH (128-bit Version) 


The immediate byte defines several bit fields that control rounding operation. The effect and encoding of the RC 


field are listed in Table 5-3. 
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Table 5-3. Immediate Byte Encoding for 16-bit Floating-Point Conversion Instructions 


INSTRUCTION SET REFERENCE, V-Z 


Bits Field Name/value Description Comment 

Imm{1:0] RC=00B Round to nearest even If Imm[2] = 0 
RC=01B Round down 
RC=10B Round up 
RC=11B Truncate 

Imm[2] MS1=0 Use imm[1:0] for rounding Ignore MXCSR.RC 
MS1=1 Use MXCSR.RC for rounding 

Imm{7:3] Ignored Ignored by processor 


VEX.128 version: The source operand is a XMM register. The destination operand is a XMM register or 64-bit 
memory location. If the destination operand is a register then the upper bits (MAXVL-1:64) of corresponding 


register are zeroed. 


VEX.256 version: The source operand is a YMM register. The destination operand is a XMM register or 128-bit 
memory location. If the destination operand is a register, the upper bits (MAXVL-1:128) of the corresponding desti- 


nation register are zeroed. 


Note: VEX.vvvv and EVEX.vvvv are reserved (must be 1111b). 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register. The destination operand is a 


YMM/XMM/XMM (low 64-bits) register or a 256/128/64-bit memory location, conditionally updated with writemask 
k1. Bits (MAXVL-1:256/128/64) of the corresponding destination register are zeroed. 


Operation 
vCvt_s2h(SRC1[31:0]) 


{ 
IF Imm[2] = 0 


THEN — ; using Imm[1:0] for rounding control, see Table 5-3 


RETURN Cvt_Single_Precision_To_Half_Precision_FP_Imm(SRC1[31:0)); 
ELSE —; using MXCSR.RC for rounding control 
RETURN Cvt_Single_Precision_To_Half_Precision_FP_Mxcsr(SRC1[31:0]); 


Fl; 
} 


VCVTPS2PH (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TOKL-1 
i:=j*16 
k:=j* 32 


IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = 


vCvt_s2h(SRC[k+31:k]) 


ELSE 


IF *merging-masking* 
THEN *DEST{i+15:i] remains unchanged* 


ELSE 


; merging-masking 


; zeroing-masking 


DEST[i+15:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL/2] := 0 
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VCVTPS2PH (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = 
vCvt_s2h(SRC[k+31:k]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_; merging-masking 
Fl; 
ENDFOR 


VCVTPS2PH (VEX.256 encoded version) 

DEST[15:0] := vCvt_s2h(SRC1[31:0)); 

DEST[31:16] := vCvt_s2h(SRC1[63:32)); 

DEST[47:32] := vCvt_s2h(SRC1[95:64)); 

DEST[63:48] := vCvt_s2h(SRC1[127:96)); 

DEST[79:64] := vCvt_s2h(SRC1[159:128)); 
DEST[95:80] := vCvt_s2h(SRC1[191:160)); 

DEST[1 11:96] := vCvt_s2h(SRC1[223:192]); 
DEST[127:112] := vCvt_s2h(SRC1[255:224]); 
DEST[MAXVL-1:128] := 0 


VCVTPS2PH (VEX.128 encoded version) 
DEST[15:0] := vCvt_s2h(SRC1[31:0)); 
DEST[31:16] := vCvt_s2h(SRC1[63:32)); 
DEST[47:32] := vCvt_s2h(SRC1[95:64)); 
DEST[63:48] := vCvt_s2h(SRC1[127:96]); 
DEST[MAXVL-1:64] := 0 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPS2PH __m256i_mm512_cvtps_ph(__m512 a); 

VCVTPS2PH __m256i_mm512_mask_cvtps_ph(__m256i s,___ mmask16 k,__m512 a); 
VCVTPS2PH __m256i_mm512_maskz_cvtps_ph(__mmask16 k,_m512 a); 

VCVTPS2PH __m256i_mm512_cvt_roundps_ph(__m512 a, const int imm); 

VCVTPS2PH __m256i__mm512_mask_cvt_roundps_ph(__m256is, __mmask16 k,_m512 a, const int imm); 
VCVTPS2PH __m256i__mm512_maskz_cvt_roundps_ph(__mmask16 k,__m512 a, const int imm); 
VCVTPS2PH __m128i__mm256_mask_cvtps_ph(__m128i s,__ mmask8 k,__m256 a); 
VCVTPS2PH __m128i __mm256_maskz_cvtps_ph(__mmask8 k,__m256 a); 

VCVTPS2PH __m128i __mm_mask_cvtps_ph(__m128i s, __ mmask8 k,__m128 a); 

VCVTPS2PH __m128i __mm_maskz_cvtps_ph(__mmask8 k,__m128 a); 

VCVTPS2PH __m128i__mm_cvtps_ph (__m128 m1, const int imm); 

VCVTPS2PH __m128i __mm256_cvtps_ph(__m256 m1, const int imm); 


SIMD Floating-Point Exceptions 
Invalid, Underflow, Overflow, Precision, Denormal (if MXCSR.DAZ=0); 
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Other Exceptions 
VEX-encoded instructions, see Table 2-26, “Type 11 Class Exception Conditions” (do not report #AC); 
EVEX-encoded instructions, see Table 2-60, “Type E11 Class Exception Conditions”. 


Additionally: 
#UD If VEX.W=1. 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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VCVTPS2UDQ—Convert Packed Single-Precision Floating-Point Values to Packed Unsigned 
Doubleword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
EVEX.128.0F.WO 79 /r A VIV AVX512VL | Convert four packed single precision floating-point 
VCVTPS2UDQ xmm1 {k1}{z}, AVX512F values from xmm2/m128/m32bcst to four packed 
xmme2/m1 28/m32bcst unsigned doubleword values in xmm1 subject to 
writemask k1. 
EVEX.256.0F.WO 79 /r A VIV AVX512VL | Convert eight packed single precision floating-point 
VCVTPS2UDQ ymm1 {k1}{Z}, AVX512F values from ymm2/m256/m32bcst to eight packed 
ymm2/m256/m32bcst unsigned doubleword values in ymm1 subject to 
writemask k1. 
EVEX.512.0F.WO 79 /r A VIV AVX512F Convert sixteen packed single-precision floating-point 
VCVTPS2UDQ zmm1 {k1}{2}, values from zmm2/m512/m32bcst to sixteen packed 
zmm2/m512/m32bcst{er} unsigned doubleword values in zmm1 subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts sixteen packed single-precision floating-point values in the source operand to sixteen unsigned double- 
word integers in the destination operand. 

When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2“ - 1 is 
returned, where w represents the number of bits in the destination format. 


The source operand is aZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 
updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


5-44 Vol. 2C VCVTPS2UDQ—Convert Packed Single-Precision Floating-Point Values to Packed Unsigned Doubleword Integer Values 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


VCVTPS2UDQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
Convert_Single_Precision_Floating_Point_To_UlInteger(SRC[i+31:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2UDQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no * 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_UlInteger(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Ulnteger(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPS2UDQ __m512i__mm512_cvtps_epu32(__m512 a); 

VCVTPS2UDQ __m512i __mm512_mask_cvtps_epu32(__m512i s,___mmask16 k,__m512 a); 
VCVTPS2UDQ __m512i __mm512_maskz_cvtps_epu32(__mmask16 k,___m512 a); 
VCVTPS2UDQ __m512i __mm512_cvt_roundps_epu32(__m512 a, int r); 

VCVTPS2UDQ __m512i __mm512_mask_cvt_roundps_epu32(__m512is,___mmask16 k,__m512 a, int r); 
VCVTPS2UDQ __m512i__mm512_maskz_cvt_roundps_epu32(__mmask16 k,___m512 a, int 1); 
VCVTPS2UDQ __m256i __mm256_cvtps_epu32(__m256d a); 

VCVTPS2UDQ __m256i _mm256_mask_cvtps_epu32(__m256i s,___mmask8 k, __m256 a); 
VCVTPS2UDQ __m256i _mm256_maskz_cvtps_epu32(__mmask8 k, __m256 a); 
VCVTPS2UDQ __m128i _mm_cvtps_epu32(__m128 a); 

VCVTPS2UDQ __m128i _mm_mask_cvtps_epu32(__m128i s, __mmask8 k, __m128 a); 
VCVTPS2UDQ __m128i __mm_maskz_cvtps_epu32(__mmask8 k, __m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VCVTPS2QQ—Convert Packed Single Precision Floating-Point Values to Packed Signed 
Quadword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F.WO 7B /r A VIV AVX512VL_ | Convert two packed single precision floating-point values from 
VCVTPS2QQ xmm1 {k1}{z}, AVX512DQ | xmm2/m64/m32bcst to two packed signed quadword values in 
xmm2/m64/m32bcst xmm1 subject to writemask k1. 
EVEX.256.66.0F.WO 7B /r A VIV AVX512VL_ | Convert four packed single precision floating-point values from 
VCVTPS2QQ ymm1 {k1}{Z}, AVX512DQ | xmm2/m128/m32bcst to four packed signed quadword values 
xmme2/m128/m32bcst in ymm1 subject to writemask k1. 
EVEX.512.66.0F.W0 7B /r A VN AVX512DQ | Convert eight packed single precision floating-point values from 
VCVTPS2QQ zmm1 {k1}{z}, ymm2/m256/m32bcst to eight packed signed quadword values 
ymm2/m256/m32bcst{er} in zmm1 subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts eight packed single-precision floating-point values in the source operand to eight signed quadword inte- 
gers in the destination operand. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MXCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 

format, the floating-point invalid exception is raised, and if this exception is masked, the indefinite integer value 
(2“-1, where w represents the number of bits in the destination format) is returned. 


The source operand is a YMM/XMM/XMM (low 64- bits) register or a 256/128/64-bit memory location. The destina- 
tion operation is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 

VCVTPS2QQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 

IF (VL == 512) AND (EVEX.b == 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_Single_Precision_To_QuadInteger(SRC[k+31:k]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2QQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Single_Precision_To_QuadInteger(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Single_Precision_To_QuadInteger(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
mm512_cvtps_epi64(__m512 a); 


VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 
VCVTPS2QQ 


m512i 


m512i 


mm512_mask_cvtps_epi64(__m512is,__ mmask16 k, 


INSTRUCTION SET REFERENCE, V-Z 


m512 a); 


m512i 


mm512_maskz_cvtps_epi64(__ mmask16 k,__m512 a); 


m512i 


m512i 


mm512_cvt_roundps_epi64(__m512 a, intr); 
mm512_mask_cvt_roundps_epi64(__m512is,__ mmask16 k,__m512 a4, intr); 


m512i 


mm512_maskz_cvt_roundps_epi64(__mmask16 k, 


m512 a, int r); 


m256i 


mm256_cvtps_epi64(__m256 a); 


m256i 


mm256_mask_cvtps_epi64(__m256i s, 


mmask8 k,___m256 a); 


m256i 


mm256_maskz_cvtps_epi64(__ mmask8 k, 


m256 a); 


m128i 


mm_cvtps_epi64(__m128 a); 


m128i 


m128i 


mm_mask_cvtps_epi64( 
mm_maskz_cvtps_epi64( 


m128is,__mmask8 k,__m128 a); 
mmask8 k,___m128 a); 


SIMD Floating-Point Exceptions 


Invalid, Precision 


Other Exceptions 


EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”; additionally: 


#UD 


If EVEX.vvvv != 1111B. 


VCVTPS2QQ—Convert Packed Single Precision Floating-Point Values to Packed Signed Quadword Integer Values 


Vol.2C 5-49 


INSTRUCTION SET REFERENCE, V-Z 


VCVTPS2UQQ—Convert Packed Single Precision Floating-Point Values to Packed Unsigned 
Quadword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F.WO 79 /r A VIN AVX512VL | Convert two packed single precision floating-point values from 
VCVTPS2UQQ xmm1 {k1}{Z}, AVX512DQ | zmm2/m64/m32bcst to two packed unsigned quadword values 
xmm2/m64/m32bcst in zmm1 subject to writemask k1. 
EVEX.256.66.0F.WO 79 /r A VIV AVX512VL | Convert four packed single precision floating-point values from 
VCVTPS2UQQ ymm1 {k1}{2Z}, AVX512DQ | xmm2/m128/m32bcst to four packed unsigned quadword 
xmm2/m128/m32bcst values in ymm1 subject to writemask k1. 
EVEX.512.66.0F.W0 79 /r A VIN AVX512DQ | Convert eight packed single precision floating-point values from 
VCVTPS2UQQ zmm1 {k1}{Z}, ymm2/m256/m32bcst to eight packed unsigned quadword 
ymm2/m256/m32bcst{er} values in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts up to eight packed single-precision floating-point values in the source operand to unsigned quadword 
integers in the destination operand. 

When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2“ - 1 is 
returned, where w represents the number of bits in the destination format. 


The source operand is a YMM/XMM/XMM (low 64- bits) register or a 256/128/64-bit memory location. The destina- 
tion operation is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 

VCVTPS2UQQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 

IF (VL == 512) AND (EVEX.b == 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_Single_Precision_To_UQuadInteger(SRC[k+31:k]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTPS2UQQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Single_Precision_To_UQuadInteger(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Single_Precision_To_UQuadInteger(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTPS2UQQ __m512i_mm512_cvtps_epu64(__m512 a); 

VCVTPS2UQQ __m512i_mm512_mask_cvtps_epu64(__m512is,__ mmask16 k, 
VCVTPS2UQQ __m512i_mm512_maskz_cvtps_epu64(__mmask16 k,__m512 a); 
VCVTPS2UQQ___m512i_mm512_cvt_roundps_epu64(__m512 a, intr); 

VCVTPS2UQQ __m512i_mm512_mask_cvt_roundps_epu64(__m512is,__mmask16 k,__m512 a, int r); 


m512 a); 


VCVTPS2UQQ __m512i_mm512_maskz_cvt_roundps_epu64(__mmask16 k,__m512 a, int r); 
VCVTPS2UQQ __m256i __mm256_cvtps_epu64(__m256 a); 
VCVTPS2UQQ __m256i __mm256_mask_cvtps_epu64(__m256i s, __ mmask8 k, __m256 a); 


VCVTPS2UQQ __m256i __mm256_maskz_cvtps_epu64(__mmask8 k, __m256 a); 
VCVTPS2UQQ __m128i __mm_cvtps_epu64(__m128 a); 

VCVTPS2UQQ __m128i __mm_mask_cvtps_epu64(__m128is,___mmask8 k, __m128 a); 
VCVTPS2UQQ __m128i __mm_maskz_cvtps_epu64(__mmask8 k, __m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTQQ2PD—Convert Packed Quadword Integers to Packed Double-Precision Floating-Point 


Values 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.F3.0F.W1 E6 /r A VIV AVX512VL_ | Convert two packed quadword integers from 
VCVTQQ2PD xmm1 {k1}{Z}, AVX512DQ | xmm2/m128/m64bcst to packed double-precision floating- 
xmm2/m128/m64bcst point values in xmm1 with writemask k1. 
EVEX.256.F3.0F.W1 E6 /r A VIV AVX512VL_ | Convert four packed quadword integers from 
VCVTQQ2PD ymm1 {k1}{2}, AVX512DQ_ | ymm2/m256/m64bcst to packed double-precision floating- 
ymm2/m256/m64bcst point values in ymm1 with writemask k1. 
EVEX.512.F3.0F.W1 €6 /r A VV AVX512DQ_ | Convert eight packed quadword integers from 
VCVTQQ2PD zmm1 {k1}{Z}, zmm2/m512/m64bcst to eight packed double-precision 
zmm2/m512/m64bcst{er} floating-point values in zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed quadword integers in the source operand (second operand) to packed double-precision floating- 


point values in the destination operand (first operand). 


The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operation 


is a ZMM/YMM/XMM register conditionally updated with writemask k1. 
EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VCVTQQ2PD (EVEX2 encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL == 512) AND (EVEX.b == 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_QuadInteger_To_Double_Precision_Floating_Point(SRC[i+63:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VCVTQQ2PD—Convert Packed Quadword Integers to Packed Double-Precision Floating-Point Values 


Vol. 2C 5-53 


INSTRUCTION SET REFERENCE, V-Z 


VCVTQQ2PD (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Quadinteger_To_Double_Precision_Floating_Point(SRC[63:0]) 
ELSE 
DEST[i+63:i] := 
Convert_QuadInteger_To_Double_Precision_Floating_Point(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTQQ2PD __m512d_mm512_cvtepi64_pd(__m512i a); 

VCVTQQ2PD __m512d_mm512_mask_cvtepi64_pd(__m512ds,__mmask16 k,__m512i a); 
VCVTQQ2PD __m512d_mm512_maskz_cvtepi64_pd(_mmask16 k,___m512i a); 

VCVTQQ2PD __m512d_mm512_cvt_roundepi64_pd(__m512i a, int r); 

VCVTQQ2PD __m512d_mm512_mask_cvt_roundepi64_pd(__m512ds,__ mmask8 k,___m512i a, int r); 
VCVTQQ2PD __m512d_mm512_maskz_cvt_roundepi64_pd(__mmask8 k,__m512i a, int r); 
VCVTQQ2PD __m256d_mm256_mask_cvtepi64_pd(__m256ds,__ mmask8 k, __m256i a); 
VCVTQQ2PD __m256d __mm256_maskz_cvtepi64_pd(__mmask8 k,___m256i a); 

VCVTQQ2PD __m128d __mm_mask_cvtepi64_pd(__m128ds,__ mmask8 k, __m128i a); 

VCVTQQ2PD __m128d _mm_maskz_cvtepi64_pd(__mmask8 k, __m128i a); 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTQQ2PS—Convert Packed Quadword Integers to Packed Single-Precision Floating-Point 


Values 

Opcode/ Op/ | 64/32 CPUID Description 

Instruction En bit Mode | Feature 

Support | Flag 

EVEX.128.0F.W1 5B /r A VIV AVX512VL | Convert two packed quadword integers from xmm2/mem to 

VCVTQQ2PS xmm1 {k1}{Z}, AVX512DQ | packed single-precision floating-point values in xmm1 with 

xmm2/m128/m64bcst writemask k1. 

EVEX.256.0F.W1 5B /r A VIV AVX512VL | Convert four packed quadword integers from ymm2/mem to 

VCVTQQ2PS xmm1 {k1}{Z}, AVX512DQ | packed single-precision floating-point values in xmm1 with 

ymm2/m256/m64bcst writemask k1. 

EVEX.512.0F.W1 5B /r A VN AVX512DQ_ | Convert eight packed quadword integers from zmm2/mem to 

VCVTQQ2PS ymm1 {k1}{Z}, eight packed single-precision floating-point values in ymm1 with 

zmm2/m512/m64bcst{er} writemask k1. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 

Description 


Converts packed quadword integers in the source operand (second operand) to packed single-precision floating- 


point values in the destination operand (first operand). 


The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operation 
is a YMM/XMM/XMM (lower 64 bits) register conditionally updated with writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VCVTQQ2PS (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[k+31:k] := 
Convert_QuadInteger_To_Single_Precision_Floating_Point(SRC[i+63:i]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST[k+31:k] remains unchanged* 
ELSE ; zeroing-masking 

DEST[k+31:k] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTQQ2PS—Convert Packed Quadword Integers to Packed Single-Precision Floating-Point Values 


Vol.2C 5-55 


INSTRUCTION SET REFERENCE, V-Z 


VCVTQQ2PS (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 


THEN 
DEST[k+31:k] := 
Convert_QuadInteger_To_Single_Precision_Floating_Point(SRC[63:0]) 
ELSE 
DEST[k+31:k] := 
Convert_QuadInteger_To_Single_Precision_Floating_Point(SRC[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[k+31:k] remains unchanged* 
ELSE ; zeroing-masking 

DEST[k+31:k] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTQQ2PS __m256 _mm512_cvtepi64_ps(__m512i a); 

VCVTQQ2PS __m256 _mm512_mask_cvtepi64_ps(__m256 s,__ mmask16 k, 
VCVTQQ2PS __m256_mm512_maskz_cvtepi64_ps(__ mmask16 k,___m512i a); 

VCVTQQ2PS __m256 _mm512_cvt_roundepi64_ps(_m512i a, int r); 

VCVTQQ2PS __m256 _mm512_mask_cvt_roundepi_ps(__m256s,__ mmask8 k,___m512i a, int r); 
VCVTQQ2PS __m256 _mm512_maskz_cvt_roundepi64_ps(__mmask8 k, __m512i a, int r); 
VCVTQQ2PS __m128 _mm256_cvtepi64_ps(__m256i a); 

VCVTQQ2PS __m128 _mm256_mask_cvtepi64_ps(__m128s,__mmask8 k, 
VCVTQQ2PS __m128 _mm256_maskz_cvtepi64_ps(_ mmask8 k, __ m256i a); 
VCVTQQ2PS __m128_mm_cvtepi64_ps(__m128i a); 

VCVTQQ2PS __m128 _mm_mask_cvtepi64_ps(__m128s,__ mmask8 k, __m128i a); 
VCVTQQ2PS __m128_mm_maskz_cvtepi64_ps(__ mmask8 k, __m128i a); 


m512i a); 


m256i a); 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTSD2USI—Convert Scalar Double-Precision Floating-Point Value to Unsigned Doubleword 


Integer 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.LLIG.F2.0F.WO 79 /r A VIN AVX512F Convert one double-precision floating-point value from 
VCVTSD2USI r32, xmm1/m64{er} xmm1/m64 to one unsigned doubleword integer r32. 
EVEX.LLIG.F2.0F.W1 79 /r A VINE." AVX512F Convert one double-precision floating-point value from 
VCVTSD2USI r64, xmm1/m64{er} xmm1/m64 to one unsigned quadword integer zero- 
extended into r64. 
NOTES: 


1. EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a double-precision floating-point value in the source operand (the second operand) to an unsigned 
doubleword integer in the destination operand (the first operand). The source operand can be an XMM register or 
a 64-bit memory location. The destination operand is a general-purpose register. When the source operand is an 
XMM register, the double-precision floating-point value is contained in the low quadword of the register. 

When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MXCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2“ - 1 is 
returned, where w represents the number of bits in the destination format. 


Operation 


VCVTSD2USI (EVEX encoded version) 
IF (SRC *is register*) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF 64-Bit Mode and OperandSize = 64 
THEN DEST[63:0] := Convert_Double_Precision_Floating_Point_To_Ulnteger(SRC[63:0)); 
ELSE DEST[31:0] := Convert_Double_Precision_Floating_Point_To_UlInteger(SRC[63:0}); 


Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSD2USI unsigned int __mm_cvtsd_u32(__m128d); 

VCVTSD2USI unsigned int __mm_cvt_roundsd_u32(__m128d, int r); 
VCVTSD2USI unsigned __int64__mm_cvtsd_u64(__m128d); 
VCVTSD2USI unsigned __int64 __mm_cvt_roundsd_u64(__m1 28d, int r); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTSS2USI—Convert Scalar Single-Precision Floating-Point Value to Unsigned Doubleword 


Integer 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.F3.0F.WO 79 /r A VIV AVX512F | Convert one single-precision floating-point value from 
VCVTSS2USI r32, xmm1/m32{er} xmm1/m32 to one unsigned doubleword integer in r32. 
EVEX.LLIG.F3.0F.W1 79 /r A VINE. AVX512F | Convert one single-precision floating-point value from 
VCVTSS2USI r64, xmm1/m32{er} xmm1/m32 to one unsigned quadword integer in r64. 
NOTES: 


1. EVEX.W1 in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a single-precision floating-point value in the source operand (the second operand) to an unsigned double- 
word integer (or unsigned quadword integer if operand size is 64 bits) in the destination operand (the first 
operand). The source operand can be an XMM register or a memory location. The destination operand is a general- 
purpose register. When the source operand is an XMM register, the single-precision floating-point value is contained 
in the low doubleword of the register. 


When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MKCSR 
register or the embedded rounding control bits. If a converted result cannot be represented in the destination 
format, the floating-point invalid exception is raised, and if this exception is masked, the integer value 2“ - 1 is 
returned, where w represents the number of bits in the destination format. 


VEX.W1 and EVEX.W1 versions: promotes the instruction to produce 64-bit data in 64-bit mode. 
Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTSS2USI (EVEX encoded version) 
IF (SRC *is register*) AND (EVEX.b = 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
IF 64-bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Single_Precision_Floating_Point_To_Ulnteger(SRC[31:0]); 
ELSE 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_Ulnteger(SRC[31:0]); 
Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTSS2USI unsigned _mm_cvtss_u32(__m128 a); 

VCVTSS2USI unsigned _mm_cvt_roundss_u32(__m128 a, int r); 
VCVTSS2USI unsigned __int64_mm_cvtss_u64(__m128 a); 
VCVTSS2USI unsigned __int64 __mm_cvt_roundss_u64(__m128 a, int r); 
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INSTRUCTION SET REFERENCE, V-Z 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE 


WV-Z 


VCVTTPD2QQ—Convert with Truncation Packed Double-Precision Floating-Point Values to 
Packed Quadword Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F.W1 7A /r A VIV AVX512VL | Convert two packed double-precision floating-point values from 
VCVTTPD2QQ xmm1 {k1}{Z}, AVX512DQ | zmm2/m128/m64bcst to two packed quadword integers in 
xmm2/m128/m64bcst zmm1 using truncation with writemask k1. 
EVEX.256.66.0F.W1 7A /r A VIV AVX512VL | Convert four packed double-precision floating-point values 
VCVTTPD2QQ ymm1 {k1}{Z}, AVX512DQ | from ymm2/m256/m64bcst to four packed quadword integers 
ymm2/m256/m64bcst in ymm1 using truncation with writemask k1. 
EVEX.512.66.0F.W1 7A /r A VN AVX512DQ_ | Convert eight packed double-precision floating-point values 
VCVTTPD2QQ zmm1 {k1}{z}, from zmm2/m512 to eight packed quadword integers in zmm1 
zmm2/m512/m64bcst{sae} using truncation with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation packed double-precision floating-point values in the source operand (second operand) to 
packed quadword integers in the destination operand (first operand). 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operand is aZMM/YMM/XMM register conditionally updated with writemask k1. 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the indefinite integer value (2“-1, where w represents the number of bits in the destination format) is returned. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTTPD2QQ (EVEX encoded version) when src operand is a register 


(KL, VL) = (2, 128), (4, 256), (8 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 


512) 


Convert_Double_Precision_Floating_Point_To_QuadInteger_Truncate(SRC[i+63:i]) 


ELSE 


IF *merging-masking* 
THEN *DEST[i+63:i] remains unchanged* 


ELSE 


DEST[i+63:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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; merging-masking 


; zeroing-masking 
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VCVTTPD2QQ (EVEX encoded version) when src operand is a memory source 


(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j*64 


IF k1[j] OR *no writemask* 


THEN 


IF (EVEX.b == 1) 


Fl; 


ELSE 


IF *merging-masking* 


Fl 


Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 
VCVTTPD2QQ 


THEN 


DEST[i+63:i] := 


ELSE 


Convert_Double_Precision_Floating_Point_To_QuadInteger_Truncate(SRC[63:0]) 


DEST[i+63:i] := Convert_Double_Precision_Floating_Point_To_QuadInteger_Truncate(SRC[i+63:i]) 


; Merging-masking 


THEN *DEST{[i+63:i] remains unchanged* 


ELSE 


DEST[i+63:i] := 0 


; zeroing-masking 


m512i_mm512_cvttpd_epi64(_m512d a); 


mask_cvttpd_epi64(__m512is,__ mmask8 k,__m512d a); 


m512d a); 


mmask8 k,__m512d a, int sae); 


m512d a, int sae); 


mask_cvttpd_epi64(__ m256i s,___ mmask8 k,___ m256d a); 


m128d a); 


m512i_mm512 
m512i_mm512_maskz_cvttpd_epi64(__mmask8 k, 
m512i_mm512_cvtt_roundpd_epi64(__m512d a, int sae); 
m512i_mm512_mask_cvtt_roundpd_epi64(__m512is, 
m512i_mm512_maskz_cvtt_roundpd_epi64(__mmask8 k, 
m256i_mm256 

m256i__mm256_maskz_cvttpd_epi64(__ mmask8 k,___ m256d a); 
m128i_mm_mask_cvttpd_epi64(__m128is,__ mmask8 k, 
m128i_mm_maskz_cvttpd_epi64(__mmask8 k, 


m128d a); 


SIMD Floating-Point Exceptions 


Invalid, Precision 


Other Exceptions 


EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 


#UD 


If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPD2UDQ—Convert with Truncation Packed Double-Precision Floating-Point Values to 
Packed Unsigned Doubleword Integers 


Opcode Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.0F.W1 78 /r A VIV AVX512VL_ | Convert two packed double-precision floating-point values 
VCVTTPD2UDQ xmm1 {k1}{z}, AVX512F in xmm2/m128/m64bcst to two unsigned doubleword 
xmm_2/m1 28/m64bcst integers in xmm1 using truncation subject to writemask 
k1. 
EVEX.256.0F.W1 78 02 /r A VIN AVX512VL_ | Convert four packed double-precision floating-point 
VCVTTPD2UDQ xmm1 {k1}{z}, AVX512F values in ymm2/m256/m64bcst to four unsigned 
ymm2/m256/m64bcst doubleword integers in xmm1 using truncation subject to 
writemask k1. 
EVEX.512.0F.W1 78 /r A VIV AVX512F Convert eight packed double-precision floating-point 
VCVTTPD2UDQ ymm1 {k1}{z}, values in zmm2/m512/m64bcst to eight unsigned 
zmm2/m512/m64bcst{sae} doubleword integers in ymm1 using truncation subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation packed double-precision floating-point values in the source operand (the second operand) 
to packed unsigned doubleword integers in the destination operand (the first operand). 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2 - 1 is returned, where w represents the number of bits in the destination format. 


The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a YMM/XMM/XMM (low 64 bits) register 
conditionally updated with writemask k1. The upper bits (MAXVL-1:256) of the corresponding destination are 
zeroed. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


5-62 Vol. 2C VCVTTPD2UDQ—Convert with Truncation Packed Double-Precision Floating-Point Values to Packed Unsigned Doubleword Integers 


INSTRUCTION SET REFERENCE, V-Z 


Operation 

VCVTTPD2UDQ (EVEX encoded versions) when src2 operand is a register 
(KL, VL) = (2, 128), (4, 256),(8, 512) 

FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[k+63:k]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


VCVTTPD2UDQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256),(8, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[63:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Double_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 
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Vol.2C 5-63 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPD2UDQ __m256i_mm512_cvttpd_epu32(__m512d a); 

VCVTTPD2UDQ __m256i__mm512_mask_cvttpd_epu32(__m256i s,___mmask8 k, 
VCVTTPD2UDQ __m256i__mm512_maskz_cvttpd_epu32(__mmask8 k, __m512d a); 

VCVTTPD2UDQ __m256i __mm512_cvtt_roundpd_epu32(__m512d a, int sae); 

VCVTTPD2UDQ __m256i__mm512_mask_cvtt_roundpd_epu32(__m256i s,__mmask8 k,___m512d a, int sae); 
VCVTTPD2UDQ __m256i__mm512_maskz_cvtt_roundpd_epu32(__mmask8 k, __m512d a, int sae); 
VCVTTPD2UDQ __m128i __mm256_mask_cvttpd_epu32(__m128i s,___mmask8 k, __m256d a); 
VCVTTPD2UDQ __m128i _mm256_maskz_cvttpd_epu32(__mmask8 k, __m256d a); 

VCVTTPD2UDQ __m128i _mm_mask_cvttpd_epu32(__m128i s,___mmask8 k, __m128d a); 

VCVTTPD2UDQ __m128i __mm_maskz_cvttpd_epu32(__mmask8 k, __m128d a); 


m512d a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPD2UQQ—Convert with Truncation Packed Double-Precision Floating-Point Values to 
Packed Unsigned Quadword Integers 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F.W1 78 /r A VIV AVX512VL Convert two packed double-precision floating-point values 
VCVTTPD2UQQ xmm1 {k1}{z}, AVX512DQ_ | from xmm2/m128/m64bcst to two packed unsigned 
xmm2/m128/m64bcst quadword integers in xmm1 using truncation with 
writemask k1. 
EVEX.256.66.0F.W1 78 /r A VIV AVX512VL Convert four packed double-precision floating-point values 
VCVTTPD2UQQ ymm1 {k1}{z}, AVX512DQ_ | from ymm2/m256/m64bcst to four packed unsigned 
ymm2/m256/m64bcst quadword integers in ymm1 using truncation with 
writemask k1. 
EVEX.512.66.0F.W1 78 /r A VN AVX512DQ | Convert eight packed double-precision floating-point values 
VCVTTPD2UQQ zmm1 {k1}{Z}, from zmm2/mem to eight packed unsigned quadword 
zmm2/m512/m64bcst{sae} integers in zmm1 using truncation with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation packed double-precision floating-point values in the source operand (second operand) to 
packed unsigned quadword integers in the destination operand (first operand). 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2“ - 1 is returned, where w represents the number of bits in the destination format. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operation is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTTPD2UQQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 


Convert_Double_Precision_Floating_Point_To_UQuadInteger_Truncate(SRC[i+63:i]) 


ELSE 


IF *merging-masking* 


ELSE 


DEST[i+63:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
; zeroing-masking 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPD2UQQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_UQuadInteger_Truncate(SRC[63:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Double_Precision_Floating_Point_To_UQuadInteger_Truncate(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] = 0 
Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPD2UQQ _mm<size>[_mask[z]]_cvtt[_round]pd_epu64 


VCVTTPD2UQQ __m512i_mm512_cvttpd_epu64(__m512d a); 

VCVTTPD2UQQ __m512i_mm512_mask_cvttpd_epu64(__m512is,__ mmask8 k,___m512d a); 
VCVTTPD2UQQ __m512i__mm512_maskz_cvttpd_epu64( __mmask8 k, __m512d a); 

VCVTTPD2UQQ __m512i__mm512_cvtt_roundpd_epu64(__m512d a, int sae); 

VCVTTPD2UQQ __m512i __mm512_mask_cvtt_roundpd_epu64(__m512is,___mmask8 k, __m512d a, int sae); 
VCVTTPD2UQQ __m512i _mm512_maskz_cvtt_roundpd_epu64( __mmask8 k, __m512d a, int sae); 
VCVTTPD2UQQ __m256i _mm256_mask_cvttpd_epu64(__m256i s,___mmask8 k, __m256d a); 
VCVTTPD2UQQ __m256i __mm256_maskz_cvttpd_epu64( __mmask8 k, __m256d a); 

VCVTTPD2UQQ __m128i__mm_mask_cvttpd_epu64(__m128i s,__mmask8 k, __m128d a); 

VCVTTPD2UQQ __m128i __mm_maskz_cvttpd_epu64(__mmask8 k, __m128d a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPS2UDQ—Convert with Truncation Packed Single-Precision Floating-Point Values to 
Packed Unsigned Doubleword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
EVEX.128.0F.WO 78 /r A VV AVX512VL | Convert four packed single precision floating-point 
VCVTTPS2UDQ xmm1 {k1}{z}, AVX512F values from xmm2/m128/m32bcst to four packed 
xmme2/m128/m32bcst unsigned doubleword values in xmm1 using 
truncation subject to writemask k1. 
EVEX.256.0F.WO 78 /r A VV AVX512VL | Convert eight packed single precision floating-point 
VCVTTPS2UDQ ymm1 {k1}{z}, AVX512F values from ymm2/m256/m32bcst to eight packed 
ymm2/m256/m32bcst unsigned doubleword values in ymm1 using 
truncation subject to writemask k1. 
EVEX.512.0F.WO 78 /r A VV AVX512F Convert sixteen packed single-precision floating- 
VCVTTPS2UDQ zmm1 {k1}{Z}, point values from zmm2/m512/m32bcst to sixteen 
zmm2/m512/m32bcst{sae} packed unsigned doubleword values in zmm1 using 
truncation subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation packed single-precision floating-point values in the source operand to sixteen unsigned 
doubleword integers in the destination operand. 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2“ - 1 is returned, where w represents the number of bits in the destination format. 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location or 
a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a 
ZMM/YMM/XMM register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VCVTTPS2UDQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 


Convert_Single_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[i+31:i]) 


ELSE 


IF *merging-masking* 
THEN *DEST{[i+31:i] remains unchanged* 


ELSE 


DEST[i+31:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VCVTTPS2UDQ—Convert with Truncation Packed Single-Precision Floating-Point Values to Packed Unsigned Doubleword Integer Val- 


; merging-masking 


; zeroing-masking 
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VCVTTPS2UDQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Single_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPS2UDQ __m512i_mm512_cvttps_epu32(__m512 a); 

VCVTTPS2UDQ __m512i__mm512_mask_cvttps_epu32(__m512is, __mmask16 k,___m512 a); 
VCVTTPS2UDQ __m512i__mm512_maskz_cvttps_epu32(__mmask16 k,___m512 a); 

VCVTTPS2UDQ __m512i_mm512_cvtt_roundps_epu32(__m512 a, int sae); 

VCVTTPS2UDQ __m512i__mm512_mask_cvtt_roundps_epu32(__m512is, _mmask16 k,__m512 a, int sae); 
VCVTTPS2UDQ __m512i__mm512_maskz_cvtt_roundps_epu32(__mmask16 k,___m512 a, int sae); 
VCVTTPS2UDQ __m256i _mm256_mask_cvttps_epu32(__m256i s,___mmask8 k, __m256 a); 
VCVTTPS2UDQ __m256i _mm256_maskz_cvttps_epu32(__mmask8 k, __m256 a); 

VCVTTPS2UDQ __m128i _mm_mask_cvttps_epu32(__m128i s,___mmask8 k, __m128 a); 

VCVTTPS2UDQ __m128i__mm_maskz_cvttps_epu32(__mmask8 k, __m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPS2QQ—Convert with Truncation Packed Single Precision Floating-Point Values to 
Packed Signed Quadword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F.W0 7A /r A VN AVX512VL | Convert two packed single precision floating-point values from 
VCVTTPS2QQ xmm1 {k1}{Z}, AVX512DQ | xmm2/m64/m32bcst to two packed signed quadword values in 
xmm2/m64/m32bcst xmm1 using truncation subject to writemask k1. 
EVEX.256.66.0F.WO 7A /r A VN AVX512VL | Convert four packed single precision floating-point values from 
VCVTTPS2QQ ymm1 {k1}{Z}, AVX512DQ | xmm2/m128/m32bcst to four packed signed quadword values 
xmme2/m128/m32bcst in ymm1 using truncation subject to writemask k1. 
EVEX.512.66.0F.W0 7A /r A VN AVX512DQ_ | Convert eight packed single precision floating-point values from 
VCVTTPS2QQ zmm1 {k1}{Z}, ymm2/m256/m32bcst to eight packed signed quadword values 
ymm2/m256/m32bcst{sae} in zmm1 using truncation subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation packed single-precision floating-point values in the source operand to eight signed quad- 
word integers in the destination operand. 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the indefinite integer value (2-1, where w represents the number of bits in the destination format) is returned. 


EVEX encoded versions: The source operand is a YMM/XMM/XMM (low 64 bits) register or a 256/128/64-bit 
memory location. The destination operation is a vector register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VCVTTPS2QQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j= 0 TOKL-1 
i:=j*64 
k:=j* 32 


IF k1[j] OR *no writemask* 


THEN DEST[i+63:i] := 


Convert_Single_Precision_To_QuadInteger_Truncate(SRC[k+31:k]) 


ELSE 


IF *merging-masking* 
THEN *DEST{[i+63:i] remains unchanged* 


ELSE 


DEST[i+63:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VCVTTPS2QQ—Convert with Truncation Packed Single Precision Floating-Point Values to Packed Signed Quadword Integer Values 


; Merging-masking 


; zeroing-masking 
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VCVTTPS2QQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Single_Precision_To_QuadInteger_Truncate(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Single_Precision_To_QuadInteger_Truncate(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPS2QQ __m512i_mm512_cvttps_epi64(__m256 a); 

VCVTTPS2QQ __m512i_mm512_mask_cvttps_epi64(_m512is,___mmask16 k, __m256 a); 
VCVTTPS2QQ __m512i _mm512_maskz_cvttps_epi64(__mmask16 k, __m256 a); 

VCVTTPS2QQ __m512i__mm512_cvtt_roundps_epi64(__m256 a, int sae); 

VCVTTPS2QQ __m512i_mm512_mask_cvtt_roundps_epi64(__m512is,__ mmask16 k,___m256 a, int sae); 
VCVTTPS2QQ __m512i _mm512_maskz_cvtt_roundps_epi64(__mmask16 k, __m256 a, int sae); 
VCVTTPS2QQ __m256i__mm256_mask_cvttps_epi64(_m256i s,___ mmask8 k, __m128 a); 

VCVTTPS2QQ __m256i __mm256_maskz_cvttps_epi64(__mmask8 k, __m128 a); 

VCVTTPS2QQ __m128i __mm_mask_cvttps_epi64(__m128i s,__mmask8 k, __m128 a); 

VCVTTPS2QQ __m128i _mm_maskz_cvttps_epi64(__mmask8 k, __m128 a); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPS2UQQ—Convert with Truncation Packed Single Precision Floating-Point Values to 
Packed Unsigned Quadword Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F.WO 78 /r A VIV AVX512VL Convert two packed single precision floating-point values 
VCVTTPS2UQQ xmm1 {k1}{z}, AVX512DQ from xmm2/m64/m32bcst to two packed unsigned quadword 
xmm2/m64/m32bcst values in xmm1 using truncation subject to writemask k1. 
EVEX.256.66.0F.WO 78 /r A VIV AVX512VL Convert four packed single precision floating-point values 
VCVTTPS2UQQ ymm1 {k1}{Z}, AVX512DQ from xmm2/m128/m32bcst to four packed unsigned 
xmm2/m128/m32bcst quadword values in ymm1 using truncation subject to 
writemask k1. 
EVEX.512.66.0F.W0O 78 /r A VN AVX512DQ Convert eight packed single precision floating-point values 
VCVTTPS2UQQ zmm1 {k1}{Z}, from ymm2/m256/m32bcst to eight packed unsigned 
ymm2/m256/m32bcst{sae} quadword values in zmm1 using truncation subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation up to eight packed single-precision floating-point values in the source operand to 
unsigned quadword integers in the destination operand. 


When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2“ - 1 is returned, where w represents the number of bits in the destination format. 


EVEX encoded versions: The source operand is a YMM/XMM/XMM (low 64 bits) register or a 256/128/64-bit 
memory location. The destination operation is a vector register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VCVTTPS2UQQ (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 


Convert_Single_Precision_To_UQuadInteger_Truncate(SRC[k+31:k]) 


ELSE 


IF *merging-masking* 


; merging-masking 


THEN *DEST{[i+63:i] remains unchanged* 


ELSE 


; zeroing-masking 


DEST[i+63:i] = 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTPS2UQQ (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_Single_Precision_To_UQuadInteger_Truncate(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Single_Precision_To_UQuadInteger_Truncate(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 
VCVTTPS2UQQ 


_mm<size>[_mask[z]]_cvttL_round]ps_epu64 


m512i_mm512_cvttps_epu64(__m256 a); 


m512i_mm512_mask_cvttps_epu64(__m512is,__mmask16 k,__m256 a); 


m512i_mm512_maskz_cvttps_epu64(___mmask16 k,__m256 a); 


m512i_mm512_cvtt_roundps_epu64(__m256 a, int sae); 


m512i_mm512_mask_cvtt_roundps_epu64(__m512is,__mmask16 k,___m256 4, int sae); 
m512i_mm512_maskz_cvtt_roundps_epu64(__mmask16 k,__m256 a, int sae); 


m256i__mm256_mask_cvttps_epu64(__m256is,__ mmask8 k,__m128 a); 


m256i __mm256_maskz_cvttps_epu64(__ mmask8 k,___m128 a); 


m128i __mm_mask_cvttps_epu64(__m128is,__ mmask8 k,__m128 a); 


m128i_mm_maskz_cvttps_epu64(__ mmask8 k,___m128 a); 


SIMD Floating-Point Exceptions 


Invalid, Precision 


Other Exceptions 


EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”; additionally: 


#UD 
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If EVEX.vvvv != 1111B. 


VCVTTPS2UQQ—Convert with Truncation Packed Single Precision Floating-Point Values to Packed Unsigned Quadword Integer Values 


INSTRUCTION SET REFERENCE, V-Z 


VCVTTSD2USI—Convert with Truncation Scalar Double-Precision Floating-Point Value to 
Unsigned Integer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.F2.0F.WO 78 /r A VN AVX512F Convert one double-precision floating-point value from 
VCVTTSD2USI r32, xmm1/m64{sae} xmm1/m64 to one unsigned doubleword integer r32 
using truncation. 
EVEX.LLIG.F2.0F.W1 78 /r A VINE. AVX512F Convert one double-precision floating-point value from 
VCVTTSD2USI r64, xmm1/m64{sae} xmm1/m64 to one unsigned quadword integer zero- 
extended into r64 using truncation. 


NOTES: 
1. For this specific instruction, EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is 
used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation a double-precision floating-point value in the source operand (the second operand) to an 
unsigned doubleword integer (or unsigned quadword integer if operand size is 64 bits) in the destination operand 
(the first operand). The source operand can be an XMM register or a 64-bit memory location. The destination 
operand is a general-purpose register. When the source operand is an XMM register, the double-precision floating- 
point value is contained in the low quadword of the register. 

When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2“ - 1 is returned, where w represents the number of bits in the destination format. 


EVEX.W1 version: promotes the instruction to produce 64-bit data in 64-bit mode. 


Operation 


VCVTTSD2USI (EVEX encoded version) 

IF 64-Bit Mode and OperandSize = 64 
THEN DEST[63:0] := Convert_Double_Precision_Floating_Point_To_Ulnteger_Truncate(SRC[63:0}); 
ELSE DEST[31:0] := Convert_Double_Precision_Floating_Point_To_UInteger_Truncate(SRC[63:0)); 


Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTSD2USI unsigned int __mm_cvttsd_u32(__m1 28d); 

VCVTTSD2USI unsigned int __mm_cvtt_roundsd_u32(__m1282d, int sae); 
VCVTTSD2USI unsigned __int64_mm_cvttsd_u64(__m1 28d); 
VCVTTSD2USI unsigned __int64 __mm_cvtt_roundsd_u64(__m128d, int sae); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTTSS2US!I—Convert with Truncation Scalar Single-Precision Floating-Point Value to 
Unsigned Integer 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.LLIG.F3.0F.WO 78 /r A VIN AVX512F Convert one single-precision floating-point value from 
VCVTTSS2USI r32, xmm1/m32{sae} xmm1/m32 to one unsigned doubleword integer in 
r32 using truncation. 
EVEX.LLIG.F3.0F.W1 78 /r A VINE." AVX512F Convert one single-precision floating-point value from 
VCVTTSS2USI r64, xmm1/m32{sae} xmm1/m32 to one unsigned quadword integer in r64 
using truncation. 


NOTES: 


1. For this specific instruction, EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is 
used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Fixed ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts with truncation a single-precision floating-point value in the source operand (the second operand) to an 
unsigned doubleword integer (or unsigned quadword integer if operand size is 64 bits) in the destination operand 
(the first operand). The source operand can be an XMM register or a memory location. The destination operand is 
a general-purpose register. When the source operand is an XMM register, the single-precision floating-point value 
is contained in the low doubleword of the register. 

When a conversion is inexact, a truncated (round toward zero) value is returned. If a converted result cannot be 
represented in the destination format, the floating-point invalid exception is raised, and if this exception is masked, 
the integer value 2 - 1 is returned, where w represents the number of bits in the destination format. 

EVEX.W1 version: promotes the instruction to produce 64-bit data in 64-bit mode. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTTSS2USI (EVEX encoded version) 
IF 64-bit Mode and OperandSize = 64 
THEN 
DEST[63:0] := Convert_Single_Precision_Floating_Point_To_UInteger_Truncate(SRC[3 1:0)); 
ELSE 
DEST[31:0] := Convert_Single_Precision_Floating_Point_To_UlInteger_Truncate(SRC[31:0)); 


Fl; 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTTSS2USI unsigned int __mm_cvttss_u32(__m128 a); 

VCVTTSS2USI unsigned int__mm_cvtt_roundss_u32(__m128 a, int sae); 
VCVTTSS2USI unsigned __int64__mm_cvttss_u64(__m128 a); 
VCVTTSS2USI unsigned __int64 _mm_cvtt_roundss_u64(__m128 a, int sae); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTUDQ2PD—Convert Packed Unsigned Doubleword Integers to Packed Double-Precision 


Floating-Point Values 


writemask k1. 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.F3.0F.W0 7A /r A VIV AVX512VL Convert two packed unsigned doubleword integers 
VCVTUDQ2PD xmm1 {k1}{Z}, AVX512F from ymm2/m64/m32bcst to packed double-precision 
xmm2/m64/m32bcst floating-point values in zmm1 with writemask k1. 
EVEX.256.F3.0F.W0 7A /r A VIV AVX512VL Convert four packed unsigned doubleword integers 
VCVTUDQ2PD ymm1 {k1}{Z}, AVX512F from xmm2/m128/m32bcst to packed double- 
xmme2/m128/m32bcst precision floating-point values in zmm1 with 

writemask k1. 

EVEX.512.F3.0F.W0 7A /r A VIV AVX512F Convert eight packed unsigned doubleword integers 
VCVTUDQ2PD zmm1 {k1}{z}, from ymm2/m256/m32bcst to eight packed double- 
ymm2/m256/m32bcst precision floating-point values in zmm1 with 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed unsigned doubleword integers in the source operand (second operand) to packed double-preci- 


sion floating-point values in the destination operand (first operand). 


The source operand is a YMM/XMM/XMM (low 64 bits) register, a 256/128/64-bit memory location or a 
256/128/64-bit vector broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM 


register conditionally updated with writemask k1. 
Attempt to encode this instruction with EVEX embedded rounding is ignored. 
Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTUDQ2PD (EVEX encoded versions) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 

i:=j* 64 

k:=j* 32 

IF k1[j] OR *no writemask* 

THEN DEST[i+63:i] := 
Convert_Ulnteger_To_Double_Precision_Floating_Point(SRC[k+31:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTUDQ2PD (EVEX encoded versions) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
Convert_Ulnteger_To_Double_Precision_Floating_Point(SRC[31:0]) 
ELSE 
DEST[i+63:i] := 
Convert_Ulnteger_To_Double_Precision_Floating_Point(SRC[k+31:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTUDQ2PD 


m512d 


mm512_cvtepu32_pd(__m256i a); 


VCVTUDQ2PD 


m512d 


mm512_mask_cvtepu32_pd(__m512ds,__mmask8 k,___m256i a); 


VCVTUDQ2PD 


m512d 


mm512_maskz_cvtepu32_pd(__mmask8 k, __m256i a); 


VCVTUDQ2PD 


m256d 


VCVTUDQ2PD 


m256d 


mm256_cvtepu32_pd(__m128i a); 
mm256_mask_cvtepu32_pd(__m256ds,__ mmask8 k, __m128i a); 


VCVTUDQ2PD 


m256d 


mm256_maskz_cvtepu32_pd(__mmask8 k, __m128i a); 


VCVTUDQ2PD __| 


m128d 


_mm_cvtepu32_pd(__m128i a); 
VCVTUDQ2PD __m128d_mm_mask_cvtepu32_pd(__m128ds, 


mmask8 k, __m128i a); 


VCVTUDQ2PD __m128d _mm_maskz_cvtepu32_pd(__mmask8 k, 


m128i a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


EVEX-encoded instructions, see Table 2-51, “Type E5 Class Exception Conditions”; additionally: 
If EVEX.vvvv != 1111B. 


#UD 
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VCVTUDQ2PD—Convert Packed Unsigned Doubleword Integers to Packed Double-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, V-Z 


VCVTUDQ2PS—Convert Packed Unsigned Doubleword Integers to Packed Single-Precision 


Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.F2.0F.W0 7A /r A VIV AVX512VL | Convert four packed unsigned doubleword integers from 
VCVTUDQ2PS xmm1 {k1}{Z}, AVX512F xmm2/m128/m32bcst to packed single-precision 
xmm2/m128/m32bcst floating-point values in xmm1 with writemask k1. 
EVEX.256.F2.0F.W0 7A /r A VIV AVX512VL | Convert eight packed unsigned doubleword integers 
VCVTUDQ2PS ymm1 {k1}{z}, AVX512F from ymm2/m256/m32bcst to packed single-precision 
ymm2/m256/m32bcst floating-point values in zmm1 with writemask k1. 
EVEX.512.F2.0F.W0 7A /r A VIV AVX512F Convert sixteen packed unsigned doubleword integers 
VCVTUDQ2PS zmm1 {k1}{2}, from zmm2/m512/m32bcst to sixteen packed single- 
zmm2/m512/m32bcst{er} precision floating-point values in zmm1 with writemask 

k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed unsigned doubleword integers in the source operand (second operand) to single-precision 
floating-point values in the destination operand (first operand). 
The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 


updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTUDQ2PS (EVEX encoded version) when src operand is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


IF (VL = 512) AND (EVEX.b = 1) 


THEN 


SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 


ELSE 


SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TOKL-1 
i:=j* 32 


IF k1[j] OR *no writemask* 


THEN DEST[i+31:i] := 


Convert_Ulnteger_To_Single_Precision_Floating_Point(SRC[i+31:i]) 


ELSE 


IF *merging-masking* 
THEN *DEST{[i+31:i] remains unchanged* 
; zeroing-masking 


ELSE 


DEST[i+31:i] := 0 


Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VCVTUDQ2PS—Convert Packed Unsigned Doubleword Integers to Packed Single-Precision Floating-Point Values 


; merging-masking 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTUDQ2PS (EVEX encoded version) when src operand is a memory source 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_Ulnteger_To_Single_Precision_Floating_Point(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert_Ulnteger_To_Single_Precision_Floating_Point(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 
VCVTUDQ2PS 


m512 


mm512_cvtepu32_ps(__m512i a); 


m512 


mm512_mask_cvtepu32_ps(__m512s,__ mmask16k,___m512i a); 


m512 


mm512_maskz_cvtepu32_ps(__mmask16 k,__m512i a); 


m512 


mm512_cvt_roundepu32_ps(__m512ia, int r); 


m512 


mm512_mask_cvt_roundepu32_ps(__m512s,__ mmask16 k,___m512i a, intr); 


m512 


mm512_maskz_cvt_roundepu32_ps(__mmask16 k,___m512i a, int r); 


m256 


mm256_cvtepu32_ps(__m256i a); 


m256 


mm256_mask_cvtepu32_ps(__m256s,__ mmask8 k,___ m256i a); 


m256 


mm256_maskz_cvtepu32_ps(__mmask8 k, __m256i a); 


_m128 _| 


mm_cvtepu32_ps(__m128i a); 


VCVTUDQ2PS __m128 _mm_mask_cvtepu32_ps(__m128s,__mmask8 k, __m128i a); 
VCVTUDQ2PS __m128 _mm_maskz_cvtepu32_ps(_mmask8 k, __m128i a); 


SIMD Floating-Point Exceptions 


Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
If EVEX.vvvv != 1111B. 


#UD 
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VCVTUDQ2PS—Convert Packed Unsigned Doubleword Integers to Packed Single-Precision Floating-Point Values 


INSTRUCTION SET REFERENCE, V-Z 


VCVTUQQ2PD—Convert Packed Unsigned Quadword Integers to Packed Double-Precision 


Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support Flag 
EVEX.128.F3.0F.W1 7A /r A VIV AVX512VL Convert two packed unsigned quadword integers from 
VCVTUQQ2PD xmm1 {k1}{Z}, AVX512DQ xmm2/m128/m64bcst to two packed double-precision 
xmm2/m128/m64bcst floating-point values in xmm1 with writemask k1. 
EVEX.256.F3.0F.W1 7A /r A VIV AVX512VL Convert four packed unsigned quadword integers from 
VCVTUQQ2PD ymm1 {k1}{z}, AVX512DQ ymm2/m256/m64bcst to packed double-precision floating- 
ymm2/m256/m64bcst point values in ymm1 with writemask k1. 
EVEX.512.F3.0F.W1 7A /r A VV AVX512DQ Convert eight packed unsigned quadword integers from 
VCVTUQQ2PD zmm1 {k1}{z}, zmm2/m512/m64bcst to eight packed double-precision 
zmm2/m512/m64bcst{er} floating-point values in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed unsigned quadword integers in the source operand (second operand) to packed double-precision 


floating-point values in the destination operand (first operand). 


The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally 


updated with writemask k1. 
Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTUQQ2PD (EVEX encoded version) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL == 512) AND (EVEX.b == 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
Convert_UQuadInteger_To_Double_Precision_Floating_Point(SRC[i+63:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] :-= 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VCVTUQQ2PD (EVEX encoded version) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) 
THEN 
DEST[i+63:i] := 
Convert_UQuadInteger_To_Double_Precision_Floating_Point(SRC[63:0]) 
ELSE 
DEST[i+63:i] := 
Convert_UQuadInteger_To_Double_Precision_Floating_Point(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTUQQ2PD __m512d_mm512_cvtepu64_ps(_m512i a); 
VCVTUQQ2PD __m512d_mm512_mask_cvtepu64_ps(__m512ds,__mmask8 k, __m512i a); 
VCVTUQQ2PD __m512d_mm512_maskz_cvtepu64_ps(___mmask8 k, __m512i a); 
VCVTUQQ2PD __m512d_mm512_cvt_roundepu64_ps(__m512i a, int r); 
VCVTUQQ2PD __m512d_mm512_mask_cvt_roundepu64_ps(__m512ds, 
VCVTUQQ2PD __m512d_mm512_maskz_cvt_roundepu64_ps(__mmask8 k, 
VCVTUQQ2PD __m256d __mm256_cvtepu64_ps(__m256i a); 
VCVTUQQ2PD __m256d __mm256_mask_cvtepu64_ps(__m256d s,__mmask8 k, __m256i a); 
VCVTUQQ2PD __m256d __mm256_maskz_cvtepu64_ps(___mmask8 k, __m256i a); 
VCVTUQQ2PD __m128d __mm_cvtepu64_ps(__m128i a); 
VCVTUQQ2PD __m128d _mm_mask_cvtepu64_ps(__m128d s, 
VCVTUQQ2PD __m128d _mm_maskz_cvtepu64_ps(__mmask8 k, 


mmask8 k,___m512i a, int r); 
m512i a, int r); 


mmask8 k, 
m128i a); 


m128i a); 


SIMD Floating-Point Exceptions 


Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VCVTUQQ2PS—Convert Packed Unsigned Quadword Integers to Packed Single-Precision 
Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.F2.0F.W1 7A /r A VIN AVX512VL Convert two packed unsigned quadword integers from 
VCVTUQQ2PS xmm1 {k1}{Z}, AVX512DQ_ | xmm2/m128/m64bcst to packed single-precision floating- 
xmm2/m128/m64bcst point values in zmm1 with writemask k1. 
EVEX.256.F2.0F.W1 7A /r A VIN AVX512VL Convert four packed unsigned quadword integers from 
VCVTUQQ2PS xmm1 {k1}{Z}, AVX512DQ_ =| ymm2/m256/m64bcst to packed single-precision floating- 
ymm2/m256/m64bcst point values in xmm1 with writemask k1. 
EVEX.512.F2.0F.W1 7A /r A VIN AVX512DQ_ | Convert eight packed unsigned quadword integers from 
VCVTUQQ2PS ymm1 {k1}{2Z}, zmm2/m512/m64bcst to eight packed single-precision 
zmm2/m512/m64bcst{er} floating-point values in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts packed unsigned quadword integers in the source operand (second operand) to single-precision floating- 
point values in the destination operand (first operand). 


EVEX encoded versions: The source operand is a ZMM/YMM/XMM register or a 512/256/128-bit memory location. 
The destination operand is a YMM/XMM/XMM (low 64 bits) register conditionally updated with writemask k1. 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Operation 


VCVTUQQ2PS (EVEX encoded version) when src operand is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] = 
Convert_UQuadInteger_To_Single_Precision_Floating_Point(SRC[k+63:k]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 
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VCVTUQQ2PS (EVEX encoded version) when src operand is a memory source 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
Convert_UQuadInteger_To_Single_Precision_Floating_Point(SRC[63:0]) 
ELSE 
DEST[i+31:i] := 
Convert_UQuadInteger_To_Single_Precision_Floating_Point(SRC[k+63:k]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTUQQ2PS __m256 __mm512_cvtepu64_ps(_m512i a); 

VCVTUQQ2PS __m256 __mm512_mask_cvtepu64_ps(__m256 s,__mmask8 k, __m512i a); 
VCVTUQQ2PS __m256 __mm512_maskz_cvtepu64_ps(__mmask8 k, __m512i a); 
VCVTUQQ2PS __m256 __mm512_cvt_roundepu64_ps(__m512ia, int r); 

VCVTUQQ2PS __m256 __mm512_mask_cvt_roundepu64_ps(__m256 s,___mmask8 k, __m512ia, int r); 
VCVTUQQ2PS __m256 __mm512_maskz_cvt_roundepu64_ps(__mmask8 k,___m512i a, int r); 
VCVTUQQ2PS __m128_mm256_cvtepu64_ps( __m256i a); 

VCVTUQQ2PS __m128 _mm256_mask_cvtepu64_ps(__m128s,__mmask8 k, __m256i a); 
VCVTUQQ2PS __m128 _mm256_maskz_cvtepu64_ps(__mmask8 k, __m256i a); 
VCVTUQQ2PS __m128 _mm_cvtepu64_ps(__m128i a); 

VCVTUQQ2PS __m128_mm_mask_cvtepu64_ps(__m128 s,__mmask8 k, __m128i a); 
VCVTUQQ2PS __m128 __mm_maskz_cvtepu64_ps(___mmask8 k, __m128i a); 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VCVTUSI2SD—Convert Unsigned Integer to Scalar Double-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.F2.0F.WO 7B /r A VIV AVX512F | Convert one unsigned doubleword integer from 
VCVTUSI2SD xmm1, xmm2, r/m32 r/m32 to one double-precision floating-point value in 
xmm1. 
EVEX.LLIG.F2.0F.W1 7B /r A VINE. AVX512F | Convert one unsigned quadword integer from r/m64 
VCVTUSI2SD xmm1, xmmc2, r/m64{er} to one double-precision floating-point value in xmm1. 
NOTES: 


1. For this specific instruction, EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is 
used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts an unsigned doubleword integer (or unsigned quadword integer if operand size is 64 bits) in the second 
source operand to a double-precision floating-point value in the destination operand. The result is stored in the low 
quadword of the destination operand. When conversion is inexact, the value returned is rounded according to the 
rounding control bits in the MXCSR register. 


The second source operand can be a general-purpose register or a 32/64-bit memory location. The first source and 
destination operands are XMM registers. Bits (127:64) of the XMM register destination are copied from corre- 
sponding bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX.W1 version: promotes the instruction to use 64-bit input value in 64-bit mode. 
EVEX.WO0 version: attempt to encode this instruction with EVEX embedded rounding is ignored. 


Operation 


VCVTUSI2SD (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[63:0] := Convert_Ulnteger_To_Double_Precision_Floating_Point(SRC2[63:0}); 
ELSE 
DEST[63:0] := Convert_UInteger_To_Double_Precision_Floating_Point(SRC2[31:0]); 
Fl; 


DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] = 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VCVTUSI2SD ___m128d _mm_cvtu32_sd(__m128d s, unsigned a); 


VCVTUSI2SD ___m128d_mm_cvtu64_sd(__m128ds, unsigned __int64 a); 
VCVTUSI2SD __m128d_mm_cvt_roundu64_sd(__m128d ss, unsigned __int64 a, int r); 


SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 


See Table 2-48, “Type E3NF Class Exception Conditions” if W1, else see Table 2-59, “Type ELONF Class Exception 
Conditions”. 
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VCVTUSI2SS—Convert Unsigned Integer to Scalar Single-Precision Floating-Point Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

EVEX.LLIG.F3.0F.WO 7B /r A VIV AVX512F | Convert one signed doubleword integer from r/m32 to 

VCVTUSI2SS xmm1, xmm2, r/m32{er} one single-precision floating-point value in xmm1. 

EVEX.LLIG.F3.0F.W1 7B /r A VINE. AVX512F | Convert one signed quadword integer from r/m64 to 

VCVTUSI2SS xmm1, xmm2, r/m64{er} one single-precision floating-point value in xmm1. 
NOTES: 


1. For this specific instruction, EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is 
used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Converts a unsigned doubleword integer (or unsigned quadword integer if operand size is 64 bits) in the source 
operand (second operand) to a single-precision floating-point value in the destination operand (first operand). The 
source operand can be a general-purpose register or a memory location. The destination operand is an XMM 
register. The result is stored in the low doubleword of the destination operand. When a conversion is inexact, the 
value returned is rounded according to the rounding control bits in the MXCSR register or the embedded rounding 
control bits. 


The second source operand can be a general-purpose register or a 32/64-bit memory location. The first source and 
destination operands are XMM registers. Bits (127:32) of the XMM register destination are copied from corre- 
sponding bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed. 


EVEX.W1 version: promotes the instruction to use 64-bit input value in 64-bit mode. 


Operation 


VCVTUSI2SS (EVEX encoded version) 
IF (SRC2 *is register*) AND (EVEX.b = 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
IF 64-Bit Mode And OperandSize = 64 
THEN 
DEST[31:0] := Convert_Ulnteger_To_Single_Precision_Floating_Point(SRC[63:0)); 
ELSE 
DEST[31:0] := Convert_Ulnteger_To_Single_Precision_Floating_Point(SRC[31:0)); 
Fl; 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] = 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VCVTUSI2SS __m128_mm_cvtu32_ss(__m128 s, unsigned a); 

VCVTUSI2SS __m128_mm_cvt_roundu32_ss(__m128 s, unsigned a, int r); 
VCVTUSI2SS __m128_mm_cvtu64_ss(__m128s, unsigned __int64 a); 
VCVTUSI2SS __m128_mm_cvt_roundu64_ss(__m128s, unsigned __int64 a, int r); 
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SIMD Floating-Point Exceptions 
Precision 


Other Exceptions 


See Table 2-48, “Type E3NF Class Exception Conditions”. 
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VDBPSADBW—Double Block Packed Sum-Absolute-Differences (SAD) on Unsigned Bytes 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F3A.WO 42 /r ib A VIV AVX512VL Compute packed SAD word results of unsigned bytes in 
VDBPSADBW xmm1 {k1}{z}, xmm2, AVX512BW | dword block from xmm_2 with unsigned bytes of dword 
xmm3/m128, imm8 blocks transformed from xmm3/m128 using the shuffle 


controls in imm8. Results are written to xmm1 under the 
writemask k1. 


EVEX.256.66.0F3A.WO 42 /r ib A VV AVX512VL Compute packed SAD word results of unsigned bytes in 
VDBPSADBW ymm1 {k1}{z}, ymm2, AVX512BW | dword block from ymm2 with unsigned bytes of dword 
ymm3/m256, imm8 blocks transformed from ymm3/m256 using the shuffle 


controls in imms. Results are written to ymm1 under the 
writemask k1. 


EVEX.512.66.0F3A.WO 42 /r ib A VIV AVX512BW_ | Compute packed SAD word results of unsigned bytes in 
VDBPSADBW zmm1 {k1}{z}, zmm2, dword block from zmm2 with unsigned bytes of dword 
zmm3/m51 2, imm8 blocks transformed from zmm3/m512 using the shuffle 


controls in imm8. Results are written to zmm1 under the 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Compute packed SAD (sum of absolute differences) word results of unsigned bytes from two 32-bit dword 
elements. Packed SAD word results are calculated in multiples of qword superblocks, producing 4 SAD word results 
in each 64-bit superblock of the destination register. 


Within each super block of packed word results, the SAD results from two 32-bit dword elements are calculated as 
follows: 


¢ The lower two word results are calculated each from the SAD operation between a sliding dword element within 
a qword superblock from an intermediate vector with a stationary dword element in the corresponding qword 
superblock of the first source operand. The intermediate vector, see “Tmp1” in Figure 5-8, is constructed from 
the second source operand the imm8 byte as shuffle control to select dword elements within a 128-bit lane of 
the second source operand. The two sliding dword elements in a qword superblock of Tmpi are located at byte 
offset 0 and 1 within the superblock, respectively. The stationary dword element in the qword superblock from 
the first source operand is located at byte offset 0. 


¢ The next two word results are calculated each from the SAD operation between a sliding dword element within 
a qword superblock from the intermediate vector Tmp1 with a second stationary dword element in the corre- 
sponding qword superblock of the first source operand. The two sliding dword elements in a qword superblock 
of Tmpi are located at byte offset 2and 3 within the superblock, respectively. The stationary dword element in 
the qword superblock from the first source operand is located at byte offset 4. 


¢ The intermediate vector is constructed in 128-bits lanes. Within each 128-bit lane, each dword element of the 
intermediate vector is selected by a two-bit field within the imm8 byte on the corresponding 128-bits of the 
second source operand. The imm§8 byte serves as dword shuffle control within each 128-bit lanes of the inter- 
mediate vector and the second source operand, similarly to PSHUFD. 


The first source operand is a ZMM/YMM/XMM register. The second source operand is a ZMM/YMM/XMM register, or 
a 512/256/128-bit memory location. The destination operand is conditionally updated based on writemask k1 at 
16-bit word granularity. 
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127+128*n 95+128*n 63+128*n 31+128*n 128*n 
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11B: DW3 
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VDBPSADBW—Double Block Packed Sum-Absolute-Differences (SAD) on Unsigned Bytes 


Figure 5-8. 64-bit Super Block of SAD Operation in VDBPSADBW 


Operation 


VDBPSADBW (EVEX encoded versions) 

(KL, VL) = (8, 128), (16, 256), (32, 512) 

Selection of quadruplets: 

FOR! =0 to VL step 128 
TMP1[I+31:1] := select (SRC2[I+127: I], imm8[1:0]) 
TMP1[I+63: I+32] := select (SRC2[I+127: I], imm8[3:2]) 
TMP1[I+95: I+64] := select (SRC2[I+127: I], imm8[5:4]) 
TMP1[I+127: |+96] := select (SRC2[I+127: I], imm8[7:6]) 

END FOR 


SAD of quadruplets: 


FOR | =0 to VL step 64 
TMP_DEST[I+15:1] := ABS(SRC1[I+7: I] - TMP1[I+7: I]) + 
ABS(SRC1[I+15: 1+8]- TMP 1[I+15: 1+8]) + 
ABS(SRC1[I+23: 1+16]- TMP1[I+23: 1+16]) + 
ABS(SRC1[I+31: 1+24]- TMP1[I+31: 1+24]) 


TMP_DEST[I+31: I+16] := ABS(SRC1[I+7: 1] - TMP1[I+15: I+8]) + 
ABS(SRC1[I+15: 1+8]- TMP1[I+23: 1+16]) + 
ABS(SRC1[I+23: 1+16]- TMP1[I+31: 1+24]) + 
ABS(SRC1[I+31: 1+24]- TMP1[I+39: I1+32]) 

TMP_DEST[I+47: I+32] := ABS(SRC1[I+39: +32] - TMP1[I+23: 1+16]) + 
ABS(SRC1[I+47: 1+40]- TMP1[I+31: 1+24]) + 
ABS(SRC1[I+55: 1+48]- TMP1[I+39: 1+32]) + 
ABS(SRC1[I+63: 1+56]- TMP 1[I+47: 1+ 40]) 


TMP_DEST[I+63: I+48] := ABS(SRC1[I+39: +32] - TMP1[I+31: 1+24]) + 
ABS(SRC1[I+47: 1+40] - TMP1[I+39: 1+32]) + 
ABS(SRC1[I+55: 1+48] - TMP1[I+47: 1+40]) + 
ABS(SRC1[I+63: 1+56] - TMP1[I+55: 1+48]) 
ENDFOR 


FOR j := OTOKL-1 
i= j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = TMP_DEST[i+15:i] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] = O 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 
VDBPSADBW 


SIMD Floating-Point Exceptions 


None 


m512i 


mm512 


m512ia,__m512ib int immé8); 


m512i 


mm512 


mask_dbsad_epu8(__m512is, 


mmask32 m,__m512i a,__m512i b int imm8); 


m512i 


mm512 


maskz_dbsad_epu8(__mmask32 m,___m512i a,__m512i b int immé8); 


m256i 


mm256 


m256i a, 


m256i 


mm256 


mask_dbsad_epu8(__m256i s, 


m256i b int imm8); 
mmask16 m, __m256i a,__m256i b int imm8); 


m256i 


mm256 


maskz_dbsad_epu8(__mmask16 m, __m256i a,___m256i b int imm8); 


m1 28i 


mm_dbsad_epu8( 


m128i a, 


m128i 


mm_mask_dbsad_epu8( 


m1 28i b int immés); 
m128i s,__mmask8 m, 


m128i a,__m128i b int imm8); 


m128i 


mm_maskz_dbsad_epu8(__mmask8 m, 


m128i a,__m128i b int imm8); 


Other Exceptions 


See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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VDBPSADBW—Double Block Packed Sum-Absolute-Differences (SAD) on Unsigned Bytes 


INSTRUCTION SET REFERENCE, V-Z 


VDPBF16PS—Dot Product of BF16 Pairs Accumulated into Packed Single Precision 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.F3.0F38.W0 52 /r A VN AVX512VL Multiply BF16 pairs from xmme2 and 
VDPBF16PS xmm1{k1}{z}, xmm_2, AVX512_BF16 xmm3/m128, and accumulate the resulting 
xmm3/m128/m32bcst packed single precision results in xmm1 with 
writemask k1. 
EVEX.256.F3.0F38.W0 52 /r A VIN AVX512VL Multiply BF16 pairs from ymm2 and 
VDPBF16PS ymm1{k1}{z}, ymm2, AVX512_BF16 ymm3/m256, and accumulate the resulting 
ymm3/m256/m32bcst packed single precision results in ymm1 with 
writemask k1. 
EVEX.512.F3.0F38.W0 52 /r A VIV AVX512F Multiply BF16 pairs from zmm2 and 
VDPBF16PS zmm1{k1}{z}, zmm2, AVX512_BF16 zmm3/m512, and accumulate the resulting 
zmm3/m512/m32bcst packed single precision results in zmm1 with 
writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs a SIMD dot-product of two BF16 pairs and accumulates into a packed single precision 


register. 


“Round to nearest even” rounding mode is used when doing each accumulation of the FMA. Output denormals are 
always flushed to zero and input denormals are always treated as zero. MXCSR is not consulted nor updated. 


NaN propagation priorities are described in Table 5-1. 


Table 5-1. NaN Propagation Priorities 


NaN Priority | Description Comments 
1 src1 low is NaN . 
Lower part has priority over upper part, i.e., it overrides the upper part. 

2 src2 low is NaN 

3 src1 high is NaN 

— Upper part may be overridden if lower has NaN. 
4 src2 high is NaN 
5 srcdest is NaN Dest is propagated if no NaN is encountered by srcz. 
Operation 


Define make_fp32(x): 
// The x parameter is bfloat16. Pack it in to upper 16b of a dword. The bit pattern is a legal fp32 value. Return that bit pattern. 


dword := 0 


dword[31:16] := x 


RETURN dword 
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VDPBF16PS srcdest, src1, src2 
VL = (128, 256, 512) 
KL = VL/32 


origdest := srcdest 
FOR i:= 0 to KL-1: 
IF k1[ i] or *no writemask*: 


IF src2 is memory and evex.b == 1: 


t:= src2.dword[0] 
ELSE: 
= src2.dword[ i ] 


// FP32 FMA with daz in, ftz out and RNE rounding. MXCSR neither consulted nor updated. 


srcdest.fp32[ i ] += make_fp32(src1.bfloat16[2*i+1]) * make_fp32(t.bfloat[1]) 
srcdest.fp32[ i ] += make_fp32(src1.bfloat16[2*i+0]) * make_fp32(t.bfloat[0]) 


ELSE IF *zeroing*: 
srcdest.dword[ i ]:= 0 


ELSE: // merge masking, dest element unchanged 
srcdest.dword[ i ] := origdest.dword[ i ] 


srcdest[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VDPBF16PS __m128 __mm_dpbf16_ps( 


VDPBF16PS __m128_mm_mask_dpbf16_ps( 


VDPBF16PS __m128_mm_maskz_dpbf16_ps( 


VDPBF16PS __m256 __mm256_dpbf16_ps( 


VDPBF16PS __m256 __mm256_mask_dpbf16_ps( 


m128bh, __m128bh); 
mmask8, 
mmask8, _m128,___m128bh, ___m128bh); 
m256bh, __m256bh); 


m128bh, __m128bh); 


mmask8, __m256bh, __m256bh); 


VDPBF16PS __m256 __mm256_maskz_dpbf16_ps( 


mmask8, __m256, 


VDPBF16PS __m512 _mm512_dpbf16_ps( 


VDPBF16PS __m512_mm512_mask_dpbf16_ps( 


m256bh, __m256bh); 
m512bh,___m512bh); 
mmask16,__.m512bh,___m512bh); 


VDPBF16PS __m512_mm512_maskz_dpbf16_ps( 


mmask16, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


m512,__m512bh, __m512bh); 


See Table 2-49, “Type E4 Class Exception Conditions”. 
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VEXPANDPD—Load Sparse Packed Double-Precision Floating-Point Values from Dense Memory 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 88 /r A VIV AVX512VL | Expand packed double-precision floating-point values 
VEXPANDPD xmm1 {k1}{Z}, AVX512F from xmm2/m128 to xmm1 using writemask k1. 
xmm2/m128 
EVEX.256.66.0F38.W1 88 /r A VIV AVX512VL | Expand packed double-precision floating-point values 
VEXPANDPD ymm1 {k1}{z}, ymm2/m256 AVX512F from ymm2/m256 to ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 88 /r A VIV AVX512F Expand packed double-precision floating-point values 
VEXPANDPD zmm1 {k1}{z}, zmm2/m512 from zmm2/m512 to zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Expand (load) up to 8/4/2, contiguous, double-precision floating-point values of the input vector in the source 
operand (the second operand) to sparse elements in the destination operand (the first operand) selected by the 
writemask k1. 

The destination operand is a ZMM/YMM/XMM register, the source operand can be a ZMM/YMM/XMM register or a 
512/256/128-bit memory location. 

The input vector starts from the lowest element in the source operand. The writemask register k1 selects the desti- 
nation elements (a partial vector or sparse elements if less than 8 elements) to be replaced by the ascending 
elements in the input vector. Destination elements not selected by the writemask ki are either unmodified or 
zeroed, depending on EVEX.z. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VEXPANDPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+63:i] := SRC[k+63:k]; 
k:=k+64 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 
VEXPANDPD 


m512d 


mm512_mask_expand_pd(__m512ds,__ mmask8 k,__m512d a); 


m512d 


mm512_maskz_expand_pd(__mmask8 k,___m512d a); 


m512d 


mm512_mask_expandloadu_pd(__m512ds, __mmask8 k, void * a); 


m512d 


mm512_maskz_expandloadu_pd(__mmask8 k, void * a); 


m256d 


mm256_mask_expand_pd(__m256ds,__ mmask8 k,___ m256d a); 


m256d 


mm256_maskz_expand_pd(__mmask8 k, __m256d a); 


m256d 


mm256_mask_expandloadu_pd(_m256d s,___ mmask8 k, void * a); 


m256d 


mm256_maskz_expandloadu_pd(__mmask8 k, void * a); 


m128d 


mm_mask_expand_pd(__m128ds,__ mmask8 k,___m128d a); 


m128d 


mm_maskz_expand_pd(__mmask8 k, __m128d a); 


m128d 


m128d 


mm_mask_expandloadu_pd(__m128d s,___mmask8 k, void * a); 
mm_maskz_expandloadu_pd(__ mmask8 k, void * a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”; additionally: 


#UD 
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VEXPANDPS—Load Sparse Packed Single-Precision Floating-Point Values from Dense Memory 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 88 /r A VV AVX512VL | Expand packed single-precision floating-point values 
VEXPANDPS xmm1 {k1}{z}, xmm2/m128 AVX512F from xmm2/m128 to xmm1 using writemask k1. 
EVEX.256.66.0F38.W0 88 /r A VV AVX512VL | Expand packed single-precision floating-point values 
VEXPANDPS ymm1 {k1}{z}, ynm2/m256 AVX512F from ymm2/m256 to ymm1 using writemask k1. 
EVEX.512.66.0F38.W0 88 /r A VV AVX512F Expand packed single-precision floating-point values 
VEXPANDPS zmm1 {k1}{z}, zmm2/m512 from zmm2/m512 to zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Expand (load) up to 16/8/4, contiguous, single-precision floating-point values of the input vector in the source 
operand (the second operand) to sparse elements of the destination operand (the first operand) selected by the 


writemask k1. 


The destination operand is a ZMM/YMM/XMM register, the source operand can be a ZMM/YMM/XMM register or a 


512/256/128-bit memory location. 


The input vector starts from the lowest element in the source operand. The writemask k1 selects the destination 
elements (a partial vector or sparse elements if less than 16 elements) to be replaced by the ascending elements 
in the input vector. Destination elements not selected by the writemask ki are either unmodified or zeroed, 


depending on EVEX.z. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 


instead of the size of the full vector. 


Operation 


VEXPANDPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+31:i] = SRC[k+31:k]; 
k:=k+32 
ELSE 
IF *merging-masking* 


ELSE 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
; zeroing-masking 
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Intel C/C++ Compiler Intrinsic Equivalent 


VEXPANDPS __m512 __mm512_mask_expand_ps(__m512s,__ mmask16 k,__m512 a); 
VEXPANDPS __m512_mm512_maskz_expand_ps(__mmask16 k,___m512 a); 
VEXPANDPS __m512 _mm512_mask_expandloadu_ps(__m512 s,___ mmask16 k, void * a); 
VEXPANDPS __m512 _mm512_maskz_expandloadu_ps(___mmask16 k, void * a); 
VEXPANDPD __m256 _mm256_mask_expand_ps(__m256s,__ mmask8 k,___m256 a); 
VEXPANDPD __m256 _mm256_maskz_expand_ps(__mmask8 k,___m256 a); 
VEXPANDPD __m256 _mm256_mask_expandloadu_ps(__m256 s,___ mmask8 kK, void * a); 
VEXPANDPD __m256 _mm256_maskz_expandloadu_ps(__mmask8 Kk, void * a); 
VEXPANDPD __m128 _mm_mask_expand_ps(__m128s,__ mmask8 k,___m128 a); 
VEXPANDPD __m128 _mm_maskz_expand_ps(__mmask8 k,___m128 a); 

VEXPANDPD __m128 _mm_mask_expandloadu_ps(__m128 s,___mmask8 kK, void * a); 
VEXPANDPD __m128 _mm_maskz_expandloadu_ps( ___mmask8 k, void * a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VERR/VERW—Verify a Segment for Reading or Writing 
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Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 00 /4 VERR r/m16 M Valid Valid Set ZF=1 if segment specified with r/m76 can 
be read. 
OF 00/5 VERW r/m16 M Valid Valid Set ZF=1 if segment specified with r/m16 can 
be written. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Verifies whether the code or data segment specified with the source operand is readable (VERR) or writable 
(VERW) from the current privilege level (CPL). The source operand is a 16-bit register or a memory location that 
contains the segment selector for the segment to be verified. If the segment is accessible and readable (VERR) or 
writable (VERW), the ZF flag is set; otherwise, the ZF flag is cleared. Code segments are never verified as writable. 
This check cannot be performed on system segments. 


To set the ZF flag, the following conditions must be met: 


¢ The segment selector is not NULL. 


° The selector must denote a descriptor within the bounds of the descriptor table (GDT or LDT). 


¢ The selector must denote the descriptor of a code or data segment (not that of a system segment or gate). 


¢ For the VERR instruction, the segment must be readable. 


¢ For the VERW instruction, the segment must be a writable data segment. 


e If the segment is not a conforming code segment, the segment’s DPL must be greater than or equal to (have 
less or the same privilege as) both the CPL and the segment selector's RPL. 


The validation performed is the same as is performed when a segment selector is loaded into the DS, ES, FS, or GS 
register, and the indicated access (read or write) is performed. The segment selector's value cannot result in a 
protection exception, enabling the software to anticipate possible segment access problems. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. The operand size is fixed at 16 bits. 


Operation 
IF SRC(Offset) > (GDTR(Limit) or (LDTR(Limit)) 


THEN ZF := 0; Fl; 


Read segment descriptor; 


IF SegmentDescriptor(DescriptorT ype) = O (* System segment *) 
or (SegmentDescriptor(Type) # conforming code segment) 
and (CPL > DPL) or (RPL > DPL) 


THEN 


ELSE 


IF (Instruction = VERR) and (Segment readable)) 
or ((Instruction = VERW) and (Segment writable)) 


Fl; 
Fl; 


VERR/VERW—Verify a Segment for Reading or Writing 


THEN 
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Flags Affected 
The ZF flag is set to 1 if the segment is accessible and readable (VERR) or writable (VERW); otherwise, it is set to 0. 


Protected Mode Exceptions 
The only exceptions generated for these instructions are those related to illegal addressing of the source operand. 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD The VERR and VERW instructions are not recognized in real-address mode. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#UD The VERR and VERW instructions are not recognized in virtual-8086 mode. 
If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used. 
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VEXTRACTF128/VEXTRACTF32x4/VEXTRACTF64x2/VEXTRACTF32x8/VEXTRACTF64x4—Extr 
act Packed Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.256.66.0F3A.WO 19 /r ib A VIV AVX Extract 128 bits of packed floating-point values 
VEXTRACTF128 xmm1/m128, ymm2, from ymm2 and store results in xmm1/m128. 
imm8 
EVEX.256.66.0F3A.WO 19 /r ib C VIV AVX512VL | Extract 128 bits of packed single-precision floating- 
VEXTRACTF32X4 xmm1/m1 28 {k1}{z}, AVX512F point values from ymm2 and store results in 
ymm_2, imm8 xmm1/m128 subject to writemask k1. 
EVEX.512.66.0F3A.WO 19 /r ib C VIV AVX512F Extract 128 bits of packed single-precision floating- 
VEXTRACTF32x4 xmm1/m1 28 {k1}{z}, point values from zmm2 and store results in 
zmm2, imm8 xmm1/m128 subject to writemask k1. 
EVEX.256.66.0F3A.W1 19 /r ib B VIV AVX512VL | Extract 128 bits of packed double-precision 
VEXTRACTF64X2 xmm1/m128 {k1}{2}, AVX512DQ | floating-point values from ymme2 and store results 
ymm_2, imm8 in xmm1/m128 subject to writemask k1. 
EVEX.512.66.0F3A.W1 19 /r ib B VV AVX512DQ | Extract 128 bits of packed double-precision 
VEXTRACTF64X2 xmm1/m128 {k1}{z}, floating-point values from zmm2 and store results 
zmm2, imm8 in xmm1/m128 subject to writemask k1. 
EVEX.512.66.0F3A.WO 1B /r ib D VIN AVX512DQ | Extract 256 bits of packed single-precision floating- 
VEXTRACTF32X8 ymm1/m256 {k1}{Z}, point values from zmm2 and store results in 
zmm2, imm8 ymm1/m256 subject to writemask k1. 
EVEX.512.66.0F3A.W1 1B /r ib C VIV AVX512F Extract 256 bits of packed double-precision 
VEXTRACTF64x4 ymm1/m256 {k1}{z}, floating-point values from zmm2 and store results 
zmme2, imm8 in ymm1/m256 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
B Tuple2 ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
C Tuple4 ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
D Tuple8 ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
Description 


VEXTRACTF128/VEXTRACTF32x4 and VEXTRACTF64x2 extract 128-bits of single-precision floating-point values 
from the source operand (the second operand) and store to the low 128-bit of the destination operand (the first 
operand). The 128-bit data extraction occurs at an 128-bit granular offset specified by imm8[0] (256-bit) or 
imm8[1:0] as the multiply factor. The destination may be either a vector register or an 128-bit memory location. 
VEXTRACTF32x4: The low 128-bit of the destination operand is updated at 32-bit granularity according to the 
writemask. 


VEXTRACTF32x8 and VEXTRACTF64x4 extract 256-bits of double-precision floating-point values from the source 
operand (second operand) and store to the low 256-bit of the destination operand (the first operand). The 256-bit 
data extraction occurs at an 256-bit granular offset specified by imm8[0] (256-bit) or imm8[0] as the multiply 
factor The destination may be either a vector register or a 256-bit memory location. 


VEXTRACTF64x4: The low 256-bit of the destination operand is updated at 64-bit granularity according to the 
writemask. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
The high 6 bits of the immediate are ignored. 


If VEXTRACTF128 is encoded with VEX.L= 0, an attempt to execute the instruction encoded with VEX.L= 0 will 
cause an #UD exception. 
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Operation 


VEXTRACTF32x4 (EVEX encoded versions) when destination is a register 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[127:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[127:0] := SRC1[383:256] 
11: TMP_DEST[127:0] := SRC1[511:384] 
ESAC. 
Fl; 
FOR j :=O0TO3 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:128] := 0 


VEXTRACTF32x4 (EVEX encoded versions) when destination is memory 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[127:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[127:0] := SRC1[383:256] 
11: TMP_DEST[127:0] := SRC1[511:384] 
ESAC. 
Fl; 


FOR j :=0TO3 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{[i+31:i] := TMP_DEST[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; Merging-masking 
Fl; 
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ENDFOR 


VEXTRACTF64x2 (EVEX encoded versions) when destination is a register 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[1 27:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[1 27:0] := SRC1[383:256] 
11: TMP_DEST[1 27:0] := SRC1[511:384] 
ESAC. 
Fl; 


FOR j:=OTO1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:128] := 0 


VEXTRACTF64x2 (EVEX encoded versions) when destination is memory 
VL = 256, 512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[1 27:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[1 27:0] := SRC1[383:256] 
11: TMP_DEST[1 27:0] := SRC1[511:384] 
ESAC. 
Fl; 


FOR j :=0TO1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
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ELSE *DEST[i+63:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR 


VEXTRACTF32x8 (EVEX.U1.512 encoded version) when destination is a register 
VL=512 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j :=OTO7 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:256] := 0 


VEXTRACTF32x8 (EVEX.U1.512 encoded version) when destination is memory 
CASE (imm8[0]) OF 

0: TMP_DEST[255:0] := SRC1[255:0] 

1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j :=OTO7 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; mMerging-masking 
Fl; 
ENDFOR 


VEXTRACTF64x4 (EVEX.512 encoded version) when destination is a register 
VL=512 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j:=0T03 
i:=j*64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
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DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:256] := 0 


VEXTRACTF64x4 (EVEX.512 encoded version) when destination is memory 


CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j:=OTO3 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE ; merging-masking 
*DEST[i+63:i] remains unchanged* 
Fl; 
ENDFOR 


VEXTRACTF128 (memory destination form) 
CASE (imm8[0]) OF 

0: DEST[127:0] := SRC1[127:0] 

1: DEST[127:0] := SRC1[255:128] 
ESAC. 


VEXTRACTF1 28 (register destination form) 
CASE (imm8[0]) OF 
0: DEST[127:0] := SRC1[127:0] 
1: DEST[127:0] := SRC1[255:128] 
ESAC. 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VEXTRACTF32x4___m128_mm512_extractf32x4_ps(__m512 a, const int nidx); 
VEXTRACTF32x4___m128_mm512_mask_extractf32x4_ps(__m128 s,___ mmask8 k, 
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m512 a, const int nidx); 


VEXTRACTF32x4___m128_mm512_maskz_extractf32x4_ps(__mmask8 k,__m512 a, const int nidx); 


VEXTRACTF32x4 ___m128_mm256_extractf32x4_ps(__m256 a, const int nidx); 


VEXTRACTF32x4___m128_mm256_mask_extractf32x4_ps(__m128 s,___ mmask8 k,___m256 a, const int nidx); 
VEXTRACTF32x4___m128_mm256_maskz_extractf32x4_ps(__mmask8 k,__m256 a, const int nidx); 


VEXTRACTF32x8 __m256_mm512_extractf32x8_ps(__m512 a, const int nidx); 
VEXTRACTF32x8 __m256 __mm512_mask_extractf32x8_ps(__m256 s,___ mmask8 k, 


m512 a, const int nidx); 


VEXTRACTF32x8 __m256 _mm512_maskz_extractf32x8_ps(__mmask8 k,__m512 a, const int nidx); 


VEXTRACTF64x2 __m128d_mm512_extractf64x2_pd(__m512d a, const int nidx); 


VEXTRACTF64x2 
VEXTRACTF64x2 
VEXTRACTF64x2 
VEXTRACTF64x2 
VEXTRACTF64x2 
VEXTRACTF64x4 
VEXTRACTF64x4 
VEXTRACTF64x4 


m128d 


mm512 


mask_extractf64x2_pd(__m128ds,__ mmask8 k,__m512d a, const int nidx); 


m128d 


mm512 


maskz_extractf64x2_pd(__mmask8 k,___m512d a, const int nidx); 


m128d 


mm256 


extractf64x2_pd(__m256d a, const int nidx); 


m128d 


mm256 


mask_extractf64x2_pd(__m128ds,__ mmask8 k,___m256d a, const int nidx); 


m128d 


mm256 


maskz_extractf64x2_pd(__mmask8 k, __m256d a, const int nidx); 


m256d 


mm512 


extractf64x4_pd(__m512d a, const int nidx); 


m256d 


mm512 


m256d 


mm512 


mask_extractf64x4_pd(__m256ds,__ mmask8 k,__m512d a, const int nidx); 
maskz_extractf64x4_pd(__mmask8 k,___m512d a, const int nidx); 


VEXTRACTF128 ___m128 _mm256_extractf128_ps (__m256 a, int offset); 
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VEXTRACTF128 ___m128d_mm256_extractf128_pd (__m256d a, int offset); 
VEXTRACTF128 __m128i_mm256_extractf128_si256(__m256i a, int offset); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VEX-encoded instructions, see Table 2-23, “Type 6 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-54, “Type E6NF Class Exception Conditions”. 


Additionally: 
#UD IF VEX.L = 0. 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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VEXTRACTI1 28/VEXTRACTI32x4/VEXTRACTI64x2/VEXTRACTI32x8/VEXTRACTI64x4—Extract 


packed Integer Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.256.66.0F3A.WO 39 /r ib A VV AVX2 Extract 128 bits of integer data from ymm2 and 
VEXTRACTI128 xmm1/m128, ymm2, store results in xmm1/m1 28. 
imm8 
EVEX.256.66.0F3A.WO 39 /r ib C VV AVX512VL_ | Extract 128 bits of double-word integer values 
VEXTRACTI3Z2X4 xmm1/m128 {k1}{Z}, AVX512F from ymmz and store results in xmm1/m128 
ymm_2, imm8 subject to writemask k1. 
EVEX.512.66.0F3A.WO 39 /r ib C VV AVX512F Extract 128 bits of double-word integer values 
VEXTRACTI32x4 xmm1/m1 28 {k1}{z}, from zmm2 and store results in xmm1/m128 
zmm2, imm8 subject to writemask k1. 
EVEX.256.66.0F3A.W1 39 /r ib B VV AVX512VL_ | Extract 128 bits of quad-word integer values from 
VEXTRACTI64X2 xmm1/m128 {k1}{2}, AVX512DQ | ymm2 and store results in xmm1/m128 subject to 
ymm_2, imm8 writemask k1. 
EVEX.512.66.0F3A.W1 39 /r ib B VN AVX512DQ_ | Extract 128 bits of quad-word integer values from 
VEXTRACTI64X2 xmm1/m128 {k1}{z}, zmme2 and store results in xmm1/m128 subject to 
zmm_2, imm8 writemask k1. 
EVEX.512.66.0F3A.WO 3B /r ib D VV AVX512DQ_ | Extract 256 bits of double-word integer values 
VEXTRACTI3Z2X8 ymm1/m256 {k1}{z}, from zmm2 and store results in ymm1/m256 
zmm2, imm8 subject to writemask k1. 
EVEX.512.66.0F3A.W1 3B /r ib C VV AVX512F Extract 256 bits of quad-word integer values from 
VEXTRACTI64x4 ymm1/m256 {k1}{zZ}, zmmez and store results in ymm1/m256 subject to 
zmm_2, imm8 writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
B Tuple2 ModRM:r/m (w) ModRM:reg (r) Imm8 NA 
C Tuple4 ModRM:r/m (w) ModRM:reg (r) Imm8s NA 
D Tuple8 ModRM:r/m (w) ModRM:reg (r) Imm8 NA 
Description 


VEXTRACTI128/VEXTRACTI32x4 and VEXTRACTI64x2 extract 128-bits of doubleword integer values from the 
source operand (the second operand) and store to the low 128-bit of the destination operand (the first operand). 
The 128-bit data extraction occurs at an 128-bit granular offset specified by imm8[0] (256-bit) or imm8[1:0] as 
the multiply factor. The destination may be either a vector register or an 128-bit memory location. 


VEXTRACTI32x4: The low 128-bit of the destination operand is updated at 32-bit granularity according to the 


writemask. 


VEXTRACTI64x2: The low 128-bit of the destination operand is updated at 64-bit granularity according to the 


writemask. 


VEXTRACTI32x8 and VEXTRACTI64x4 extract 256-bits of quadword integer values from the source operand (the 
second operand) and store to the low 256-bit of the destination operand (the first operand). The 256-bit data 
extraction occurs at an 256-bit granular offset specified by imm8[0] (256-bit) or imm8[0] as the multiply factor 
The destination may be either a vector register or a 256-bit memory location. 


VEXTRACTI32x8: The low 256-bit of the destination operand is updated at 32-bit granularity according to the 


writemask. 
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VEXTRACTI64x4: The low 256-bit of the destination operand is updated at 64-bit granularity according to the 
writemask. 


VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
The high 7 bits (6 bits in EVEX.512) of the immediate are ignored. 


If VEXTRACTI128 is encoded with VEX.L= 0, an attempt to execute the instruction encoded with VEX.L= 0 will 
cause an #UD exception. 


Operation 


VEXTRACTI32x4 (EVEX encoded versions) when destination is a register 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[127:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[127:0] := SRC1[383:256] 
11: TMP_DEST[127:0] := SRC1[511:384] 
ESAC. 
Fl; 
FOR j :=0 TO 3 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:128] := 0 


VEXTRACTI32x4 (EVEX encoded versions) when destination is memory 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[127:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[127:0] := SRC1[383:256] 
11: TMP_DEST[127:0] := SRC1[51 1:384] 
ESAC. 
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Fl; 


FOR j :=O0TO3 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VEXTRACTI64x2 (EVEX encoded versions) when destination is a register 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[1 27:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:1 28] 
10: TMP_DEST[1 27:0] := SRC1[383:256] 
11: TMP_DEST[1 27:0] := SRC1[511:384] 
ESAC. 
Fl; 


FOR j:=OTO1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:128] := 0 
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VEXTRACTI64x2 (EVEX encoded versions) when destination is memory 
VL = 256,512 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC1[127:0] 
1: TMP_DEST[127:0] := SRC1[255:128] 
ESAC. 
Fl; 
IF VL=512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[1 27:0] := SRC1[127:0] 
01: TMP_DEST[127:0] := SRC1[255:128] 
10: TMP_DEST[127:0] := SRC1[383:256] 
11: TMP_DEST[127:0] := SRC1[511:384] 
ESAC. 
Fl; 


FOR j :=0OTO1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE *DEST[i+63:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR 


VEXTRACTI32x8 (EVEX.U1.512 encoded version) when destination is a register 
VL=512 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j :=OTO7 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:256] := 0 
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VEXTRACTI32x8 (EVEX.U1.512 encoded version) when destination is memory 
CASE (imm8[0]) OF 

0: TMP_DEST[255:0] := SRC1[255:0] 

1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j:=OTO7 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VEXTRACTI64x4 (EVEX.512 encoded version) when destination is a register 
VL=512 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 


FOR j:=OTO3 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:256] := 0 


VEXTRACTI64x4 (EVEX.512 encoded version) when destination is memory 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC1[255:0] 
1: TMP_DEST[255:0] := SRC1[511:256] 
ESAC. 
FOR j:=OTO3 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE *DEST[i+63:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 
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VEXTRACTI1 28 (memory destination form) 
CASE (imm8[0]) OF 

0: DEST[127:0] := SRC1[127:0] 

1: DEST[1 27:0] := SRC1[255:128] 
ESAC. 


VEXTRACTI1 28 (register destination form) 
CASE (imm8[0]) OF 
0: DEST[127:0] := SRC1[127:0] 
1: DEST[1 27:0] := SRC1[255:128] 
ESAC. 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VEXTRACTI32x4 __m128i_mm512_extracti32x4_epi32(__m512i a, const int nidx); 

VEXTRACTI32x4 __m128i__mm512_mask_extracti32x4_epi32(__m128is,__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI32x4 __m128i_mm512_maskz_extracti32x4_epi32(__mmask8 k,__m512i a, const int nidx); 
VEXTRACTI32x4 ___m128i__mm256_extracti32x4_epi32(__m256i a, const int nidx); 

VEXTRACTI32x4 __m128i__mm256_mask_extracti32x4_epi32(__m128i s,__ mmask8 k, __m256i a, const int nidx); 
VEXTRACTI32x4 __m128i __mm256_maskz_extracti32x4_epi32(__mmask8 k, __ m256i a, const int nidx); 
VEXTRACTI32x8 __m256i_mm512_extracti32x8_epi32(__m512i a, const int nidx); 

VEXTRACTI32x8 __m256i_mm512_mask_extracti32x8_epi32(__m256is,__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI32x8 __m256i_mm512_maskz_extracti32x8_epi32(__mmask8 k,__m512i a, const int nidx); 
VEXTRACTI64x2 __m128i_mm512_extracti64x2_epi64(__m512i a, const int nidx); 

VEXTRACTI64x2 __ m128i_mm512_mask_extracti64x2_epi64(__m128i s,__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI64x2 __m128i_mm512_maskz_extracti64x2_epi64(__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI64x2 __m128i_mm256_extracti64x2_epi64(__m256i a, const int nidx); 

VEXTRACTI64x2 __m128i_mm256_mask_extracti64x2_epi64(__m128is,__ mmask8 k, __m256i a, const int nidx); 
VEXTRACTI64x2 __m128i_mm256_maskz_extracti64x2_epi64(__ mmask8 k, __ m256i a, const int nidx); 
VEXTRACTI64x4 _ m256i_mm512_extracti64x4_epi64(__m512i a, const int nidx); 

VEXTRACTI64x4 __ m256i_mm512_mask_extracti64x4_epi64(__m25Gis,__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI64x4 __m256i__mm512_maskz_extracti64x4_epi64(__ mmask8 k, __m512i a, const int nidx); 
VEXTRACTI128 __m128i_mm256_extracti128_si256(__m256i a, int offset); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VEX-encoded instructions, see Table 2-23, “Type 6 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-54, “Type E6NF Class Exception Conditions”. 


Additionally: 
#UD IF VEX.L = 0. 
#UD If VEX.vvvv != 1111B or EVEX.vvvv != 1111B. 
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VFIXUPIMMPD—Fix Up Special Packed Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F3A.W1 54 /r ib A VIV AVX512VL | Fix up special numbers in float64 vector xmm1, float64 
VFIXUPIMMPD xmm1 {k1}{z}, xmm2, AVX512F vector xmm_2 and int64 vector xmm3/m128/m64bcst 
xmm3/m128/m64bcst, imm8 and store the result in xmm1, under writemask. 
EVEX.256.66.0F3A.W1 54 /r ib A VV AVX512VL | Fix up special numbers in float64 vector ymm1, float64 
VFIXUPIMMPD ymm1 {k1}{z}, ymm2, AVX512F vector ymm_2 and int64 vector ymm3/m256/m64bcst 
ymm3/m256/m64bcst, imm8 and store the result in ymm1, under writemask. 
EVEX.512.66.0F3A.W1 54 /r ib A VV AVX512F Fix up elements of float64 vector in zmm2 using int64 
VFIXUPIMMPD zmm1 {k1}{z}, zmm2, vector table in zmm3/m512/m64bcst, combine with 
zmm3/m512/m64bcst{sae}, imm8 preserved elements from zmm1, and store the result in 

zmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Perform fix-up of quad-word elements encoded in double-precision floating-point format in the first source operand 
(the second operand) using a 32-bit, two-level look-up table specified in the corresponding quadword element of 
the second source operand (the third operand) with exception reporting specifier imm8. The elements that are 
fixed-up are selected by mask bits of 1 specified in the opmask k1. Mask bits of 0 in the opmask k1 or table 
response action of 0000b preserves the corresponding element of the first operand. The fixed-up elements from 
the first source operand and the preserved element in the first operand are combined as the final results in the 
destination operand (the first operand). 


The destination and the first source operands are ZMM/YMM/XMM registers. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. 


The two-level look-up table perform a fix-up of each DP FP input data in the first source operand by decoding the 
input data encoding into 8 token types. A response table is defined for each token type that converts the input 
encoding in the first source operand with one of 16 response actions. 


This instruction is specifically intended for use in fixing up the results of arithmetic calculations involving one source 
so that they match the spec, although it is generally useful for fixing up the results of multiple-instruction 
sequences to reflect special-number inputs. For example, consider rcp(0). Input 0 to rcp, and you should get INF 
according to the DX10 spec. However, evaluating rcp via Newton-Raphson, where x=approx(1/0), yields an incor- 
rect result. To deal with this, VFIXUPIMMPD can be used after the N-R reciprocal sequence to set the result to the 
correct value (i.e. INF when the input is 0). 


If MXCSR.DAZ is not set, denormal input elements in the first source operand are considered as normal inputs and 
do not trigger any fixup nor fault reporting. 


Imm is used to set the required flags reporting. It supports #ZE and #IE fault reporting (see details below). 


MXCSR mask bits are ignored and are treated as if all mask bits are set to masked response). If any of the imm8 
bits is set and the condition met for fault reporting, MXCSR.IE or MXCSR.ZE might be updated. 


This instruction is writemasked, so only those elements with the corresponding bit set in vector mask register ki 
are computed and stored into zmm1. Elements in the destination with the corresponding bit clear in k1 retain their 
previous values or are set to 0. 
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Operation 


enum TOKEN_TYPE 

{ 
QNAN_TOKEN := 0, 
SNAN_TOKEN := 1, 
ZERO_VALUE_TOKEN := 2, 
POS_ONE_VALUE_TOKEN := 3, 
NEG_INF_TOKEN := 4, 
POS_INF_TOKEN := 5, 
NEG_VALUE_TOKEN := 6, 
POS_VALUE_TOKEN := 7 

} 


FIXUPIMM_DP (dest[63:0], src1[63:0],tbl3[63:0], imm8 [7:0]){ 
tsrc[63:0] := ((src1 [62:52] = 0) AND (MXCSR.DAZ =1)) ? 0.0 : src1[63:0] 
CASE(tsrc[63:0] of TOKEN_TYPE) { 
QNAN_TOKEN: j := 0; 
SNAN_TOKEN: j := 1; 
ZERO_VALUE_TOKEN: j := 2; 
POS_ONE_VALUE_TOKEN: j := 3; 
NEG_INF_TOKEN: j := 4; 
POS_INF_TOKEN: j := 5; 
NEG_VALUE_TOKEN: j := 6; 
POS_VALUE_TOKEN: j := 7; 

} ; end source special CASE(tsrc...) 


; The required response from src3 table is extracted 
token_response[3:0] = tbl3[3+4*j:4*j]; 


CASE(token_response[3:0)) { 
0000: dest[63:0] := dest[63:0]; ; preserve content of DEST 
0001: dest[63:0] := tsrc[63:0); ; pass through src1 normal input value, denormal as zero 
0010: dest[63:0] := QNaN(tsrc[63:0)); 
0011: dest[63:0] := QNAN_Indefinite; 
0100: dest[63:0] := -INF; 
0101: dest[63:0] := +INF; 
0110: dest[63:0] := tsrc.sign? -INF : +INF; 
0111: dest[63:0] := -0; 
1000: dest[63:0] := +0; 
1001: dest[63:0] := -1; 
1010: dest[63:0] := +1; 
1011: dest[63:0] := %; 
1100: dest[63:0] := 90.0; 
1101: dest[63:0] := Pl/2; 
1110: dest[63:0] := MAX_FLOAT; 
1111: dest[63:0] := -MAX_FLOAT; 
} ; end of token_response CASE 
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; The required fault reporting from immé8 is extracted 
; TOKENs are mutually exclusive and TOKENs priority defines the order. 
; Multiple faults related to a single token can occur simultaneously. 
IF (tsrc[63:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[0] then set #ZE; 
IF (tsrc[63:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[1] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[2] then set #ZE; 
IF (tsrc[63:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[3] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: SNAN_TOKEN) AND imm8[4] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: NEG_INF_TOKEN) AND imm8[5] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: NEG_VALUE_TOKEN) AND imm8[6] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: POS_INF_TOKEN) AND imm8[7] then set #IE; 
; end fault reporting 

return dest[63:0]; 

} ;end of FIXUPIMM_DP() 


ee ee ee ee 


VFIXUPIMMPD 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j:= O TOKL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] := FIXUPIMM_DP(DEST[i+63:i], SRC1[i+63:i], SRC2[63:0], imm8 [7:0]) 
ELSE 
DEST[i+63:i] := FIXUPIMM_DP(DEST[i+63:i], SRC1 [i+63:i], SRC2[i+63:i], imm8 [7:0]) 
Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Immediate Control Description: 


|7| 6] 5 4] 3] 2 1/0 
+INF> #IE 
- VE > #IE 

- INF> #IE 
SNaN> #IE 
ONE > #IE 
ONE > #ZE 
ZERO > #15 
ZERO >  —f2E 


Figure 5-9. VFIXUPIMMPD Immediate Control Description 


Intel C/C++ Compiler Intrinsic Equivalent 


VFIXUPIMMPD __m512d_mm512_fixupimm_pd(__m512d a, ___m512i tbl, int imm); 

VFIXUPIMMPD __m512d_mm512_mask_fixupimm_pd(__m512d s,___mmask8 k,__m512da,__m512i tbl, int imm); 
VFIXUPIMMPD __m512d_mm512_maskz_fixupimm_pd(__mmask8 k,__m512da,__m512i tbl, int imm); 
VFIXUPIMMPD __m512d_mm512_fixupimm_round_pd(__m512da,__m512i tbl, int imm, int sae); 

VFIXUPIMMPD __m512d_mm512_mask_fixupimm_round_pd(__m512ds,__ mmask8 k,__m512d a,__m512z tbl, int imm, int sae); 
VFIXUPIMMPD __m512d_mm512_maskz_fixupimm_round_pd(__mmask8 k,__m512d a,__m512i tbl, int imm, int sae); 
VFIXUPIMMPD __m256d_mm256_fixupimm_pd(__m256d a, m256d b,___ m256i c, int imm8); 

VFIXUPIMMPD __m256d__mm256_mask_fixupimm_pd(__m256d a,__mmask8 k,__m256d b,__ m256i c, int imm8); 
VFIXUPIMMPD __m256d __mm256_maskz_fixupimm_pd(__mmask8 k,__m256d a,__m256d b,___m256i c, int imm8); 
VFIXUPIMMPD __m128d _mm_fixupimm_pd(__m128d a,__m128d b,__m128ic, int imm8); 

VFIXUPIMMPD __m128d __mm_mask_fixupimm_pd(__m128d a, ___mmask8 k,__m128d b, __m128i_c, int imm8); 
VFIXUPIMMPD __m128d __mm_maskz_fixupimm_pd(__mmask8 k,___m128d a,__m128db, 128ic, int imm8); 


SIMD Floating-Point Exceptions 


Zero, Invalid 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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VFIXUPIMMPS—Fix Up Special Packed Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F3A.WO 54 /r A VIV AVX512VL | Fix up special numbers in float32 vector xmm1, float32 
VFIXUPIMMPS xmm1 {k1}{z}, xmm2, AVX512F vector xmm_2 and int32 vector xmm3/m128/m32bcst 
xmm3/m128/m32bcst, imm8 and store the result in xmm1, under writemask. 
EVEX.256.66.0F3A.WO 54 /r A VIV AVX512VL | Fix up special numbers in float32 vector ymm1, float32 
VFIXUPIMMPS ymm1 {k1}{z}, ymm2, AVX512F vector ymm_2 and int32 vector ymm3/m256/m32bcst 
ymm3/m256/m32bcst, imm8 and store the result in ymm1, under writemask. 
EVEX.512.66.0F3A.WO 54 /r ib A VIV AVX512F Fix up elements of float32 vector in zmm2 using int32 
VFIXUPIMMPS zmm1 {k1}{z}, zmm2, vector table in zmm3/m512/m32bcst, combine with 
zmm3/m51 2/m32bcst{sae}, imm8 preserved elements from zmm1, and store the result in 

zmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Perform fix-up of doubleword elements encoded in single-precision floating-point format in the first source operand 
(the second operand) using a 32-bit, two-level look-up table specified in the corresponding doubleword element of 
the second source operand (the third operand) with exception reporting specifier imm8. The elements that are 
fixed-up are selected by mask bits of 1 specified in the opmask k1. Mask bits of 0 in the opmask k1 or table 
response action of 0000b preserves the corresponding element of the first operand. The fixed-up elements from 
the first source operand and the preserved element in the first operand are combined as the final results in the 
destination operand (the first operand). 


The destination and the first source operands are ZMM/YMM/XMM registers. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. 


The two-level look-up table perform a fix-up of each SP FP input data in the first source operand by decoding the 
input data encoding into 8 token types. A response table is defined for each token type that converts the input 
encoding in the first source operand with one of 16 response actions. 


This instruction is specifically intended for use in fixing up the results of arithmetic calculations involving one source 
so that they match the spec, although it is generally useful for fixing up the results of multiple-instruction 
sequences to reflect special-number inputs. For example, consider rcp(0). Input 0 to rcp, and you should get INF 
according to the DX10 spec. However, evaluating rcp via Newton-Raphson, where x=approx(1/0), yields an incor- 
rect result. To deal with this, VFIXUPIMMPS can be used after the N-R reciprocal sequence to set the result to the 
correct value (i.e. INF when the input is 0). 


If MXCSR.DAZ is not set, denormal input elements in the first source operand are considered as normal inputs and 
do not trigger any fixup nor fault reporting. 


Imm8 is used to set the required flags reporting. It supports #ZE and #IE fault reporting (see details below). 
MXCSR.DAZ is used and refer to zmm2 only (i.e. zmm1 is not considered as zero in case MXCSR.DAZ is set). 


MXCSR mask bits are ignored and are treated as if all mask bits are set to masked response). If any of the imm8& 
bits is set and the condition met for fault reporting, MXCSR.IE or MXCSR.ZE might be updated. 
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Operation 


enum TOKEN_TYPE 

{ 
QNAN_TOKEN := 0, 
SNAN_TOKEN := 1, 
ZERO_VALUE_TOKEN := 2, 
POS_ONE_VALUE_TOKEN := 3, 
NEG_INF_TOKEN := 4, 
POS_INF_TOKEN := 5, 
NEG_VALUE_TOKEN := 6, 
POS_VALUE_TOKEN := 7 

} 


FIXUPIMM_SP ( dest[31:0], src1[31:0],tbI3[3 1:0], imms [7:0])f{ 
tsrc[31:0] := ((src1[30:23] = 0) AND (MXCSR.DAZ =1)) ? 0.0 : src1[31:0] 
CASE(tsrc[31:0] of TOKEN_TYPE) { 
QNAN_TOKEN: j := 0; 
SNAN_TOKEN: j := 1; 
ZERO_VALUE_TOKEN: j := 2; 
POS_ONE_VALUE_TOKEN: j := 3; 
NEG_INF_TOKEN: j := 4; 
POS_INF_TOKEN: j := 5; 
NEG_VALUE_TOKEN: j := 6; 
POS_VALUE_TOKEN: j := 7; 

} ; end source special CASE(tsrc...) 


; The required response from src3 table is extracted 
token_response[3:0] = tbl3[3+4*j:4*j]; 


CASE(token_response[3:0)) { 
0000: dest[31:0] := dest[31:0]; ; preserve content of DEST 
0001: dest[31:0] := tsrc[31:0]; ; pass through src1 normal input value, denormal as zero 
0010: dest[31:0] := QNaN(tsrc[3 1:0); 
0011: dest[31:0] := QNAN_Indefinite; 
0100: dest[31:0] := -INF; 
0101: dest[31:0] := +INF; 
0110: dest[31:0] := tsrc.sign? -INF : +INF; 
0111: dest[31:0] := -0; 
1000: dest[31:0] := +0; 
1001: dest[31:0] := -1; 
1010: dest[31:0] := +1; 
1011: dest[31:0] := % 
1100: dest[31:0] := 90.0; 
1101: dest[31:0] := Pl/2; 
1110: dest[31:0] := MAX_FLOAT; 
1111: dest[3 1:0] := -MAX_FLOAT; 
} ; end of token_response CASE 
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; The required fault reporting from immé8 is extracted 
; TOKENs are mutually exclusive and TOKENs priority defines the order. 
; Multiple faults related to a single token can occur simultaneously. 
IF (tsrc[31:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[0] then set #ZE; 
IF (tsrc[31:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[1] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[2] then set #ZE; 
IF (tsrc[31:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[3] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: SNAN_TOKEN) AND imm8[4] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: NEG_INF_TOKEN) AND imm8[5] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: NEG_VALUE_TOKEN) AND imm8[6] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: POS_INF_TOKEN) AND imm8[7] then set #IE; 
; end fault reporting 

return dest[3 1:0]; 

} ; end of FIXUPIMM_SP() 


VFIXUPIMMPS (EVEX) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+31:i] := FIXUPIMM_SP(DEST[i+31:i], SRC1[i+3 1:1], SRC2[31:0], imm8 [7:0]) 
ELSE 
DEST[i+31:i] := FIXUPIMM_SP(DEST[i+3 1:1], SRC1[i+31:i], SRC2[i+31:i], imm8 [7:0]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ; zeroing-masking 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Immediate Control Description: 


+ INF > #1IE 
= VED #1IE 


SNaN > #1IE 


- INF > #1IE 


ONE > #1E 


ONE > #ZE 


ZERO > eT Ey 


ZERO > #ZE 


7] 6] 5 4) 3] 2] 1] 0 


Figure 5-10. VFIXUPIMMPS Immediate Control Description 


Intel C/C++ Compiler Intrinsic Equivalent 


VFIXUPIMMPS 


m512 


mm512_fixupimm_ps(__m512 a,__m512i tbl, int imm); 


VFIXUPIMMPS 


m512 


mm512_mask_fixupimm_ps(__m512 s, 


VFIXUPIMMPS 


m512 


mmask16 k,__m512 a,__m512i tbl, int imm); 


VFIXUPIMMPS 


m512 


mm512_maskz_fixupimm_ps( 


mmask16 k,__m512 a,__m512i tbl, int imm); 


mm512_fixupimm_round_ps(__m512 a,__m512i tbl, int imm, int sae); 


VFIXUPIMMPS 


m512 


mm512_mask_fixupimm_round_ps(__m512 s,__mmask16 k,__m512 a,__m512i tbl, int imm, int sae); 


VFIXUPIMMPS 


m512 


mm512_maskz_fixupimm_round_ps(_mmask16 k, 


m512 a,__m512i tbl, int imm, int sae); 


VFIXUPIMMPS 


m256 


mm256_fixupimm_ps(__m256 a, 


VFIXUPIMMPS 


m256 


m256 b,___m256i c, int imm8); 


mm256_mask_fixupimm_ps(__m256 a,___ mmask8 k,__m256 b,___ m256i, int imm8); 


VFIXUPIMMPS 


m256 


mm256_maskz_fixupimm_ps( 


mmask8 k,__m256 a,__m256b, _ m256i c, int imm8); 


VFIXUPIMMPS 


_mi128 


_mm_fixupimm_ps(__m128 a,__m128 b, 128i, int imms); 


VFIXUPIMMPS __m128 _mm_mask_fixupimm_ps(__m128 a, ___mmask8 k,__m128 b,___m128i_c, int imm8); 


VFIXUPIMMPS __m128 __mm_maskz_fixupimm_ps(__mmask8 k, 


SIMD Floating-Point Exceptions 


Zero, Invalid 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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VFIXUPIMMSD—Fix Up Special Scalar Float64 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.LLIG.66.0F3A.W1 55 /r ib A VIV AVX512F Fix up a float64 number in the low quadword element of 
VFIXUPIMMSD xmm1 {k1}{Z}, xmm_2 using scalar int32 table in xmm3/m64 and store the 
xmm2, xmm3/m64{sae}, imm8 result in xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Perform a fix-up of the low quadword element encoded in double-precision floating-point format in the first source 
operand (the second operand) using a 32-bit, two-level look-up table specified in the low quadword element of the 
second source operand (the third operand) with exception reporting specifier imm8. The element that is fixed-up 
is selected by mask bit of 1 specified in the opmask ki. Mask bit of 0 in the opmask ki or table response action of 
0000b preserves the corresponding element of the first operand. The fixed-up element from the first source 
operand or the preserved element in the first operand becomes the low quadword element of the destination 
operand (the first operand). Bits 127:64 of the destination operand is copied from the corresponding bits of the 
first source operand. The destination and first source operands are XMM registers. The second source operand can 
be a XMM register or a 64- bit memory location. 

The two-level look-up table perform a fix-up of each DP FP input data in the first source operand by decoding the 
input data encoding into 8 token types. A response table is defined for each token type that converts the input 
encoding in the first source operand with one of 16 response actions. 

This instruction is specifically intended for use in fixing up the results of arithmetic calculations involving one source 
so that they match the spec, although it is generally useful for fixing up the results of multiple-instruction 
sequences to reflect special-number inputs. For example, consider rcp(0). Input 0 to rcp, and you should get INF 
according to the DX10 spec. However, evaluating rcp via Newton-Raphson, where x=approx(1/0), yields an incor- 
rect result. To deal with this, VFIXUPIMMPD can be used after the N-R reciprocal sequence to set the result to the 
correct value (i.e. INF when the input is 0). 

If MXCSR.DAZ is not set, denormal input elements in the first source operand are considered as normal inputs and 
do not trigger any fixup nor fault reporting. 


Imm8 is used to set the required flags reporting. It supports #ZE and #IE fault reporting (see details below). 
MXCSR.DAZ is used and refer to zmm2 only (i.e. zmm1 is not considered as zero in case MXCSR.DAZ is set). 


MXCSR mask bits are ignored and are treated as if all mask bits are set to masked response). If any of the imm8& 
bits is set and the condition met for fault reporting, MXCSR.IE or MXCSR.ZE might be updated. 


Operation 

enum TOKEN_TYPE 

{ 
QNAN_TOKEN := 0, 
SNAN_TOKEN := 1, 
ZERO_VALUE_TOKEN := 2, 
POS_ONE_VALUE_TOKEN := 3, 
NEG_INF_TOKEN := 4, 
POS_INF_TOKEN := 5, 
NEG_VALUE_TOKEN := 6, 
POS_VALUE_TOKEN := 7 
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FIXUPIMM_DP (dest[63:0], src1[63:0],tbl3[63:0], imm8 [7:0]){ 
tsrc[63:0] := ((src1 [62:52] = 0) AND (MXCSR.DAZ =1)) ? 0.0 : src1[63:0] 
CASE(tsrc[63:0] of TOKEN_TYPE) { 
QNAN_TOKEN: j := 0; 
SNAN_TOKEN: j := 1; 
ZERO_VALUE_TOKEN: j := 2; 
POS_ONE_VALUE_TOKEN: j := 3; 
NEG_INF_TOKEN: j := 4; 
POS_INF_TOKEN: j := 5; 
NEG_VALUE_TOKEN: j := 6; 
POS_VALUE_TOKEN: j := 7; 

} ; end source special CASE(tsrc...) 


; The required response from src3 table is extracted 
token_response[3:0] = tbl3[3+4*j:4*j]; 


CASE(token_response[3:0)) { 
0000: dest[63:0] := dest[63:0] ; preserve content of DEST 
0001: dest[63:0] := tsrc[63:0); ; pass through src1 normal input value, denormal as zero 
0010: dest[63:0] := QNaN(tsrc[63:0)); 
0011: dest[63:0] := QNAN_Indefinite; 
0100:dest[63:0] := -INF; 
0101: dest[63:0] := +INF; 
0110: dest[63:0] := tsrc.sign? -INF : +INF; 
0111: dest[63:0] := -0; 
1000: dest[63:0] := +0; 
1001: dest[63:0] := -1; 
1010: dest[63:0] := +1; 
1011: dest[63:0] := %; 
1100: dest[63:0] := 90.0; 
1101: dest[63:0] := Pl/2; 
1110: dest[63:0] := MAX_FLOAT; 
1111: dest[63:0] := -MAX_FLOAT; 
} ; end of token_response CASE 


; The required fault reporting from imm8 is extracted 
; TOKENs are mutually exclusive and TOKENs priority defines the order. 
; Multiple faults related to a single token can occur simultaneously. 
IF (tsrc[63:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[0] then set #ZE; 
IF (tsrc[63:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[1] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[2] then set #ZE; 
IF (tsrc[63:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8{[3] then set #lE; 
IF (tsrc[63:0] of TOKEN_TYPE: SNAN_TOKEN) AND imm8[4] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: NEG_INF_TOKEN) AND imm8[5] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: NEG_VALUE_TOKEN) AND imm8[6] then set #IE; 
IF (tsrc[63:0] of TOKEN_TYPE: POS_INF_TOKEN) AND imm8[7] then set #IE; 
; end fault reporting 

return dest[63:0]; 

} ; end of FIXUPIMM_DP() 
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VFIXUPIMMSD (EVEX encoded version) 
IF k1[0] OR *no writemask* 
THEN DEST[63:0] := FIXUPIMM_DP(DEST[63:0], SRC1[63:0], SRC2[63:0], imm8 [7:0]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE DEST[63:0] := 0 ; zeroing-masking 
Fl 
Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Immediate Control Description: 


+INF> #IE 
- VE > #IE 
- INF> #IE 
SNaN> #IE 
ONE > #IE 
ONE > #2ZE 
ZERO > #18 
ZEROD #2ZE 


Figure 5-11. VFIXUPIMMSD Immediate Control Description 


Intel C/C++ Compiler Intrinsic Equivalent 


VFIXUPIMMSD __m128d _mm_fixupimm_sd(__m128d a, __m128i tbl, int imm); 

VFIXUPIMMSD __m128d __mm_mask_fixupimm_sd(__m128d s,__ mmask8 k,__m128d a, ___m128i tbl, int imm); 
VFIXUPIMMSD __m128d __mm_maskz_fixupimm_sd(__mmask8 k,__m128d a, __m128i tbl, int imm); 

VFIXUPIMMSD __m128d __mm_fixupimm_round_sd(__m128d a, __m128i tbl, int imm, int sae); 

VFIXUPIMMSD __m128d __mm_mask_fixupimm_round_sd(__m128d s,__mmask8 k,__m128d a, __m128i tbl, int imm, int sae); 
VFIXUPIMMSD __m128d __mm_maskz_fixupimm_round_sd(__mmask8 k,__m128d a, ___m128i tbl, int imm, int sae); 


SIMD Floating-Point Exceptions 


Zero, Invalid 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VFIXUPIMMSS—Fix Up Special Scalar Float32 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.LLIG.66.0F3A.WO 55 /r ib A VIV AVX512F | Fix upa float32 number in the low doubleword element 
VFIXUPIMMSS xmm1 {k1}{z}, xmm2, in xmm_z using scalar int32 table in xmm3/m32 and store 
xmm3/m32{sae}, imm8 the result in xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) Imms 
Description 


Perform a fix-up of the low doubleword element encoded in single-precision floating-point format in the first source 
operand (the second operand) using a 32-bit, two-level look-up table specified in the low doubleword element of 
the second source operand (the third operand) with exception reporting specifier imm8. The element that is fixed- 
up is selected by mask bit of 1 specified in the opmask k1. Mask bit of 0 in the opmask ki or table response action 
of 0000b preserves the corresponding element of the first operand. The fixed-up element from the first source 
operand or the preserved element in the first operand becomes the low doubleword element of the destination 
operand (the first operand) Bits 127:32 of the destination operand is copied from the corresponding bits of the first 
source operand. The destination and first source operands are XMM registers. The second source operand can be a 
XMM register or a 32-bit memory location. 

The two-level look-up table perform a fix-up of each SP FP input data in the first source operand by decoding the 
input data encoding into 8 token types. A response table is defined for each token type that converts the input 
encoding in the first source operand with one of 16 response actions. 

This instruction is specifically intended for use in fixing up the results of arithmetic calculations involving one source 
so that they match the spec, although it is generally useful for fixing up the results of multiple-instruction 
sequences to reflect special-number inputs. For example, consider rcp(0). Input 0 to rcp, and you should get INF 
according to the DX10 spec. However, evaluating rcp via Newton-Raphson, where x=approx(1/0), yields an incor- 
rect result. To deal with this, VFIXUPIMMPD can be used after the N-R reciprocal sequence to set the result to the 
correct value (i.e. INF when the input is 0). 

If MXCSR.DAZ is not set, denormal input elements in the first source operand are considered as normal inputs and 
do not trigger any fixup nor fault reporting. 


Imm8 is used to set the required flags reporting. It supports #ZE and #IE fault reporting (see details below). 
MXCSR.DAZ is used and refer to zmm2 only (i.e. zmm1 is not considered as zero in case MXCSR.DAZ is set). 


MXCSR mask bits are ignored and are treated as if all mask bits are set to masked response). If any of the imm8 
bits is set and the condition met for fault reporting, MXCSR.IE or MXCSR.ZE might be updated. 


Operation 

enum TOKEN_TYPE 

{ 
QNAN_TOKEN := 0, 
SNAN_TOKEN := 1, 
ZERO_VALUE_TOKEN := 2, 
POS_ONE_VALUE_TOKEN := 3, 
NEG_INF_TOKEN := 4, 
POS_INF_TOKEN := 5, 
NEG_VALUE_TOKEN := 6, 
POS_VALUE_TOKEN := 7 
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FIXUPIMM_SP (dest[3 1:0], src1[31:0],tbI3[31:0], imm8 [7:0])f{ 
tsrc[31:0] := ((src1[30:23] = 0) AND (MXCSR.DAZ =1)) ? 0.0 : src1[31:0] 
CASE(tsrc[63:0] of TOKEN_TYPE) { 
QNAN_TOKEN: j := 0; 
SNAN_TOKEN: j := 1; 
ZERO_VALUE_TOKEN: j := 2; 
POS_ONE_VALUE_TOKEN: j := 3; 
NEG_INF_TOKEN: j := 4; 
POS_INF_TOKEN: j := 5; 
NEG_VALUE_TOKEN: j := 6; 
POS_VALUE_TOKEN: j := 7; 

} ; end source special CASE(tsrc...) 


; The required response from src3 table is extracted 
token_response[3:0] = tbl3[3+4*j:4*j]; 


CASE(token_response[3:0)) { 
0000: dest[31:0] := dest[31:0]; ; preserve content of DEST 
0001: dest[31:0] := tsrc[31:0]; ; pass through src1 normal input value, denormal as zero 
0010: dest[31:0] := QNaN(tsrc[3 1:0); 
0011: dest[31:0] := QNAN_Indefinite; 
0100: dest[31:0] := -INF; 
0101: dest[31:0] := +INF; 
0110: dest[31:0] := tsrc.sign? -INF : +INF; 
0111: dest[31:0] := -0; 
1000: dest[31:0] := +0; 
1001: dest[31:0] := -1; 
1010: dest[31:0] := +1; 
1011: dest[31:0] := % 
1100: dest[31:0] := 90.0; 
1101: dest[31:0] := Pl/2; 
1110: dest[31:0] := MAX_FLOAT; 
1111: dest[31:0] := -MAX_FLOAT; 
} ; end of token_response CASE 


; The required fault reporting from immé8 is extracted 
; TOKENs are mutually exclusive and TOKENs priority defines the order. 
; Multiple faults related to a single token can occur simultaneously. 
IF (tsrc[31:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[0] then set #ZE; 
IF (tsrc[31:0] of TOKEN_TYPE: ZERO_VALUE_TOKEN) AND imm8[1] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[2] then set #ZE; 
IF (tsrc[31:0] of TOKEN_TYPE: ONE_VALUE_TOKEN) AND imm8[3] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: SNAN_TOKEN) AND imm8[4] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: NEG_INF_TOKEN) AND imm8[5] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: NEG_VALUE_TOKEN) AND imm8[6] then set #IE; 
IF (tsrc[31:0] of TOKEN_TYPE: POS_INF_TOKEN) AND imm8[7] then set #IE; 
; end fault reporting 

return dest[3 1:0]; 

} ; end of FIXUPIMM_SP() 
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VFIXUPIMMSS (EVEX encoded version) 
IF k1[0] OR *no writemask* 


THEN DEST[31:0] := FIXUPIMM_SP(DEST[31:0], SRC1[31:0], SRC2[31:0], imm8 [7:0]) 


ELSE 
IF *merging-masking* 


THEN *DEST[31:0] remains unchanged* 


ELSE DEST[31:0] := 0 
Fl 
Fl; 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Immediate Control Description: 


; merging-masking 


; zeroing-masking 


+ INF > 
- VE > 
- INF > 
SNaN > 
ONE > 
ONE > 
ZERO > 
ZERO > 


#1E 
#1E 
#1IE 
#1IE 
#1E 
#ZE 
#1E 
#ZE 


Figure 5-12. VFIXUPIMMSS Immediate Control Description 


Intel C/C++ Compiler Intrinsic Equivalent 


VFIXUPIMMSS __m128 _mm_fixupimm_ss(__m128 a, 


m1 28i tbl, int imm); 


VFIXUPIMMSS __m128 _mm_mask_fixupimm_ss(__m128 s,__ mmask8 k,__m128 a, __m128i tbl, int imm); 


VFIXUPIMMSS __m128 __mm_maskz_fixupimm_ss( __mmask8 k, 


m128 a, __m128i tbl, int imm); 


VFIXUPIMMSS __m128 _mm_fixupimm_round_ss(__m128 a, __m128i tbl, int imm, int sae); 


VFIXUPIMMSS __m128 _mm_mask_fixupimm_round_ss(__m128 s, 
VFIXUPIMMSS __m128 _mm_maskz_fixupimm_round_ss(__mmask8 k, 


SIMD Floating-Point Exceptions 


Zero, Invalid 


Other Exceptions 


mmask8 k,__m128 a,__m128i tbl, int imm, int sae); 
m128 a,__m128i tbl, int imm, int sae); 


See Table 2-47, “Type E3 Class Exception Conditions”. 


5-124 Vol. 2C 


VFIXUPIMMSS—Fix Up Special Scalar Float32 Value 


INSTRUCTION SET REFERENCE, V-Z 


VFMADD132PD/VFMADD213PD/VFMADD231PD—Fused Multiply-Add of Packed Double- 
Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
VEX.128.66.0F38.W1 98 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD132PD xmm1, xmme2, values from xmm1 and xmm3/mem, add to xmm2 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W1 A8 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD213PD xmm1, xmm2, values from xmm1 and xmme2, add to xmm3/mem 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W1 B8 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD231PD xmm1, xmme2, values from xmm2 and xmm3/mem, add to xmm1 
xmm3/m128 and put result in xmm1. 
VEX.256.66.0F38.W1 98 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD132PD ymm1, ymm2, values from ymm1 and ymm3/mem, add to ymm2 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W1 A8 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD213PD ymm1, ymm2, values from ymm1 and ymm2, add to ymm3/mem 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W1 B8 /r A VIV FMA Multiply packed double-precision floating-point 
VFMADD231PD ymm1, ymm2, values from ymm2 and ymm3/mem, add to ymm1 
ymm3/m256 and put result in ymm1. 
EVEX.128.66.0F38.W1 98 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD132PD xmm1 {k1}{z}, xmm2, AVX512F values from xmm1 and xmm3/m128/m64bcst, add 
xmm3/m128/m64bcst to xmm2 and put result in xmm1. 
EVEX.128.66.0F38.W1 A8 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD213PD xmm1 {k1}{z}, xmm2, AVX512F values from xmm1 and xmm2, add to 
xmm3/m128/m64bcst xmm3/m128/m64bcst and put result in xmm1. 
EVEX.128.66.0F38.W1 B8 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD231PD xmm1 {k1}{z}, xmm_2, AVX512F values from xmm2 and xmm3/m128/m64bcst, add 
xmm3/m128/m64bcst to xmm1 and put result in xmm1. 
EVEX.256.66.0F38.W1 98 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD132PD ymm1 {k1}{z}, ymm2, AVX512F values from ymm1 and ymm3/m256/m64bcst, add 
ymm3/m256/m64bcst to ymm2 and put result in ymm1. 
EVEX.256.66.0F38.W1 A8 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD213PD ymm1 {k1}{z}, ymm2, AVX512F values from ymm1 and ymm2, add to 
ymm3/m256/m64bcst ymm3/m256/m64bcst and put result in ymm1. 
EVEX.256.66.0F38.W1 B8 /r B VIV AVX512VL | Multiply packed double-precision floating-point 
VFMADD231PD ymm1 {k1}{z}, ymm2, AVX512F values from ymm2 and ymm3/m256/m64bcst, add 
ymm3/m256/m64bcst to ymm1 and put result in ymm1. 
EVEX.512.66.0F38.W1 98 /r B VIV AVX512F Multiply packed double-precision floating-point 
VFMADD132PD zmm1 {k1}{z}, zmm2, values from zmm1 and zmm3/m512/m64bcst, add 
zmm3/m512/m64bcst{er} to zmm2 and put result in zmm1. 
EVEX.512.66.0F38.W1 A8 /r B VIV AVX512F Multiply packed double-precision floating-point 
VFMADD213PD zmm1 {k1}{z}, zmm2, values from zmm1 and zmm2, add to 
zmm3/m512/m64bcst{er} zmm3/m512/m64bcst and put result in zmm1. 
EVEX.512.66.0F38.W1 B8 /r B VIV AVX512F Multiply packed double-precision floating-point 
VFMADD231PD zmm1 {k1}{z}, zmm2, values from zmm2 and zmm3/m512/m64bcst, add 
zmm3/m512/m64bcst{er} to zmm1 and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a set of SIMD multiply-add computation on packed double-precision floating-point values using three 
source operands and writes the multiply-add results in the destination operand. The destination operand is also the 
first source operand. The second operand must be a SIMD register. The third source operand can be a SIMD 
register or a memory location. 


VFMADD132PD: Multiplies the two, four or eight packed double-precision floating-point values from the first source 
operand to the two, four or eight packed double-precision floating-point values in the third source operand, adds 

the infinite precision intermediate result to the two, four or eight packed double-precision floating-point values in 
the second source operand, performs rounding and stores the resulting two, four or eight packed double-precision 
floating-point values to the destination operand (first source operand). 


VFMADD213PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source operand to the two, four or eight packed double-precision floating-point values in the first source operand, 
adds the infinite precision intermediate result to the two, four or eight packed double-precision floating-point 
values in the third source operand, performs rounding and stores the resulting two, four or eight packed double- 
precision floating-point values to the destination operand (first source operand). 


VFMADD231PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source to the two, four or eight packed double-precision floating-point values in the third source operand, adds the 
infinite precision intermediate result to the two, four or eight packed double-precision floating-point values in the 
first source operand, performs rounding and stores the resulting two, four or eight packed double-precision 
floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) is a ZMM register and encoded in 
reg_field. The second source operand is a ZMM register and encoded in EVEX.vvvv. The third source operand is a 
ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 64-bit memory location. The 
destination operand is conditionally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 
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Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 


rounding). 


VFMADD132PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%i; 
DEST[n+63:n] := RoundFPControl_MXCSR(DEST[n+63:n]*SRC3[n+63:n] + SRC2[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADD213PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(SRC2[n+63:n]*DEST[n+63:n] + SRC3[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADD231PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(SRC2[n+63:n]*SRC3[n+63:n] + DEST[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFMADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] + SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[63:0]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] + DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDxxxPD __m512d_mm512_fmadd_pd(__m512da,__m512db,__m512d c); 

VFMADDxxxPD __m512d_mm512_fmadd_round_pd(__m512da,__m512db,__m512d, int r); 
VFMADDxxxPD __m512d_mm512_mask_fmadd_pd(__m512d a, ___mmask8 k,__m512db,_m512d c); 
VFMADDxxxPD __m512d_mm512_maskz_fmadd_pd(__mmask8 k,__m512da,__m512db,__m512dc); 
VFMADDxxxPD __m512d_mm512_mask3_fmadd_pd(__m512da,__m512db,__m512dc,__mmask8 k); 
VFMADDxxxPD __m512d_mm512_mask_fmadd_round_pd(__m512d a,__mmask8 k, 
VFMADDxxxPD __m512d_mm512_maskz_fmadd_round_pd(__mmask8 k,__m512da,__m512d b, 
VFMADDxxxPD __m512d_mm512_mask3_fmadd_round_pd(__m512da,__m512db,__m512dc, 
VFMADDxxxPD __m256d __mm256_mask_fmadd_pd(__m256d a, __mmask8 k,__m256d b, __m256d c); 
VFMADDxxxPD __m256d__mm256_maskz_fmadd_pd(__mmask8 k,__m256d a,__m256d b,__ m256d c); 
VFMADDxxxPD __m256d_mm256_mask3_fmadd_pd(__m256d a,__m256d b,__ m256dc,___ mmask8 k); 
VFMADDxxxPD __m128d _mm_mask_fmadd_pd(__m128d a,__mmask8 k,__m128db,__m128d c); 
VFMADDxxxPD __m128d _mm_maskz_fmadd_pd(__mmask8 k,___m128d a,__m128db,__m128d c); 
VFMADDxxxPD __m128d _mm_mask3_fmadd_pd(__m128d a,__m128d b,__m128d c,___mmask8 k); 
VFMADDxxxPD __m128d _mm_fmadd_pd (__m128d a,__m128db,__m128d c); 

VFMADDxxxPD __m256d_mm256_fmadd_pd (__m256d a,__m256d b,___m256d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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m512db,__m512dc, intr); 
m512dc, int r); 
mmask§8 k, int r); 
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VFMADD132PS/VFMADD213PS/VFMADD231PS—Fused Multiply-Add of Packed Single- 


Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.128.66.0F38.WO 98 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD132PS xmm1, xmm2, from xmm1 and xmm3/mem, add to xmm2 and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.W0O A8 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD213PS xmm1, xmm2, from xmm1 and xmmz, add to xmm3/mem and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.WO B8 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD231PS xmm1, xmme2, from xmm2 and xmm3/mem, add to xmm1 and put 
xmm3/m128 result in xmm1. 
VEX.256.66.0F38.WO 98 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD132PS ymm1, ymm2, from ymm1 and ymm3/mem, add to ymm2 and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.W0O A8 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD213PS ymm1, ymm2, from ymm1 and ymm2, add to ymm3/mem and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.0 B8 /r A VV FMA Multiply packed single-precision floating-point values 
VFMADD231PS ymm1, ymm2, from ymm2 and ymm3/mem, add to ymm1 and put 
ymm3/m256 result in ymm1. 
EVEX.128.66.0F38.W0 98 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD132PS xmm1 {k1}{z}, xmm2, AVX512F from xmm1 and xmm3/m128/m32bcst, add to 
xmm3/m1 28/m32bcst xmm_2 and put result in xmm1. 
EVEX.128.66.0F38.W0 A8 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD213PS xmm1 {k1}{z}, xmm2, AVX512F from xmm1 and xmm2, add to 
xmm3/m1 28/m32bcst xmm3/m128/m32bcst and put result in xmm1. 
EVEX.128.66.0F38.W0 B8 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD231PS xmm1 {k1}{z}, xmm2, AVX512F from xmm_2 and xmm3/m128/m32bcst, add to 
xmm3/m1 28/m32bcst xmm1 and put result in xmm1. 
EVEX.256.66.0F38.W0 98 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD132PS ymm1 {k1}{z}, ymm2, AVX512F from ymm1 and ymm3/m256/m32bcst, add to 
ymm3/m256/m32bcst ymm_2 and put result in ymm1. 
EVEX.256.66.0F38.W0 A8 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD213PS ymm1 {k1}{z}, ymm2, AVX512F from ymm1 and ymm2, add to 
ymm3/m256/m32bcst ymm3/m256/m32bcst and put result in ymm1. 
EVEX.256.66.0F38.W0 B8 /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMADD231PS ymm1 {k1}{z}, ymm2, AVX512F from ymm2 and ymm3/m256/m32bcst, add to 
ymm3/m256/m32bcst ymm1 and put result in ymm1. 
EVEX.512.66.0F38.W0 98 /r B VIV AVX512F Multiply packed single-precision floating-point values 
VFMADD132PS zmm1 {k1}{z}, zmm2, from zmm1 and zmm3/m512/m32bcst, add to 
zmm3/m51 2/m32bcst{er} zmmez and put result in zmm1. 
EVEX.512.66.0F38.W0 A8 /r B VIV AVX512F Multiply packed single-precision floating-point values 
VFMADD213PS zmm1 {k1}{z}, zmm2, from zmm1 and zmm2, add to 
zmm3/m51 2/m32bcst{er} zmm3/m512/m32bcst and put result in zmm1. 
EVEX.512.66.0F38.W0 B8 /r B VIV AVX512F Multiply packed single-precision floating-point values 


VFMADD231PS zmm1 {k1}{z}, zmm2, 
zmm3/m512/m32bcst{er} 


from zmm2 and zmm3/m512/m32bcst, add to 
zmm1 and put result in zmm1. 
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INSTRUCTION SET REFERENCE, V-Z 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a set of SIMD multiply-add computation on packed single-precision floating-point values using three 
source operands and writes the multiply-add results in the destination operand. The destination operand is also the 
first source operand. The second operand must be a SIMD register. The third source operand can be a SIMD 
register or a memory location. 


VFMADD132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand, adds the infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the second source operand, performs rounding and stores the resulting four, eight or 
sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFMADD213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the first source 
operand, adds the infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the third source operand, performs rounding and stores the resulting the four, eight or 
sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFMADD231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand, adds the infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the first source operand, performs rounding and stores the resulting four, eight or sixteen 
packed single-precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) is a ZMM register and encoded in 
reg_field. The second source operand is a ZMM register and encoded in EVEX.vvvv. The third source operand is a 
ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit memory location. The 
destination operand is conditionally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


VFMADD132PS/VFMADD2 1 3PS/VFMADD231PS—Fused Multiply-Add of Packed Single-Precision Floating-Point Values Vol.2C 5-133 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFMADD132PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 4 
ELSEIF (VEX.256) 
MAXNUM := 8 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(DEST[n+31 :n]*SRC3[n+31:n] + SRC2[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADD213PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 4 
ELSEIF (VEX.256) 
MAXNUM := 8 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*DEST[n+31:n] + SRC3[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADD231PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 4 
ELSEIF (VEX.256) 
MAXNUM := 8 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*SRC3[n+31:n] + DEST[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFMADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(DEST[i+3 1 :i]*SRC3[i+31:i] + SRC2[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+3 1:i]*SRC3[3 1:0] + SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[i+3 1:1] + SRC2[i+3 1:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(SRC2[i+31:i]*DEST[i+31:i] + SRC3[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+31:i] + SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] + SRC3[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(SRC2[i+31:i]*SRC3[i+31:i] + DEST[i+31:i]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] + DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[i+3 1:i] + DEST[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDxxxPS __m512_mm512_fmadd_ps(__m512 a,__m512b,__m512 c); 

VFMADDxxxPS __m512_mm512_fmadd_round_ps(__m512 a,__m512b,__m512¢, int r); 

VFMADDxxxPS __m512 _mm512_mask_fmadd_ps(__m512 a,__mmask16 k,__m512b,__m512 c); 
VFMADDxxxPS __m512_mm512_maskz_fmadd_ps(__mmask16 k,__m512 a,__m512b,__m512 c); 
VFMADDxxxPS __m512_mm512_mask3_fmadd_ps(__m512 a,__m512b,__m512c,__mmask16 k); 
VFMADDxxxPS __m512_mm512_mask_fmadd_round_ps(__m512 a,__mmask16k,__m512b,__m512c, int r); 
VFMADDxxxPS __m512_mm512_maskz_fmadd_round_ps(__mmask16 k,__m512a,__m512b,__m512., intr); 
VFMADDxxxPS __m512_mm512_mask3_fmadd_round_ps(__m512 a,__m512b,__m512c,__mmask16 k, int r); 
VFMADDxxxPS __m256 _mm256_mask_fmadd_ps(__m256 a,__ mmask8 k,__m256 b,__m256 c); 
VFMADDxxxPS __m256 __mm256_maskz_fmadd_ps(__mmask8 k,__m256 a,__m256b,__m256 c); 
VFMADDxxxPS __m256 __mm256_mask3_fmadd_ps(__m256 a,__m256b,__m256 c,__ mmask8 k); 
VFMADDxxxPS __m128 _mm_mask_fmadd_ps(__m128 a,__ mmask8 k,__m128b,__m128 c); 

VFMADDxxxPS __m128_mm_maskz_fmadd_ps(__mmask8 k,__m128a,__m128b,__m128 c); 

VFMADDxxxPS __m128 _mm_mask3_fmadd_ps(__m128 a,__m128b,_m128c,__mmask8 k); 

VFMADDxxxPS __m128 _mm_fmadd_ps (_m128a,__m128b,__m128 c); 

VFMADDxxxPS __m256_mm256_fmadd_ps (_m256a,__m256b,__m256 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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VFMADD132SD/VFMADD213SD/VFMADD231SD—Fused Multiply-Add of Scalar Double- 
Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.LIG.66.0F38.W1 99 /r A VV FMA Multiply scalar double-precision floating-point value 
VFMADD132SD xmm1, xmm2, from xmm1 and xmm3/m64, add to xmm2 and put 
xmm3/m64 result in xmm1. 
VEX.LIG.66.0F38.W1 AQ /r A VIN FMA Multiply scalar double-precision floating-point value 
VFMADD213SD xmm1, xmm2, from xmm1 and xmm2, add to xmm3/m64 and put 
xmm3/m64 result in xmm1. 
VEX.LIG.66.0F38.W1 B9 /r A VV FMA Multiply scalar double-precision floating-point value 
VFMADD231SD xmm1, xmm2, from xmm_2 and xmm3/m64, add to xmm1 and put 
xmm3/m64 result in xmm1. 
EVEX.LLIG.66.0F38.W1 99 /r B VIV AVX512F Multiply scalar double-precision floating-point value 
VFMADD132SD xmm1 {k1}{z}, xmm2z, from xmm1 and xmm3/m64, add to xmm2 and put 
xmm3/m64{er} result in xmm1. 
EVEX.LLIG.66.0F38.W1 A9 /r B VIV AVX512F Multiply scalar double-precision floating-point value 
VFMADD213SD xmm1 {k1}{z}, xmm2z, from xmm1 and xmm2, add to xmm3/m64 and put 
xmm3/m64{er} result in xmm1. 
EVEX.LLIG.66.0F38.W1 B9 /r B VIV AVX512F Multiply scalar double-precision floating-point value 
VFMADD231SD xmm1 {k1}{z}, xmm2z, from xmm2 and xmm3/m64, add to xmm1 and put 
xmm3/m64{er} result in xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD multiply-add computation on the low double-precision floating-point values using three source 
operands and writes the multiply-add result in the destination operand. The destination operand is also the first 
source operand. The first and second operand are XMM registers. The third source operand can be an XMM register 
or a 64-bit memory location. 


VFMADD132SD: Multiplies the low double-precision floating-point value from the first source operand to the low 
double-precision floating-point value in the third source operand, adds the infinite precision intermediate result to 
the low double-precision floating-point values in the second source operand, performs rounding and stores the 
resulting double-precision floating-point value to the destination operand (first source operand). 


VFMADD213SD: Multiplies the low double-precision floating-point value from the second source operand to the low 
double-precision floating-point value in the first source operand, adds the infinite precision intermediate result to 
the low double-precision floating-point value in the third source operand, performs rounding and stores the 
resulting double-precision floating-point value to the destination operand (first source operand). 


VFMADD231SD: Multiplies the low double-precision floating-point value from the second source to the low double- 
precision floating-point value in the third source operand, adds the infinite precision intermediate result to the low 
double-precision floating-point value in the first source operand, performs rounding and stores the resulting 
double-precision floating-point value to the destination operand (first source operand). 


VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:64 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 


EVEX encoded version: The low quadword element of the destination is updated according to the writemask. 
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Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFMADD132SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(DEST[63:0]*SRC3[63:0] + SRC2[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFMADD213SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(SRC2[63:0]*DEST[63:0] + SRC3[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 
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VFMADD231SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(SRC2[63:0]*SRC3[63:0] + DEST[63:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFMADD132SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := MAXVL-1:128RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] + SRC2[63:0]) 
DEST[127:63] := DEST[127:63] 

DEST[MAXVL-1:128] = 0 


VFMADD213SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] + SRC3[63:0]) 
DEST[127:63] := DEST[127:63] 

DEST[MAXVL-1:128] := 0 


VFMADD231SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] + DEST[63:0]) 
DEST[127:63] := DEST[127:63] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDxxxSD __m128d_mm_fmadd_round_sd(__m128d a,__m128db,__m128d.c, int r); 

VFMADDxxxSD __m128d_mm_mask_fmadd_sd(__m128d a,__ mmask8 k,_m128d b,___m128d c); 
VFMADDxxxSD __m128d __mm_maskz_fmadd_sd(__mmask8 k,___m128d a,__m128db, ___m128d c); 
VFMADDxxxSD __m128d _mm_mask3_fmadd_sd(__m128d a,__m128db,__m128dc,___ mmask8 k); 
VFMADDxxxSD __m128d __mm_mask_fmadd_round_sd(__m128d a, ___mmask8 k,__m128db,__m128d, int r); 
VFMADDxxxSD __m128d __mm_maskz_fmadd_round_sd(__mmask8 k,__m128da,__m128db,__m128dc, int r); 
VFMADDxxxSD __m128d __mm_mask3_fmadd_round_sd(__m128d a,__m128db,__m128dc,__mmask8 k, int r); 
VFMADDxxxSD __m128d_mm_fmadd_sd (__m128d a,__m128db,___m128d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFMADD132SS/VFMADD213SS/VFMADD231SS—Fused Multiply-Add of Scalar Single-Precision 
Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
VEX.LIG.66.0F38.W0 99 /r A VIV FMA Multiply scalar single-precision floating-point value 
VFMADD132SS xmm1, xmm2, from xmm1 and xmm3/m32, add to xmm_2 and put 
xmm3/m32 result in xmm1. 
VEX.LIG.66.0F38.W0 AQ /r A VIV FMA Multiply scalar single-precision floating-point value 
VFMADD213SS xmm1, xmm2, from xmm1 and xmm2, add to xmm3/m32 and put 
xmm3/m32 result in xmm1. 
VEX.LIG.66.0F38.W0 B9 /r A VIV FMA Multiply scalar single-precision floating-point value 
VFMADD231SS xmm1, xmm2, from xmm_2 and xmm3/m32, add to xmm1 and put 
xmm3/m32 result in xmm1. 
EVEX.LLIG.66.0F38.W0 99 /r B VIV AVX512F Multiply scalar single-precision floating-point value 
VFMADD132SS xmm1 {k1}{z}, xmm2, from xmm1 and xmm3/m32, add to xmm_2 and put 
xmm3/m32{er} result in xmm1. 
EVEX.LLIG.66.0F38.W0 AQ /r B VIV AVX512F Multiply scalar single-precision floating-point value 
VFMADD213SS xmm1 {k1}{z}, xmm2, from xmm1 and xmm2, add to xmm3/m32 and put 
xmm3/m32{er} result in xmm1. 
EVEX.LLIG.66.0F38.W0 B9 /r B VIV AVX512F Multiply scalar single-precision floating-point value 
VFMADD231SS xmm1 {k1}{z}, xmm2, from xmm2 and xmm3/m32, add to xmm1 and put 
xmm3/m32{er} result in xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD multiply-add computation on single-precision floating-point values using three source operands 
and writes the multiply-add results in the destination operand. The destination operand is also the first source 
operand. The first and second operands are XMM registers. The third source operand can be a XMM register or a 32- 
bit memory location. 


VFMADD132SS: Multiplies the low single-precision floating-point value from the first source operand to the low 
single-precision floating-point value in the third source operand, adds the infinite precision intermediate result to 
the low single-precision floating-point value in the second source operand, performs rounding and stores the 
resulting single-precision floating-point value to the destination operand (first source operand). 


VFMADD213SS: Multiplies the low single-precision floating-point value from the second source operand to the low 
single-precision floating-point value in the first source operand, adds the infinite precision intermediate result to 
the low single-precision floating-point value in the third source operand, performs rounding and stores the 
resulting single-precision floating-point value to the destination operand (first source operand). 


VFMADD231SS: Multiplies the low single-precision floating-point value from the second source operand to the low 
single-precision floating-point value in the third source operand, adds the infinite precision intermediate result to 
the low single-precision floating-point value in the first source operand, performs rounding and stores the resulting 
single-precision floating-point value to the destination operand (first source operand). 


VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:32 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low doubleword element of the destination is updated according to the writemask. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 


column. 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 


rounding). 


VFMADD132SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(DEST[31:0]*SRC3[31:0] + SRC2[31:0]) 
ELSE 


IF *merging-masking* ;Merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:1 28] := 0 


VFMADD213SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(SRC2[31:0]*DEST[31:0] + SRC3[31:0]) 
ELSE 


IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:1 28] := 0 
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VFMADD231SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(SRC2[31:0]*SRC3[31:0] + DEST[31:0]) 
ELSE 


IF *merging-masking* ; merging-masking 
THEN *DEST[31:0]] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := DEST[1 27:32] 
DEST[MAXVL-1:128] := 0 


VFMADD132SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(DEST[31:0]*SRC3[31:0] + SRC2[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFMADD213SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(SRC2[31:0]*DEST[31:0] + SRC3[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFMADD231SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(SRC2[31:0]*SRC3[31:0] + DEST[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDxxxSS __m128_mm_fmadd_round_ss(__m128 a,__m128b,__m128 c, int r); 
VFMADDxxxSS __m128_mm_mask_fmadd_ss(__m128 a,__mmask8 k,_m128b,__m128 c); 
VFMADDxxxSS __m128 _mm_maskz_fmadd_ss(__mmask8 k,__m128 a,__m128b,__m128 c); 
VFMADDxxxSS __m128_mm_mask3_fmadd_ss(__m128 a,__m128b,__m128c,__mmask8 k); 
VFMADDxxxSS __m128 __mm_mask_fmadd_round_ss(__m128 a, ___mmask8 k,__m128 b, 
VFMADDxxxSS __m128 _mm_maskz_fmadd_round_ss(__mmask8 k,__m128 a,__m128b, 
VFMADDxxxSS __m128_mm_mask3_fmadd_round_ss(__m128 a,__m128b,__m128c, 
VFMADDxxxSS __m128_mm_fmadd_ss (_m128a,__m128b,__m128 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 


m128 c, int r); 
m128 ¢, intr); 
mmask8 k, int r); 
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VFMADDSUB132PD/VFMADDSUB2 1 3PD/VFMADDSUB231PD—Fused Multiply-Alternating 
Add/Subtract of Packed Double-Precision Floating-Point Values 


ymm_2, ymm3/m256/m64bcst 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W1 96 /r A VV FMA Multiply packed double-precision floating-point values 
VFMADDSUB132PD xmm1, xmm2, from xmm1 and xmm3/mem, add/subtract elements in 
xmm3/m128 xmm2 and put result in xmm1. 
VEX.128.66.0F38.W1 A6 /r A VIV FMA Multiply packed double-precision floating-point values 
VFMADDSUB213PD xmm1, xmm2, from xmm1 and xmm2, add/subtract elements in 
xmm3/m128 xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W1 B6 /r A VIV FMA Multiply packed double-precision floating-point values 
VFMADDSUB231PD xmm1, xmm2, from xmm2 and xmm3/mem, add/subtract elements in 
xmm3/m128 xmm1 and put result in xmm1. 
VEX.256.66.0F38.W1 96 /r A VIV FMA Multiply packed double-precision floating-point values 
VFMADDSUB132PD ymm1, ymm2, from ymm1 and ymm3/mem, add/subtract elements in 
ymm3/m256 ymme and put result in ymm1. 
VEX.256.66.0F38.W1 A6 /r A VIV FMA Multiply packed double-precision floating-point values 
VFMADDSUB213PD ymm1, ymm2, from ymm1 and ymm2, add/subtract elements in 
ymm3/m256 ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.W1 B6 /r A VV FMA Multiply packed double-precision floating-point values 
VFMADDSUB231PD ymm1, ymm2, from ymm2 and ymm3/mem, add/subtract elements in 
ymm3/m256 ymm1 and put result in ymm1. 
EVEX.128.66.0F38.W1 A6 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB213PD xmm1 {k1}{Z}, AVX512F from xmm1 and xmmz, add/subtract elements in 
xmm2, xmm3/m128/m64bcst xmm3/m128/m64bcst and put result in xmm1 subject to 
writemask k1. 
EVEX.128.66.0F38.W1 B6 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB231PD xmm1 {k1}{Z}, AVX512F from xmm_2 and xmm3/m128/m64bcst, add/subtract 
xmm2, xmm3/m128/m64bcst elements in xmm1 and put result in xmm1 subject to 
writemask k1. 
EVEX.128.66.0F38.W1 96 /r B VV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB132PD xmm1 {k1}{Z}, AVX512F from xmm1 and xmm3/m128/m64bcst, add/subtract 
xmm2, xmm3/m128/m64bcst elements in xmm_2 and put result in xmm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W1 A6 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB213PD ymm1 {k1}{z}, AVX512F from ymm1 and ymm2, add/subtract elements in 
ymm_2, ymm3/m256/m64bcst ymm3/m256/m64bcst and put result in ymm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W1 B6 /r B VV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB231PD ymm1 {k1}{z}, AVX512F from ymm2 and ymm3/m256/m64bcst, add/subtract 
ymm_2, ymm3/m256/m64bcst elements in ymm1 and put result in ymm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W1 96 /r B VV AVX512VL | Multiply packed double-precision floating-point values 
VFMADDSUB132PD ymm1 {k1}{z}, AVX512F from ymm1 and ymm3/m256/m64bcst, add/subtract 


elements in ymm2 and put result in ymm1 subject to 
writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.512.66.0F38.W1 AG /r B VIV AVX512F Multiply packed double-precision floating-point values 
VFMADDSUB213PD zmm1 {k1}{Z}, from zmm1and zmmz, add/subtract elements in 
zmm2, zmm3/m512/m64bcst{er} zmm3/m512/m64bcst and put result in zmm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W1 B6 /r B VIV AVX512F Multiply packed double-precision floating-point values 
VFMADDSUB231PD zmm1 {k1}{z}, from zmm2 and zmm3/m512/m64bcst, add/subtract 
zmm2, zmm3/m512/m64bcst{er} elements in zmm1 and put result in zmm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W1 96 /r B VIV AVX512F Multiply packed double-precision floating-point values 
VFMADDSUB132PD zmm1 {k1}{z}, from zmm1 and zmm3/m512/m64bcst, add/subtract 
zmm2, zmm3/m51 2/m64bcst{er} elements in zmm_2 and put result in zmm1 subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFMADDSUB132PD: Multiplies the two, four, or eight packed double-precision floating-point values from the first 
source operand to the two or four packed double-precision floating-point values in the third source operand. From 
the infinite precision intermediate result, adds the odd double-precision floating-point elements and subtracts the 
even double-precision floating-point values in the second source operand, performs rounding and stores the 
resulting two or four packed double-precision floating-point values to the destination operand (first source 
operand). 


VFMADDSUB213PD: Multiplies the two, four, or eight packed double-precision floating-point values from the 
second source operand to the two or four packed double-precision floating-point values in the first source operand. 
From the infinite precision intermediate result, adds the odd double-precision floating-point elements and subtracts 
the even double-precision floating-point values in the third source operand, performs rounding and stores the 
resulting two or four packed double-precision floating-point values to the destination operand (first source 
operand). 


VFMADDSUB231PD: Multiplies the two, four, or eight packed double-precision floating-point values from the 
second source operand to the two or four packed double-precision floating-point values in the third source operand. 
From the infinite precision intermediate result, adds the odd double-precision floating-point elements and subtracts 
the even double-precision floating-point values in the first source operand, performs rounding and stores the 
resulting two or four packed double-precision floating-point values to the destination operand (first source 
operand). 

EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 
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VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 

Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFMADDSUB132PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] - SRC2[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(DEST[127:64]*SRC3[1 27:64] + SRC2[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] - SRC2[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(DEST[127:64]*SRC3[1 27:64] + SRC2[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(DEST[191:128]*SRC3[191:128] - SRC2[191:128}) 
DEST[255:192] := RoundFPControl_MXCSR(DEST[255:192]*SRC3[255:1 92] + SRC2[255:192] 
FI 


VFMADDSUB213PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] - SRC3[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*DEST[1 27:64] + SRC3[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] - SRC3[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*DEST[1 27:64] + SRC3[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(SRC2[191:128]*DEST[191:128] - SRC3[191:128]) 
DEST[255:192] := RoundFPControl_MXCSR(SRC2[255:1 92]*DEST[255:192] + SRC3[255:192] 
FI 


VFMADDSUB231PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] - DEST[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*SRC3[1 27:64] + DEST[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] - DEST[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*SRC3[1 27:64] + DEST[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(SRC2[191:128]*SRC3[191:128] - DEST[191:128}) 
DEST[255:192] = RoundFPControl_MXCSR(SRC2[255:192]*SRC3[255:1 92] + DEST[255:192] 
FI 


VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision Vol.2C 5-147 


INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
ELSE DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


5-148 Vol. 2C VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision 


INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 


(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] - SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] + SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
ELSE DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


5-150 Vol. 2C VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision 


VFMADDSUB213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 


(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[63:0]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[63:0]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-151 


INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
ELSE DEST[i+63:i] = 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 


(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] - DEST[i+63:i]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] + DEST[i+63:i]) 
ELSE 
DEST[i+63:i] = 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision Vol.2C 5-153 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDSUBxxxPD __m512d_mm512_fmaddsub_pd(__m512da,__m512db,__m512dc); 

VFMADDSUBxxxPD __m512d_mm512_fmaddsub_round_pd(__m512d a,__m512db,__m512dc, int r); 

VFMADDSUBxxxPD __m512d_mm512_mask_fmaddsub_pd(__m512d a,__ mmask8 k,__m512db,___m512d c); 
VFMADDSUBxxxPD __m512d_mm512_maskz_fmaddsub_pd(__mmask8 k,__m512da,__m512db,__m512d c); 
VFMADDSUBxxxPD __m512d_mm512_mask3_fmaddsub_pd(__m512d a,__m512db,__m512dc,__mmask8 k); 
VFMADDSUBxxxPD __m512d_mm512_mask_fmaddsub_round_pd(__m512d a,__mmask8 k,__m512db,__m512dc, int r); 
VFMADDSUBxxxPD __m512d_mm512_maskz_fmaddsub_round_pd(__mmask8 k,__m512da,__m512db,__m512dc, intr); 
VFMADDSUBxxxPD __m512d_mm512_mask3_fmaddsub_round_pd(__m512da,__m512db,__m512dc,__ mmask8 k, int r); 
VFMADDSUBxxxPD __m256d __mm256_mask_fmaddsub_pd(__m256d a,__ mmask8 k,___ m256d b,__ m256d c); 
VFMADDSUBxxxPD __m256d __mm256_maskz_fmaddsub_pd(__mmask8 k,__ m256d a,__m256d b,___m256d c); 
VFMADDSUBxxxPD __m256d__mm256_mask3_fmaddsub_pd(__m256d a,__m256d b,__m256dc,___mmask8 k); 
VFMADDSUBxxxPD __m128d _mm_mask_fmaddsub_pd(__m128d a,___mmask8 k,__m128d b,___m128d c); 
VFMADDSUBxxxPD __m128d __mm_maskz_fmaddsub_pd(__mmask8 k,__m128d a,__m128db,__m128d c); 
VFMADDSUBxxxPD __m128d __mm_mask3_fmaddsub_pd(__m128d a,__m128db,__m128dc,__mmask8 k); 
VFMADDSUBxxxPD __m128d _mm_fmaddsub_pd (__m128d a,__m128d b,__m128d c); 

VFMADDSUBxxxPD __m256d_mm256_fmaddsub_pd (__m256d a,___m256d b, __m256d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


5-154 Vol. 2C VFMADDSUB1 32PD/VFMADDSUB21 3PD/VFMADDSUB231PD—Fused Multiply-Alternating Add/Subtract of Packed Double-Precision 


INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB132PS/VFMADDSUB213PS/VFMADDSUB231PS—Fused Multiply-Alternating 
Add/Subtract of Packed Single-Precision Floating-Point Values 


VFMADDSUB132PS zmm1 {k1}{Z}, 
zmm2, zmm3/m51 2/m32bcst{er} 


VFMADDSUB1 32PS/VFMADDSUB2 1 3PS/VFMADDSUB231PS—Fused Multiply-Alternating Add/Subtract of Packed Single-Precision 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W0 96 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB132PS xmm1, xmm2, xmm1 and xmm3/mem, add/subtract elements in xmm2 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W0 A6 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB213PS xmm1, xmm2, xmm1 and xmm2, add/subtract elements in xmm3/mem 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W0 B6 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB231PS xmm1, xmm2, xmm_2 and xmm3/mem, add/subtract elements in xmm1 
xmm3/m128 and put result in xmm1. 
VEX.256.66.0F38.W0 96 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB132PS ymm1, ymme2, ymm1 and ymm3/mem, add/subtract elements in ymm2 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W0 A6 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB213PS ymm1, ymm2, ymm1 and ymm2, add/subtract elements in ymnm3/mem 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W0 B6 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMADDSUB231PS ymm1, ymm2, ymme2 and ymm3/mem, add/subtract elements in ymm1 
ymm3/m256 and put result in ymm1. 
EVEX.128.66.0F38.W0 A6 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB213PS xmm1 {k1}{2}, AVX512F xmm1 and xmmd2, add/subtract elements in 
xmm2, xmm3/m128/m32bcst xmm3/m128/m32bcst and put result in xmm1 subject to 
writemask k1. 
EVEX.128.66.0F38.W0 B6 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB231PS xmm1 {k1}{Z}, AVX512F xmme and xmm3/m128/m32bcst, add/subtract elements 
xmm2, xmm3/m128/m32bcst in xmm1 and put result in xmm1 subject to writemask k1. 
EVEX.128.66.0F38.W0 96 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB132PS xmm1 {k1}{z}, AVX512F xmm1 and xmm3/m128/m32bcst, add/subtract elements 
xmm2, xmm3/m128/m32bcst in zmm2 and put result in xmm1 subject to writemask k1. 
EVEX.256.66.0F38.W0 A6 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB213PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm2, add/subtract elements in 
ymm_2, ymm3/m256/m32bcst ymm3/m256/m32bcst and put result in ymm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W0 B6 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB231PS ymm1 {k1}{Z}, AVX512F ymme2 and ymm3/m256/m32bcst, add/subtract elements 
ymm_2, ymm3/m256/m32bcst in ymm1 and put result in ymm1 subject to writemask k1. 
EVEX.256.66.0F38.W0 96 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMADDSUB132PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m32bcst, add/subtract elements 
ymm_2, ymm3/m256/m32bcst in ymme2 and put result in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W0 A6 /r B VIV AVX512F Multiply packed single-precision floating-point values from 
VFMADDSUB213PS zmm1 {k1}{Z}, zmm1 and zmm2, add/subtract elements in 
zmm2, zmm3/m51 2/m32bcst{er} zmm3/m512/m32bcst and put result in zmm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W0O B6 /r B VIV AVX512F Multiply packed single-precision floating-point values from 
VFMADDSUB231PS zmm1 {k1}{Z}, zmme2 and zmm3/m512/m32bcst, add/subtract elements 
zmm2, zmm3/m51 2/m32bcst{er} in zmm1 and put result in zmm1 subject to writemask k1. 
EVEX.512.66.0F38.W0O 96 /r B VIV AVX512F Multiply packed single-precision floating-point values from 


zmm1 and zmm3/m512/m32bcst, add/subtract elements 
in zmm2 and put result in zmm1 subject to writemask k1. 


Vol.2C 5-155 


INSTRUCTION SET REFERENCE, V-Z 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFMADDSUB132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the corresponding packed single-precision floating-point values in the third source operand. 
From the infinite precision intermediate result, adds the odd single-precision floating-point elements and subtracts 
the even single-precision floating-point values in the second source operand, performs rounding and stores the 
resulting packed single-precision floating-point values to the destination operand (first source operand). 


VFMADDSUB213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the 
second source operand to the corresponding packed single-precision floating-point values in the first source 
operand. From the infinite precision intermediate result, adds the odd single-precision floating-point elements and 
subtracts the even single-precision floating-point values in the third source operand, performs rounding and stores 
the resulting packed single-precision floating-point values to the destination operand (first source operand). 


VFMADDSUB231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the 
second source operand to the corresponding packed single-precision floating-point values in the third source 
operand. From the infinite precision intermediate result, adds the odd single-precision floating-point elements and 
subtracts the even single-precision floating-point values in the first source operand, performs rounding and stores 
the resulting packed single-precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


5-156 Vol. 2C VFMADDSUB132PS/VFMADDSUB2 1 3PS/VFMADDSUB231PS—Fused Multiply-Alternating Add/Subtract of Packed Single-Precision 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFMADDSUB132PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM :=2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%i; 
DEST[n+31:n] := RoundFPControl_MXCSR(DEST[n+31 :n]*SRC3[n+3 1:n] - SRC2[n+31:n]) 
DEST[nN+63:n+32] := RoundFPControl_MXCSR(DEST[n+63:n+32]*SRC3[n+63:n+32] + SRC2[n+63:n+32]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADDSUB213PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*DEST[n+31:n] - SRC3[n+31:n]) 
DEST[n+63:n+32] := RoundFPControl_MXCSR(SRC2[n+63:n+32]*DEST[n+63:n+32] + SRC3[n+63:n+32)) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB231PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*SRC3[n+31:n] - DEST[n+31:n]) 
DEST[n+63:n+32] :=RoundFPControl_MXCSR(SRC2[n+63:n+32]*SRC3[n+63:n+32] + DEST[n+63:n+32]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMADDSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) (4, 128), (8, 256),= (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] := 
RoundFPControl(DEST[i+31:i]*SRC3[i+31:i] - SRC2[i+3 1:i]) 
ELSE DEST[i+31:i] = 
RoundFPControl(DEST[i+31:i]*SRC3[i+31:i] + SRC2[i+31:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 


(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] = 
RoundFPControl_MXCSR(DEST[i+3 1 :i]*SRC3[3 1:0] - SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] = 
RoundFPControl_MXCSR(DEST[i+3 1 :i]*SRC3[i+3 1:i] - SRC2[i+31:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] = 
RoundFPControl_MXCSR(DEST[i+3 1 :i]*SRC3[3 1:0] + SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] = 
RoundFPControl_MXCSR(DEST[i+3 1 :i]*SRC3[i+3 1:i] + SRC2[i+3 1:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] := 
RoundFPControl(SRC2[i+31:i]*DEST[i+31:i] - SRC3[i+3 1:i]) 
ELSE DEST[i+31:i] := 
RoundFPControl(SRC2[i+31:i]*DEST[i+31:i] + SRC3[i+31:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMADDSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] - SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] - SRC3[i+3 1:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] + SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+31:i] + SRC3[i+31:i]) 
Fl; 
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Fl 
ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


INSTRUCTION SET REFERENCE, V-Z 


VFMADDSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 


(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] = 
RoundFPControl(SRC2[i+31:i]*SRC3[i+31:i] - DEST[i+31:i]) 
ELSE DEST[i+31:i] := 
RoundFPControl(SRC2[i+31:i]*SRC3[i+31:i] + DEST[i+31:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMADDSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] - DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[i+31:i] - DEST[i+3 1:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] + DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[i+31:i] + DEST[i+31:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 
VFMADDSUBxxxPS 


m512 


mm512_fmaddsub_ps(__m512 a,__m512b,__m512 c); 


m512 


mm512_fmaddsub_round_ps(__m512 a,__m512b,__m512c, int r); 


m512 


mm512_mask_fmaddsub_ps(__m512 a,__mmask16 k,__m512b,__m512 c); 


m512 


m512 


mm512_maskz_fmaddsub_ps(__mmask16 k,__m512a,__m512b,__m512c); 
mm512_mask3_fmaddsub_ps(__m512 a,__m512b,__m512c,__mmask16 k); 


m512 


mm512_mask_fmaddsub_round_ps(__m512 a,__mmask16 k,__m512b,__m512¢, intr); 


m512 


mm512_maskz_fmaddsub_round_ps(__mmask16 k,__m512a,__m512b,__m512¢, intr); 


m512 


mm512_mask3_fmaddsub_round_ps(__m512 a,__m512b,__m512c,__mmask16 k, int r); 


m256 


mm256_mask_fmaddsub_ps(__m256 a,__mmask8 k,__m256 b,__m256 c); 


m256 


mm256_maskz_fmaddsub_ps(__mmask8 k,__m256 a,__m256 b,__m256 c); 


m256 


mi28 


mm256_mask3_fmaddsub_ps(__m256 a,__m256b,__m256c,__ mmask8 k); 
mm_mask_fmaddsub_ps(__m128 a,__mmask8 k,__m128b,__m128 c); 


mi28 


mm_maskz_fmaddsub_ps(__mmask8 k,__m128 a,__m128b,__m128 c); 


mi28 


mm_mask3_fmaddsub_ps(__m128 a,__m128b,__m128 c,___mmask8 k); 


_m128 
VFMADDSUBxxxPS __m256 _mm256_fmaddsub_ps (__m256 a, 


_mm_fmaddsub_ps (__m128 a,__m128b,__m128 c); 
m256 b,__m256 c); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD132PD/VFMSUBADD21 3PD/VFMSUBADD231PD—Fused Multiply-Alternating 
Subtract/Add of Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W1 97 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD132PD xmm1, xmm2, from xmm1 and xmm3/mem, subtract/add elements 
xmm3/m128 in xmm_2 and put result in xmm1. 
VEX.128.66.0F38.W1 A7 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD213PD xmm1, xmm2, from xmm1 and xmm2, subtract/add elements in 
xmm3/m128 xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W1 B7 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD231PD xmm1, xmm2, from xmm2 and xmm3/mem, subtract/add elements 
xmm3/m128 in xmm1 and put result in xmm1. 
VEX.256.66.0F38.W1 97 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD132PD ymm1, ymm2, from ymm1 and ymm3/mem, subtract/add elements 
ymm3/m256 in ymm2 and put result in ymm1. 
VEX.256.66.0F38.W1 A7 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD213PD ymm1, ymm2, from ymm1 and ymm2, subtract/add elements in 
ymm3/m256 ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.W1 B7 /r A VV FMA Multiply packed double-precision floating-point values 
VFMSUBADD231PD ymm1, ymm2, from ymm2 and ymm3/mem, subtract/add elements 
ymm3/m256 in ymm1 and put result in ymm1. 
EVEX.128.66.0F38.W1 97 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD132PD xmm1 {k1}{Z}, AVX512F from xmm1 and xmm3/m128/m64bcst, subtract/add 
xmm2, xmm3/m128/m64bcst elements in xmm_2 and put result in xmm1 subject to 
writemask k1. 
EVEX.128.66.0F38.W1 A7 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD213PD xmm1 {k1}{Z}, AVX512F from xmm1 and xmm2, subtract/add elements in 
xmm2, xmm3/m128/m64bcst xmm3/m128/m64bcst and put result in xmm1 
subject to writemask k1. 
EVEX.128.66.0F38.W1 B7 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD231PD xmm1 {k1}{Z}, AVX512F from xmm_2 and xmm3/m128/m64bcst, subtract/add 
xmm2, xmm3/m128/m64bcst elements in xmm1 and put result in xmm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W1 97 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD132PD ymm1 {k1}{z}, AVX512F from ymm1 and ymm3/m256/m64bcst, subtract/add 
ymm2, ymm3/m256/m64bcst elements in ymm2 and put result in ymm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W1 A7 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD213PD ymm1 {k1}{z}, AVX512F from ymm1 and ymm2, subtract/add elements in 
ymme2, ymm3/m256/m64bcst ymm3/m256/m64bcst and put result in ymm1 
subject to writemask k1. 
EVEX.256.66.0F38.W1 B7 /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUBADD231PD ymm1 {k1}{z}, AVX512F from ymm2 and ymm3/m256/m64bcst, subtract/add 


ymm2, ymm3/m256/m64bcst 


elements in ymm1 and put result in ymm1 subject to 
writemask k1. 
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INSTRUCTION SET REFERENCE, V-Z 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.512.66.0F38.W1 97 /r B VV AVX512F Multiply packed double-precision floating-point values 
VFMSUBADD132PD zmm1 {k1}{z}, from zmm1 and zmm3/m512/m64bcst, subtract/add 
zmm2, zmm3/m512/m64bcst{er} elements in zmme2 and put result in zmm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W1 A7 /r B VV AVX512F Multiply packed double-precision floating-point values 
VFMSUBADD213PD zmm1 {k1}{z}, from zmm1 and zmm2, subtract/add elements in 
zmm2, zmm3/m51 2/m64bcst{er} zmm3/m512/m64bcst and put result inzmm1 subject 
to writemask k1. 
EVEX.512.66.0F38.W1 B7 /r B VV AVX512F Multiply packed double-precision floating-point values 
VFMSUBADD231PD zmm1 {k1}{Z}, from zmm2 and zmm3/m512/m64bcst, subtract/add 
zmm2, zmm3/m51 2/m64bcst{er} elements in zmm1 and put result in zmm1 subject to 
writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFMSUBADD132PD: Multiplies the two, four, or eight packed double-precision floating-point values from the first 
source operand to the two or four packed double-precision floating-point values in the third source operand. From 
the infinite precision intermediate result, subtracts the odd double-precision floating-point elements and adds the 
even double-precision floating-point values in the second source operand, performs rounding and stores the 
resulting two or four packed double-precision floating-point values to the destination operand (first source 
operand). 


VFMSUBADD213PD: Multiplies the two, four, or eight packed double-precision floating-point values from the 
second source operand to the two or four packed double-precision floating-point values in the first source operand. 
From the infinite precision intermediate result, subtracts the odd double-precision floating-point elements and 
adds the even double-precision floating-point values in the third source operand, performs rounding and stores the 
resulting two or four packed double-precision floating-point values to the destination operand (first source 
operand). 


VFMSUBADD231PD: Multiplies the two, four, or eight packed double-precision floating-point values from the 
second source operand to the two or four packed double-precision floating-point values in the third source 
operand. From the infinite precision intermediate result, subtracts the odd double-precision floating-point 
elements and adds the even double-precision floating-point values in the first source operand, performs rounding 
and stores the resulting two or four packed double-precision floating-point values to the destination operand (first 
source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 
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INSTRUCTION SET REFERENCE, V-Z 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 

Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFMSUBADD132PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] + SRC2[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(DEST[127:64]*SRC3[1 27:64] - SRC2[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] + SRC2[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(DEST[127:64]*SRC3[1 27:64] - SRC2[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(DEST[191:128]*SRC3[191:128] + SRC2[191:128]) 
DEST[255:192] := RoundFPControl_MXCSR(DEST[255:192]*SRC3[255:1 92] - SRC2[255:192] 
Fl 


VFMSUBADD213PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] + SRC3[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*DEST[127:64] - SRC3[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] + SRC3[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*DEST[1 27:64] - SRC3[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(SRC2[191:128]*DEST[191:128] + SRC3[191:128}) 
DEST[255:192] := RoundFPControl_MXCSR(SRC2[255:192]*DEST[255:1 92] - SRC3[255:192] 
Fl 


VFMSUBADD231PD DEST, SRC2, SRC3 
IF (VEX.128) THEN 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] + DEST[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*SRC3[1 27:64] - DEST[127:64]) 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] + DEST[63:0]) 
DEST[127:64] := RoundFPControl_MXCSR(SRC2[127:64]*SRC3[1 27:64] - DEST[127:64]) 
DEST[191:128] := RoundFPControl_MXCSR(SRC2[191:128]*SRC3[191:128] + DEST[191:128]) 
DEST[255:192] := RoundFPControl_MXCSR(SRC2[255:192]*SRC3[255:192] - DEST[255:192] 
Fl 
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VFMSUBADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
ELSE DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFMSUBADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] + SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] + SRC2[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] - SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


5-168 Vol. 2C VFMSUBADD 1 32PD/VFMSUBADD21 3PD/VFMSUBADD231PD—Fused Multiply-Alternating Subtract/Add of Packed Double-Precision 


INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
ELSE DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[63:0]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] + SRC3[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[63:0]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
ELSE DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] + DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] + DEST[i+63:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] - DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 
VFMSUBADDxxxPD 


m512d 


mm512_fmsubadd_pd(__m512da,__m512db,_m512d c); 


m512d 


mm512_fmsubadd_round_pd(__m512da,__m512db,__m512dc, int r); 


m512d 


mm512_mask_fmsubadd_pd(__m512d a,__mmask8 k,__m512db,__m512d c); 


m512d 


mm512_maskz_fmsubadd_pd(__mmask8 k,__m512da,__m512db,__m512dc); 


m512d 


mm512_mask3_fmsubadd_pd(__m512da,__m512db,__m512dc,__ mmask8 k); 


m512d 


mm512_mask_fmsubadd_round_pd(__m512da,__ mmask8 k,__m512db,__m512dc, intr); 


m512d 


mm512_maskz_fmsubadd_round_pd(__mmask8 k,__m512da,__m512db,__m512dc, int r); 


m512d 


mm512_mask3_fmsubadd_round_pd(__m512da,__m512db,__m512dc,__mmask8 k, int r); 


m256d 


mm256_mask_fmsubadd_pd(__m256d a,___ mmask8 k,__m256d b, __m256d c); 


m256d 


mm256_maskz_fmsubadd_pd(__mmask8 k,__m256d a,__m256d b,___ m256d c); 


m256d 


mm256_mask3_fmsubadd_pd(__m256d a,__m256db,__ m256dc,___ mmask8 k); 


m128d 


mm_mask_fmsubadd_pd(__m128d a,__ mmask8 k,__m128db,__m128d c); 


m128d 


mm_maskz_fmsubadd_pd(__mmask8 k,__m128da,__m128db,___m128d c); 


m128d 


mm_mask3_fmsubadd_pd(__m128d a,__m128d b,__m128dc, __mmask8 k); 


__m128d 


_mm_fmsubadd_pd (__m128d a,__m128db,___m128d c); 
VFMSUBADDxxxPD __m256d __mm256_fmsubadd_pd (__m256d a, 


m256d b,__m256d c); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


VFMSUBADD132PD/VFMSUBADD21 3PD/VFMSUBADD231PD—Fused Multiply-Alternating Subtract/Add of Packed Double-Precision 


Vol.2C 5-173 


INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD132PS/VFMSUBADD21 3PS/VFMSUBADD231PS—Fused Multiply-Alternating 
Subtract/Add of Packed Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W0O 97 /r A VV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD132PS xmm1, xmm2, xmm1 and xmm3/mem, subtract/add elements in xmm2 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W0O A7 /r A VV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD213PS xmm1, xmm2, xmm1 and xmm2, subtract/add elements in xmm3/mem 
xmm3/m128 and put result in xmm1. 
VEX.128.66.0F38.W0O B7 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD231PS xmm1, xmm2, xmm2 and xmm3/mem, subtract/add elements in xmm1 
xmm3/m128 and put result in xmm1. 
VEX.256.66.0F38.WO 97 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD132PS ymm1, ymm2, ymm1 and ymm3/mem, subtract/add elements in ymnm2 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W0O A7 /r A VIV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD213PS ymm1, ymm2, ymm1 and ymm2, subtract/add elements in ymm3/mem 
ymm3/m256 and put result in ymm1. 
VEX.256.66.0F38.W0 B7 /r A VV FMA Multiply packed single-precision floating-point values from 
VFMSUBADD231PS ymm1, ymm2, ymme2 and ymm3/mem, subtract/add elements in ymm1 
ymm3/m256 and put result in ymm1. 
EVEX.128.66.0F38.W0 97 /r B VV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD132PS xmm1 {k1}{z}, AVX512F xmm1 and xmm3/m128/m32bcst, subtract/add elements 
xmm2, xmm3/m128/m32bcst in xmm2 and put result in xmm1 subject to writemask k1. 
EVEX.128.66.0F38.W0 A7 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD213PS xmm1 {k1}{z}, AVX512F xmm1 and xmm2, subtract/add elements in 
xmm2, xmm3/m128/m32bcst xmm3/m128/m32bcst and put result in xmm1 subject to 
writemask k1. 
EVEX.128.66.0F38.W0 B7 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD231PS xmm1 {k1}{z}, AVX512F xmme2 and xmm3/m128/m32bcst, subtract/add elements 
xmm2, xmm3/m128/m32bcst in xmm1 and put result in xmm1 subject to writemask k1. 
EVEX.256.66.0F38.W0 97 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD132PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m32bcst, subtract/add elements 
ymm2, ymm3/m256/m32bcst in ymmd2 and put result in ymm1 subject to writemask k1. 
EVEX.256.66.0F38.W0 A7 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD213PS ymm1 {k1}{Z}, AVX512F ymm1 and ymmd2, subtract/add elements in 
ymm2, ymm3/m256/m32bcst ymm3/m256/m32bcst and put result in ymm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W0 B7 /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFMSUBADD231PS ymm1 {k1}{Z}, AVX512F ymme2 and ymm3/m256/m32bcst, subtract/add elements 
ymm2, ymm3/m256/m32bcst in ymm1 and put result in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W0 97 /r B VIV AVX512F Multiply packed single-precision floating-point values from 
VFMSUBADD132PS zmm1 {k1}{Z}, zmm1 and zmm3/m512/m32bcst, subtract/add elements 
zmm2, zmm3/m51 2/m32bcst{er} in zmm2 and put result in zmm1 subject to writemask k1. 
EVEX.512.66.0F38.W0 A7 /r B VV AVX512F Multiply packed single-precision floating-point values from 
VFMSUBADD213PS zmm1 {k1}{Z}, zmm1 and zmmcz, subtract/add elements in 
zmm2, zmm3/m512/m32bcst{er} zmm3/m512/m32bcst and put result in zmm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W0 B7 /r B VV AVX512F Multiply packed single-precision floating-point values from 


VFMSUBADD231PS zmm1 {k1}{2}, 
zmm2, zmm3/m51 2/m32bcst{er} 
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zmme2 and zmm3/m512/m32bcst, subtract/add elements 
in zmm1 and put result in zmm1 subject to writemask k1. 


VFMSUBADD132PS/VFMSUBADD213PS/VFMSUBADD231PS—Fused Multiply-Alternating Subtract/Add of Packed Single-Precision 


INSTRUCTION SET REFERENCE, V-Z 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFMSUBADD132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the corresponding packed single-precision floating-point values in the third source operand. 
From the infinite precision intermediate result, subtracts the odd single-precision floating-point elements and adds 
the even single-precision floating-point values in the second source operand, performs rounding and stores the 
resulting packed single-precision floating-point values to the destination operand (first source operand). 


VFMSUBADD213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the 
second source operand to the corresponding packed single-precision floating-point values in the first source 
operand. From the infinite precision intermediate result, subtracts the odd single-precision floating-point elements 
and adds the even single-precision floating-point values in the third source operand, performs rounding and stores 
the resulting packed single-precision floating-point values to the destination operand (first source operand). 


VFMSUBADD231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the 
second source operand to the corresponding packed single-precision floating-point values in the third source 
operand. From the infinite precision intermediate result, subtracts the odd single-precision floating-point elements 
and adds the even single-precision floating-point values in the first source operand, performs rounding and stores 
the resulting packed single-precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


VFMSUBADD132PS/VFMSUBADD213PS/VFMSUBADD231PS—Fused Multiply-Alternating Subtract/Add of Packed Single-Precision Vol.2C 5-175 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFMSUBADD132PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%; 
DEST[n+31:n] := RoundFPControl_MXCSR(DEST[n+31 :n]*SRC3[n+31:n] + SRC2[n+31:n]) 
DEST[n+63:n+32] := RoundFPControl_MXCSR(DEST[n+63:n+32]*SRC3[n+63:n+32] -SRC2[n+63:n+32)) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUBADD213PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n}*DEST[n+31:n] +SRC3[n+3 1:n)J) 
DEST[n+63:n+32] := RoundFPControl_MXCSR(SRC2[n+63:n+32]*DEST[n+63:n+32] -SRC3[n+63:n+32]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUBADD231PS DEST, SRC2, SRC3 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM -1{ 
n:= 64%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*SRC3[n+31:n] + DEST[n+31:n]) 
DEST[n+63:n+32] := RoundFPControl_MXCSR(SRC2[n+63:n+32]*SRC3[n+63:n+32] -DEST[n+63:n+32]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFMSUBADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 


(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] = 
RoundFPControl(DEST[i+3 1 :i]*SRC3[i+31:i] + SRC2[i+31:i]) 
ELSE DEST[i+31:i] := 
RoundFPControl(DEST[i+3 1 :i]*SRC3[i+31:i] - SRC2[i+31:i]) 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFMSUBADD132PS/VFMSUBADD2 1 3PS/VFMSUBADD231PS—Fused Multiply-Alternating Subtract/Add of Packed Single-Precision 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-177 


INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[3 1:0] + SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[i+31:i] + SRC2[i+31:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[3 1:0] - SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[i+31:i] - SRC2[i+31:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] = 
RoundFPControl(SRC2[i+31:i]*DEST[i+31:i] + SRC3[i+31:i]) 
ELSE DEST[i+31:i] := 
RoundFPControl(SRC2[i+31:i]*DEST[i+31:i] - SRC3[i+3 1:i]) 
Fl 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] + SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] + SRC3[i+31:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+31:i] - SRC3[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*DEST[i+31:i] - SRC3[31:0]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMSUBADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN DEST[i+31:i] = 
RoundFPControl(SRC2[i+31:i]*SRC3[i+31:i] + DEST[i+31:i]) 
ELSE DEST[i+31:i] := 
RoundFPControl(SRC2[i+31:i]*SRC3[i+31:i] - DEST[i+31:i]) 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUBADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF j *is even* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] + DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[i+31:i] + DEST[i+31:i]) 
Fl; 
ELSE 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] - DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[i+31:i] - DEST[i+3 1:i]) 
Fl; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 
VFMSUBADDxxxPS 


m512 


mm512_fmsubadd_ps(__m512 a,__m512b,__m512 c); 


m512 


mm512_fmsubadd_round_ps(__m512 a,__m512b,__m512¢, intr); 


m512 


mm512_mask_fmsubadd_ps(__m512 a,__mmask16k,__m512b,__m512 c); 


m512 


mm512 


m512 


maskz_fmsubadd_ps(__mmask16 k,__m512 a,__m512b,__m512 c); 


mm512_mask3_fmsubadd_ps(__m512 a,__m512b,__m512c,__mmask16 k); 


m512 


mm512_mask_fmsubadd_round_ps(__m512 a,__mmask16 k,__m512b,__m512, int r); 


m512 


mm512_maskz_fmsubadd_round_ps(__mmask16 k,__m512a,__m512b,__m512c, intr); 


m512 


mm512_mask3_fmsubadd_round_ps(__m512 a,__m512b,__m512 c,__mmask16 k, int r); 


m256 


mm256_mask_fmsubadd_ps(__m256 a,__mmask8k,__m256 b,__m256 c); 


m256 


mm256_maskz_fmsubadd_ps(__mmask8 k,__m256 a,__m256b,__m256 c); 


m256 


mi28 


mm256_mask3_fmsubadd_ps(__m256 a,__m256b,__m256c,__ mmask8 k); 
mm_mask_fmsubadd_ps(__m128 a,__ mmask8 k,__m128b,__m128 c); 


mi28 


mm_maskz_fmsubadd_ps(__mmask8 k,__m128 a,__m128b,__m128 c); 


mi28 


mm_mask3_fmsubadd_ps(__m128 a,__m128b,__m128c, ___mmask8 k); 


_m128 
VFMSUBADDxxxPS __m256 __mm256_fmsubadd_ps (__m256 a, 


_mm_fmsubadd_ps (__m128 a,__m128b,__m128c); 
m256 b,__m256 c); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 


VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 


VFMSUBADD132PS/VFMSUBADD213PS/VFMSUBADD231PS—Fused Multiply-Alternating Subtract/Add of Packed Single-Precision 


Vol.2C 5-183 


INSTRUCTION SET REFERENCE, V-Z 


VFMSUB132PD/VFMSUB213PD/VFMSUB231PD—Fused Multiply-Subtract of Packed Double- 
Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.128.66.0F38.W1 9A /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB132PD xmm1, xmm2, from xmm1 and xmm3/mem, subtract xmm2 and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.W1 AA /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB213PD xmm1, xmm2, from xmm1 and xmmz, subtract xmm3/mem and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.W1 BA /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB231PD xmm1, xmm2, from xmm_2 and xmm3/mem, subtract xmm1 and put 
xmm3/m128 result in xmm1. 
VEX.256.66.0F38.W1 9A /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB132PD ymm1, ymm2, from ymm1 and ymm3/mem, subtract ymm2 and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.W1 AA /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB213PD ymm1, ymm2, from ymm1 and ymm2, subtract ynm3/mem and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.W1 BA /r A VIV FMA Multiply packed double-precision floating-point values 
VFMSUB231PD ymm1, ymm2, from ymm2 and ymm3/mem, subtract ymm1 and put 
ymm3/m256 result in ymm1.S 
EVEX.128.66.0F38.W1 9A /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB132PD xmm1 {k1}{Z}, AVX512F from xmm1 and xmm3/m128/m64bcst, subtract xmm2 
xmm2, xmm3/m128/m64bcst and put result in xmm1 subject to writemask k1. 
EVEX.128.66.0F38.W1 AA /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB213PD xmm1 {k1}{z}, AVX512F from xmm1 and xmmz, subtract xmm3/m128/m64bcst 
xmm2, xmm3/m128/m64bcst and put result in xmm1 subject to writemask k1. 
EVEX.128.66.0F38.W1 BA /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB231PD xmm1 {k1}{z}, AVX512F from xmm_2 and xmm3/m128/m64bcst, subtract xmm1 
xmm2, xmm3/m128/m64bcst and put result in xmm1 subject to writemask k1. 
EVEX.256.66.0F38.W1 9A /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB132PD ymm1 {k1}{Z}, AVX512F from ymm1 and ymm3/m256/m64bcst, subtract ymm2 
ymme2, ymm3/m256/m64bcst and put result in ymm1 subject to writemask k1. 
EVEX.256.66.0F38.W1 AA /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB213PD ymm1 {k1}{Z}, AVX512F from ymm1 and ymm2, subtract ynm3/m256/m64bcst 
ymm2, ymm3/m256/m64bcst and put result in ymm1 subject to writemask k1. 
EVEX.256.66.0F38.W1 BA /r B VIV AVX512VL | Multiply packed double-precision floating-point values 
VFMSUB231PD ymm1 {k1}{Z}, AVX512F from ymm_2 and ymm3/m256/m64bcst, subtract ymm1 
ymme2, ymm3/m256/m64bcst and put result in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W1 9A /r B VIV AVX512F Multiply packed double-precision floating-point values 
VFMSUB132PD zmm1 {k1}{Z}, from zmm1 and zmm3/m512/m64bcst, subtract zmm2 
zmm2, zmm3/m512/m64bcst{er} and put result in zmm1 subject to writemask k1. 
EVEX.512.66.0F38.W1 AA /r B VIV AVX512F Multiply packed double-precision floating-point values 
VFMSUB213PD zmm1 {k1}{Z}, from zmm1 and zmm2, subtract zmm3/m512/m64bcst 
zmm2, zmm3/m512/m64bcst{er} and put result in zmm1 subject to writemask k1. 
EVEX.512.66.0F38.W1 BA /r B VIV AVX512F Multiply packed double-precision floating-point values 


VFMSUB231PD zmm1 {k1}{z}, 
zmm2, zmm3/m512/m64bcst{er} 


from zmm2 and zmm3/m512/m64bcst, subtract zmm1 
and put result in zmm1 subject to writemask k1. 
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INSTRUCTION SET REFERENCE, V-Z 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a set of SIMD multiply-subtract computation on packed double-precision floating-point values using three 
source operands and writes the multiply-subtract results in the destination operand. The destination operand is 
also the first source operand. The second operand must be a SIMD register. The third source operand can be a 
SIMD register or a memory location. 


VFMSUB132PD: Multiplies the two, four or eight packed double-precision floating-point values from the first source 
operand to the two, four or eight packed double-precision floating-point values in the third source operand. From 
the infinite precision intermediate result, subtracts the two, four or eight packed double-precision floating-point 
values in the second source operand, performs rounding and stores the resulting two, four or eight packed double- 
precision floating-point values to the destination operand (first source operand). 


VFMSUB213PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source operand to the two, four or eight packed double-precision floating-point values in the first source operand. 
From the infinite precision intermediate result, subtracts the two, four or eight packed double-precision floating- 
point values in the third source operand, performs rounding and stores the resulting two, four or eight packed 
double-precision floating-point values to the destination operand (first source operand). 


VFMSUB231PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source to the two, four or eight packed double-precision floating-point values in the third source operand. From the 
infinite precision intermediate result, subtracts the two, four or eight packed double-precision floating-point values 
in the first source operand, performs rounding and stores the resulting two, four or eight packed double-precision 
floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFMSUB132PD DEST, SRC2, SRC3 (VEX encoded versions) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(DEST[n+63:n]*SRC3[n+63:n] - SRC2[n+63:n)) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUB213PD DEST, SRC2, SRC3 (VEX encoded versions) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(SRC2[n+63:n]*DEST[n+63:n] - SRC3[n+63:n)) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUB231PD DEST, SRC2, SRC3 (VEX encoded versions) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(SRC2[n+63:n]*SRC3[n+63:n] - DEST[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUB132PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB132PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[63:0] - SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(DEST[i+63:i]*SRC3[i+63:i] - SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Vol.2C 5-187 


INSTRUCTION SET REFERENCE, V-Z 


VFMSUB213PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB213PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[63:0]) 
+31:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*DEST[i+63:i] - SRC3[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


VFMSUB231PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB231PD DEST, SRC2, SRC3 (EVEX encoded versions, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[63:0] - DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(SRC2[i+63:i]*SRC3[i+63:i] - DEST[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Vol.2C 5-189 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBxxxPD __m512d_mm512_fmsub_pd(__m512da,__m512db,__m512dc); 

VFMSUBxxxPD __m512d_mm512_fmsub_round_pd(__m512da,__m512db,__m512dc, int r); 

VFMSUBxxxPD __m512d_mm512_mask_fmsub_pd(__m512da,__ mmask8 k,__m512db,__m512d c); 
VFMSUBxxxPD __m512d_mm512_maskz_fmsub_pd(__mmask8 k,__m512da,__m512db,__m512d c); 
VFMSUBxxxPD __m512d_mm512_mask3_fmsub_pd(__m512da,__m512db,__m512dc,__mmask8 k); 
VFMSUBxxxPD __m512d_mm512_mask_fmsub_round_pd(__m512d a,__mmask8k,__m512db,__m512dc, int r); 
VFMSUBxxxPD __m512d_mm512_maskz_fmsub_round_pd(__mmask8 k,___m512da,__m512db,__m512dc, intr); 
VFMSUBxxxPD __m512d_mm512_mask3_fmsub_round_pd(__m512da,__m512db,__m512dc,___mmask8 k, int r); 
VFMSUBxxxPD __m256d_mm256_mask_fmsub_pd(__m256d a,__ mmask8 k,__ m256d b,__ m256d c); 
VFMSUBxxxPD __m256d _mm256_maskz_fmsub_pd(__mmask8 k,___ m256d a,__m256d b,___m256d c); 
VFMSUBxxxPD __m256d_mm256_mask3_fmsub_pd(__m256d a,__m256d b,__m256d c,___mmask8 k); 
VFMSUBxxxPD __m128d _mm_mask_fmsub_pd(__m128d a,__mmask8 k,__m128d b,___m128d c); 

VFMSUBxxxPD __m128d _mm_maskz_fmsub_pd(__mmask8 k,__m128d a,__m128d b,___m128d c); 
VFMSUBxxxPD __m128d _mm_mask3_fmsub_pd(__m128d a,__m128db,__m128dc,__mmask8 k); 
VFMSUBxxxPD __m128d_mm_fmsub_pd (__m128da,_m128db,__m128d c); 

VFMSUBxxxPD __m256d_mm256_fmsub_pd (__m256d a,__m256d b, __m256d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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VFMSUB132PS/VFMSUB2 1 3PS/VFMSUB231PS—Fused Multiply-Subtract of Packed Single- 
Precision Floating-Point Values 


VFMSUB231PS zmm1 {k1}{Z}, 
zmm2, zmm3/m51 2/m32bcst{er} 


Opcode/ Op/E | 64/32 CPUID Description 
Instruction n bitMode | Feature 

Support Flag 
VEX.128.66.0F38.W0 9A /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB132PS xmm1, xmm2, from xmm1 and xmm3/mem, subtract xmm_2 and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.W0 AA /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB213PS xmm1, xmm2, from xmm1 and xmm2z, subtract xmm3/mem and put 
xmm3/m128 result in xmm1. 
VEX.128.66.0F38.W0 BA /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB231PS xmm1, xmm2, from xmm2 and xmm3/mem, subtract xmm1 and put 
xmm3/m128 result in xmm1. 
VEX.256.66.0F38.W0 9A /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB132PS ymm1, ymm2, from ymm1 and ymm3/mem, subtract ymm2 and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.W0 AA /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB213PS ymm1, ymm2, from ymm1 and ymm2, subtract ymm3/mem and put 
ymm3/m256 result in ymm1. 
VEX.256.66.0F38.0 BA /r A VIV FMA Multiply packed single-precision floating-point values 
VFMSUB231PS ymm1, ymm2, from ymm2 and ymm3/mem, subtract ymm1 and put 
ymm3/m256 result in ymm1. 
EVEX.128.66.0F38.W0 JA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB132PS xmm1 {k1}{z}, AVX512F from xmm1 and xmm3/m128/m32bcst, subtract 
xmm2, xmm3/m128/m32bcst xmme2 and put result in xmm1. 
EVEX.128.66.0F38.WO AA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB213PS xmm1 {k1}{z}, AVX512F from xmm1 and xmmz, subtract 
xmm2, xmm3/m128/m32bcst xmm3/m128/m32bcst and put result in xmm1. 
EVEX.128.66.0F38.W0 BA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB231PS xmm1 {k1}{z}, AVX512F from xmm2 and xmm3/m128/m32bcst, subtract 
xmm2, xmm3/m128/m32bcst xmm1 and put result in xmm1. 
EVEX.256.66.0F38.W0 JA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB132PS ymm1 {k1}{z}, AVX512F from ymm1 and ymm3/m256/m32bcst, subtract 
ymm_2, ymm3/m256/m32bcst ymm_2 and put result in ymm1. 
EVEX.256.66.0F38.W0 AA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB213PS ymm1 {k1}{z}, AVX512F from ymm1 and ymm2, subtract 
ymm_2, ymm3/m256/m32bcst ymm3/m256/m32bcst and put result in ymm1. 
EVEX.256.66.0F38.W0 BA /r B VIV AVX512VL | Multiply packed single-precision floating-point values 
VFMSUB231PS ymm1 {k1}{z}, AVX512F from ymm2 and ymm3/m256/m32bcst, subtract 
ymm_2, ymm3/m256/m32bcst ymm1 and put result in ymm1. 
EVEX.512.66.0F38.W0 JA /r B VIV AVX512F Multiply packed single-precision floating-point values 
VFMSUB132PS zmm1 {k1}{Z}, from zmm1 and zmm3/m512/m32bcst, subtract zmm2 
zmm2, zmm3/m51 2/m32bcst{er} and put result in zmm1. 
EVEX.512.66.0F38.W0 AA /r B VIV AVX512F Multiply packed single-precision floating-point values 
VFMSUB213PS zmm1 {k1}{Z}, from zmm1 and zmm2, subtract zmm3/m512/m32bcst 
zmm2, zmm3/m51 2/m32bcst{er} and put result in zmm1. 
EVEX.512.66.0F38.W0 BA /r B VIV AVX512F Multiply packed single-precision floating-point values 


from zmm2 and zmm3/m512/m32bcst, subtract zmm1 
and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a set of SIMD multiply-subtract computation on packed single-precision floating-point values using three 
source operands and writes the multiply-subtract results in the destination operand. The destination operand is 
also the first source operand. The second operand must be a SIMD register. The third source operand can be a 
SIMD register or a memory location. 


VFMSUB132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand. From the infinite precision intermediate result, subtracts the four, eight or sixteen packed single-precision 
floating-point values in the second source operand, performs rounding and stores the resulting four, eight or 
sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFMSUB213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the first source 
operand. From the infinite precision intermediate result, subtracts the four, eight or sixteen packed single-precision 
floating-point values in the third source operand, performs rounding and stores the resulting four, eight or sixteen 
packed single-precision floating-point values to the destination operand (first source operand). 


VFMSUB231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 

source to the four, eight or sixteen packed single-precision floating-point values in the third source operand. From 
the infinite precision intermediate result, subtracts the four, eight or sixteen packed single-precision floating-point 
values in the first source operand, performs rounding and stores the resulting four, eight or sixteen packed single- 
precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 


VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 
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Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 


rounding). 


VFMSUB132PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(DEST[n+31 :n]*SRC3[n+3 1:n] - SRC2[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUB213PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*DEST[n+31:n] - SRC3[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFMSUB231PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(SRC2[n+31 :n]*SRC3[n+31:n] - DEST[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFMSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
RoundFPControl(DEST[i+31:i]*SRC3[i+31:i] - SRC2[i+3 1:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+31:i]*SRC3[3 1:0] - SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(DEST[i+3 1:i]*SRC3[i+3 1:1] - SRC2[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+3 1:i] - SRC3[i+31:i]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+3 1:i] - SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*DEST[i+3 1:i] - SRC3[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFMSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*SRC3[i+31:i] - DEST[i+3 1:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFMSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+31:i]*SRC3[3 1:0] - DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(SRC2[i+3 1:i]*SRC3[i+31:i] - DEST[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBxxxPS __m512_mm512_fmsub_ps(__m512 a,__m512b,__m512 c); 

VFMSUBxxxPS __m512_mm512_fmsub_round_ps(__m512 a,__m512b,__m512¢, intr); 
VFMSUBxxxPS __m512_mm512_mask_fmsub_ps(__m512 a,__ mmask16k,__m512b,__m512 c); 
VFMSUBxxxPS __m512_mm512_maskz_fmsub_ps(__mmask16 k,__m512 a,__m512b,__m512 c); 
VFMSUBxxxPS __m512_mm512_mask3_fmsub_ps(__m512 a,__m512b,__m512 c,__mmask16 k); 
VFMSUBxxxPS __m512_mm512_mask_fmsub_round_ps(__m512 a,__mmask16k,__m512b, 


VFMSUBxxxPS __m256 _mm256_mask_fmsub_ps(__m256 a,__ mmask8 k,__m256 b,__m256 c); 
VFMSUBxxxPS __m256 __mm256_maskz_fmsub_ps(__mmask8 k,__m256 a,__m256 b,__m256 c); 
VFMSUBxxxPS __m256 _mm256_mask3_fmsub_ps(__m256 a,__m256 b,__m256 c,__ mmask8 k); 
VFMSUBxxxPS __m128 _mm_mask_fmsub_ps(__m128 a,__mmask8 k,__m128b,__m128 c); 
VFMSUBxxxPS __m128 _mm_maskz_fmsub_ps(__mmask8 k,_m128 a,__m128b,__m128 c); 
VFMSUBxxxPS __m128 _mm_mask3_fmsub_ps(__m128a,__m128b,__m128c,__mmask8 k); 
VFMSUBxxxPS __m128 _mm_fmsub_ps (__m128a,__m128b,__m128 c); 

VFMSUBxxxPS __m256 __mm256_fmsub_ps (_m256 a,__m256 b,__m256 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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m512 ¢, intr); 
VFMSUBxxxPS __m512_mm512_maskz_fmsub_round_ps(__mmask16 k,__m512 a,__m512b,__m512¢, int r); 
VFMSUBxxxPS __m512_mm512_mask3_fmsub_round_ps(__m512 a,__m512b,__m512c,__mmask16 k, int r); 
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VFMSUB132SD/VFMSUB213SD/VFMSUB231SD—Fused Multiply-Subtract of Scalar Double- 
Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
VEX.LIG.66.0F38.W1 9B /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFMSUB132SD xmm1, xmm2, xmm1 and xmm3/m64, subtract xmm2 and put result in 
xmm3/m64 xmm1. 
VEX.LIG.66.0F38.W1 AB /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFMSUB213SD xmm1, xmm2, xmm1 and xmmd2, subtract xmm3/m64 and put result in 
xmm3/m64 xmm1. 
VEX.LIG.66.0F38.W1 BB /r A VIN FMA Multiply scalar double-precision floating-point value from 
VFMSUB231SD xmm1, xmm2, xmme2 and xmm3/m64, subtract xmm1 and put result in 
xmm3/m64 xmm1. 
EVEX.LLIG.66.0F38.W1 9B /r B VIV AVX512F | Multiply scalar double-precision floating-point value from 
VFMSUB132SD xmm1 {k1}{Z}, xmm1 and xmm3/m64, subtract xmm2 and put result in 
xmm2, xmm3/m64{er} xmm1. 
EVEX.LLIG.66.0F38.W1 AB /r B VIV AVX512F | Multiply scalar double-precision floating-point value from 
VFMSUB213SD xmm1 {k1}{Z}, xmm1 and xmmd2, subtract xmm3/m64 and put result in 
xmm2, xmm3/m64{er} xmm1. 
EVEX.LLIG.66.0F38.W1 BB /r B VIV AVX512F | Multiply scalar double-precision floating-point value from 
VFMSUB231SD xmm1 {k1}{Z}, xmm_2 and xmm3/m64, subtract xmm1 and put result in 
xmm2, xmm3/m64{er} xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD multiply-subtract computation on the low packed double-precision floating-point values using 
three source operands and writes the multiply-subtract result in the destination operand. The destination operand 
is also the first source operand. The second operand must be a XMM register. The third source operand can be a 
XMM register or a 64-bit memory location. 


VFMSUB132SD: Multiplies the low packed double-precision floating-point value from the first source operand to the 
low packed double-precision floating-point value in the third source operand. From the infinite precision interme- 
diate result, subtracts the low packed double-precision floating-point values in the second source operand, 
performs rounding and stores the resulting packed double-precision floating-point value to the destination operand 
(first source operand). 


VFMSUB213SD: Multiplies the low packed double-precision floating-point value from the second source operand to 
the low packed double-precision floating-point value in the first source operand. From the infinite precision inter- 
mediate result, subtracts the low packed double-precision floating-point value in the third source operand, 
performs rounding and stores the resulting packed double-precision floating-point value to the destination operand 
(first source operand). 


VFMSUB231SD: Multiplies the low packed double-precision floating-point value from the second source to the low 
packed double-precision floating-point value in the third source operand. From the infinite precision intermediate 
result, subtracts the low packed double-precision floating-point value in the first source operand, performs 
rounding and stores the resulting packed double-precision floating-point value to the destination operand (first 
source operand). 


VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX. vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:64 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low quadword element of the destination is updated according to the writemask. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 


column. 


Operation 


In the operations below, “*” and “-" symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 


rounding). 


VFMSUB132SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(DEST[63:0]*SRC3[63:0] - SRC2[63:0]) 


ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFMSUB213SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(SRC2[63:0]*DEST[63:0] - SRC3[63:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 
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VFMSUB231SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(SRC2[63:0]*SRC3[63:0] - DEST[63:0]) 
ELSE 


IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[63:0] := 0 
Fl; 
Fl; 
DEST[1 27:64] := DEST[1 27:64] 
DEST[MAXVL-1:128] := 0 


VFMSUB132SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(DEST[63:0]*SRC3[63:0] - SRC2[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


VFMSUB213SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*DEST[63:0] - SRC3[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


VFMSUB231SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(SRC2[63:0]*SRC3[63:0] - DEST[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBxxxSD __m128d_mm_fmsub_round_sd(__m128d a,_m128db,__m128d., int r); 

VFMSUBxxxSD __m128d __mm_mask_fmsub_sd(__m128d a,___mmask8 k,__m128d b,___m128d c); 
VFMSUBxxxSD __m128d _mm_maskz_fmsub_sd(__mmask8 k,__m128d a,__m128db,__m128d c); 
VFMSUBxxxSD __m128d _mm_mask3_fmsub_sd(__m128d a,__m128db,__m128dc,__ mmask8 k); 


VFMSUBxxxSD __m128d_mm_mask_fmsub_round_sd(__m128d a, ___mmask8 k,__m128db,__m128dc, int r); 


VFMSUBxxxSD __m128d __mm_maskz_fmsub_round_sd(__mmask8 k,___m128da,__m128d b, 
VFMSUBxxxSD __m128d _mm_mask3_fmsub_round_sd(__m128d a,__m128db,__m128dc, 
VFMSUBxxxSD __m128d_mm_fmsub_sd (__m128d a,__m128d b,__m128d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 


m128d ¢, int r); 
mmask8 k, int r); 
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VFMSUB132SS/VFMSUB213SS/VFMSUB231SS—Fused Multiply-Subtract of Scalar Single- 
Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
VEX.LIG.66.0F38.W0O 9B /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFMSUB132SS xmm1, xmm2, xmm1 and xmm3/m32, subtract xmm2 and put result in 
xmm3/m32 xmm1. 
VEX.LIG.66.0F38.W0 AB /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFMSUB213SS xmm1, xmm2, xmm1 and xmmd2, subtract xmm3/m32 and put result in 
xmm3/m32 xmm1. 
VEX.LIG.66.0F38.WO BB /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFMSUB231SS xmm1, xmm2, xmme2 and xmm3/m32, subtract xmm1 and put result in 
xmm3/m32 xmm1. 
EVEX.LLIG.66.0F38.W0 9B /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFMSUB132SS xmm1 {k1}{Z}, xmm1 and xmm3/m32, subtract xmm2 and put result in 
xmme2, xmm3/m32{er} xmm1. 
EVEX.LLIG.66.0F38.W0 AB /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFMSUB213SS xmm1 {k1}{Z}, xmm1 and xmmd2, subtract xmm3/m32 and put result in 
xmme2, xmm3/m32{er} xmm1. 
EVEX.LLIG.66.0F38.W0 BB /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFMSUB231SS xmm1 {k1}{z}, xmme2 and xmm3/m32, subtract xmm1 and put result in 
xmm2, xmm3/m32{er} xmm1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD multiply-subtract computation on the low packed single-precision floating-point values using 
three source operands and writes the multiply-subtract result in the destination operand. The destination operand 
is also the first source operand. The second operand must be a XMM register. The third source operand can be a 
XMM register or a 32-bit memory location. 


VFMSUB132SS: Multiplies the low packed single-precision floating-point value from the first source operand to the 
low packed single-precision floating-point value in the third source operand. From the infinite precision interme- 
diate result, subtracts the low packed single-precision floating-point values in the second source operand, 
performs rounding and stores the resulting packed single-precision floating-point value to the destination operand 
(first source operand). 


VFMSUB213SS: Multiplies the low packed single-precision floating-point value from the second source operand to 
the low packed single-precision floating-point value in the first source operand. From the infinite precision interme- 
diate result, subtracts the low packed single-precision floating-point value in the third source operand, performs 
rounding and stores the resulting packed single-precision floating-point value to the destination operand (first 
source operand). 


VFMSUB231SS: Multiplies the low packed single-precision floating-point value from the second source to the low 
packed single-precision floating-point value in the third source operand. From the infinite precision intermediate 
result, subtracts the low packed single-precision floating-point value in the first source operand, performs rounding 
and stores the resulting packed single-precision floating-point value to the destination operand (first source 
operand). 


VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:32 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low doubleword element of the destination is updated according to the writemask. 
Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFMSUB132SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := RoundFPControl(DEST[31:0]*SRC3[3 1:0] - SRC2[31:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[127:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 


VFMSUB213SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := RoundFPControl(SRC2[31:0]*DEST[31:0] - SRC3[31:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 
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VFMSUB231SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 

IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(SRC2[3 1:0]*SRC3[63:0] - DEST[31:0]) 
ELSE 


IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 


THEN DEST[31:0] := 0 
Fl; 
Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:1 28] := 0 


VFMSUB132SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(DEST[31:0]*SRC3[31:0] - SRC2[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] = 0 


VFMSUB213SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(SRC2[31:0]*DEST[31:0] - SRC3[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] = 0 


VFMSUB231SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(SRC2[31:0]*SRC3[31:0] - DEST[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] = 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFMSUBxxxSS __m128_mm_fmsub_round_ss(__m128 a,__m128b,__m128c, int r); 

VFMSUBxxxSS __m128_mm_mask_fmsub_ss(__m128 a,__mmask8 k,__m128 b,__m128 c); 
VFMSUBxxxSS __m128 _mm_maskz_fmsub_ss(__mmask8 k,_m128 a,__m128b,__m128 c); 
VFMSUBxxxSS __m128_mm_mask3_fmsub_ss(__m128 a,__m128b,__m128c,__mmask8 k); 
VFMSUBxxxSS __m128 __mm_mask_fmsub_round_ss(__m128 a,__ mmask8 k,__m128b,__m128c, int r); 
VFMSUBxxxSS __m128 __mm_maskz_fmsub_round_ss(__mmask8 k,__m128 a,__m128b,__m128c, intr); 
VFMSUBxxxSS __m128 _mm_mask3_fmsub_round_ss(__m128 a,__m128b,__m128c,__mmask8 k, int r); 
VFMSUBxxxSS __m128_mm_fmsub_ss (_m128a,__m128b,__m128 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFNMADD132PD/VFNMADD213PD/VFNMADD231PD—Fused Negative Multiply-Add of Packed 
Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
VEX.128.66.0F38.W1 9C /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD132PD xmm1, xmm2, xmm1 and xmm3/mem, negate the multiplication result 
xmm3/m128 and add to xmm2 and put result in xmm1. 
VEX.128.66.0F38.W1 AC /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD213PD xmm1, xmm2, xmm1 and xmm2, negate the multiplication result and add 
xmm3/m128 to xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W1 BC /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD231PD xmm1, xmm2, xmme2 and xmm3/mem, negate the multiplication result 
xmm3/m128 and add to xmm1 and put result in xmm1. 
VEX.256.66.0F38.W1 9C /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD132PD ymm1, ymm2, ymm1 and ymm3/mem, negate the multiplication result and 
ymm3/m256 add to ymm2 and put result in ymm1. 
VEX.256.66.0F38.W1 AC /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD213PD ymm1, ymm2, ymm1 and ymm2, negate the multiplication result and add 
ymm3/m256 to ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.W1 BC /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMADD231PD ymm1, ymm2, ymm2 and ymm3/mem, negate the multiplication result and 
ymm3/m256 add to ymm1 and put result in ymm1. 
EVEX.128.66.0F38.W1 SC /r B VV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD132PD xmm0 {k1}{z}, AVX512F xmm1 and xmm3/m128/m64bcst, negate the 
xmm1, xmm2/m128/m64bcst multiplication result and add to xmm2 and put result in 
xmm1. 
EVEX.128.66.0F38.W1 AC /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD213PD xmm1 {k1}{Z}, AVX512F xmm1 and xmm2, negate the multiplication result and add 
xmm2, xmm3/m128/m64bcst to xmm3/m128/m64bcst and put result in xmm1. 
EVEX.128.66.0F38.W1 BC /r B VV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD231PD xmm1 {k1}{Z}, AVX512F xmme2 and xmm3/m1 28/m64bcst, negate the 
xmm2, xmm3/m128/m64bcst multiplication result and add to xmm1 and put result in 
xmm1. 
EVEX.256.66.0F38.W1 SC /r B VV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD132PD ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m64bcst, negate the 
ymm2, ymm3/m256/m64bcst multiplication result and add to ymm2 and put result in 
ymm1. 
EVEX.256.66.0F38.W1 AC /r B VV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD213PD ymm1 {k1}{Z}, AVX512F ymm1 and ymm2, negate the multiplication result and add 
ymm2, ymm3/m256/m64bcst to ymm3/m256/m64bcst and put result in ymm1. 
EVEX.256.66.0F38.W1 BC /r B VV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMADD231PD ymm1 {k1}{Z}, AVX512F ymme and ymm3/m256/m64bcst, negate the 
ymme2, ymm3/m256/m64bcst multiplication result and add to ymm1 and put result in 
ymm1. 
EVEX.512.66.0F38.W1 SC /r B VV AVX512F Multiply packed double-precision floating-point values from 
VFNMADD132PD zmm1 {k1}{z}, zmm1 and zmm3/m512/m64bcst, negate the multiplication 
zmm2, zmm3/m512/m64bcst{er} result and add to zmm2 and put result in zmm1. 
EVEX.512.66.0F38.W1 AC /r B VV AVX512F Multiply packed double-precision floating-point values from 
VFNMADD213PD zmm1 {k1}{z}, zmm1 and zmmz, negate the multiplication result and add 
zmm2, zmm3/m512/m64bcst{er} to zmm3/m512/m64bcst and put result in zmm1. 
EVEX.512.66.0F38.W1 BC /r B VV AVX512F Multiply packed double-precision floating-point values from 


VFNMADD231PD zmm1 {k1}{Z}, 
zmm2, zmm3/m51 2/m64bcst{er} 


zmme2 and zmm3/m512/m64bcst, negate the multiplication 
result and add to zmm1 and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMADD132PD: Multiplies the two, four or eight packed double-precision floating-point values from the first 
source operand to the two, four or eight packed double-precision floating-point values in the third source operand, 
adds the negated infinite precision intermediate result to the two, four or eight packed double-precision floating- 
point values in the second source operand, performs rounding and stores the resulting two, four or eight packed 
double-precision floating-point values to the destination operand (first source operand). 


VFNMADD213PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source operand to the two, four or eight packed double-precision floating-point values in the first source operand, 
adds the negated infinite precision intermediate result to the two, four or eight packed double-precision floating- 
point values in the third source operand, performs rounding and stores the resulting two, four or eight packed 
double-precision floating-point values to the destination operand (first source operand). 


VFNMADD231PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source to the two, four or eight packed double-precision floating-point values in the third source operand, the 
negated infinite precision intermediate result to the two, four or eight packed double-precision floating-point 
values in the first source operand, performs rounding and stores the resulting two, four or eight packed double- 
precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 

VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 


VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 
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VFNMADD132PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(-(DEST[n+63:n]*SRC3[n+63:n]) + SRC2[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMADD213PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(-(SRC2[n+63:n]*DEST[n+63:n]) + SRC3[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMADD231PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR(-(SRC2[n+63:n]*SRC3[n+63:n]) + DEST[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFNMADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(DEST[i+63:i]*SRC3[i+63:i]) + SRC2[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFNMADD132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(DEST[i+63:i]*SRC3[63:0]) + SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(DEST[i+63:i]*SRC3[i+63:i]) + SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFNMADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(SRC2[i+63:i]*DEST[i+63:i]) + SRC3[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFNMADD213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*DEST[i+63:i]) + SRC3[63:0]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*DEST[i+63:i]) + SRC3[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFNMADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(SRC2[i+63:i]*SRC3[i+63:i]) + DEST[i+63:i]) 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VFNMADD231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*SRC3[63:0]) + DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*SRC3[i+63:i]) + DEST[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VFNMADDxxxPD __m512d_mm512_fnmadd_pd(__m512da,__m512db,___m512dc); 

VFNMADDxxxPD __m512d_mm512_fnmadd_round_pd(__m512da,__m512db,__m512dc, int r); 

VFNMADDxxxPD __m512d_mm512_mask_fnmadd_pd(__m512d a,__ mmask8 k,__m512db,_m512d c); 
VFNMADDxxxPD __m512d_mm512_maskz_fnmadd_pd(__mmask8 k,__m512da,__m512db,__m512d c); 
VFNMADDxxxPD __m512d_mm512_mask3_fnmadd_pd(__m512da,__m512db,__m512dc,__ mmask8 k); 
VFNMADDxxxPD __m512d_mm512_mask_fnmadd_round_pd(__m512d a,__mmask8k,_m512db,__m512dc, int r); 
VFNMADDxxxPD __m512d_mm512_maskz_fnmadd_round_pd(__mmask8 k,__m512da,__m512db,__m512dc, int r); 
VFNMADDxxxPD __m512d_mm512_mask3_fnmadd_round_pd(__m512da,__m512db,__m512dc,___mmask8 k, int r); 
VFNMADDxxxPD __m256d_mm256_mask_fnmadd_pd(__m256d a, ___ mmask8 k,__ m256d b,___m256d c); 
VFNMADDxxxPD __m256d __mm256_maskz_fnmadd_pd(__mmask8 k,__m256d a,__m256db,__ m256d c); 
VFNMADDxxxPD __m256d__mm256_mask3_fnmadd_pd(__m256d a,__ m256d b,__ m256dc,___ mmask8 k); 
VFNMADDxxxPD __m128d __mm_mask_fnmadd_pd(__m128d a,__ mmask8 k,__m128d b,___m128d c); 
VFNMADDxxxPD __m128d __mm_maskz_fnmadd_pd(__mmask8 k,___m128d a,__m128d b,___m128d c); 
VFNMADDxxxPD __m128d __mm_mask3_fnmadd_pd(__m128d a,__m128d b,_m128d c, __mmask8 k); 
VFNMADDxxxPD __m128d_mm_fnmadd_pd (__m128d a,__m128db,__m128d c); 

VFNMADDxxxPD __m256d_mm256_fnmadd_pd (__m256d a,__m256d b,___m256d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VFNMADD132PS/VFNMADD213PS/VFNMADD231PS—Fused Negative Multiply-Add of Packed 
Single-Precision Floating-Point Values 


VFNMADD231PS zmm1 {k1}{Z}, 
zmm2, zmm3/m51 2/m32bcst{er} 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.128.66.0F38.W0 SC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD132PS xmm1, xmm2, xmm1 and xmm3/mem, negate the multiplication result 
xmm3/m128 and add to xmm_2 and put result in xmm1. 
VEX.128.66.0F38.W0 AC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD213PS xmm1, xmm_2, xmm1 and xmm2, negate the multiplication result and add 
xmm3/m128 to xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W0 BC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD231PS xmm1, xmm2, xmm2 and xmm3/mem, negate the multiplication result 
xmm3/m128 and add to xmm1 and put result in xmm1. 
VEX.256.66.0F38.W0 SC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD132PS ymm1, ymm2, ymm1 and ymm3/mem, negate the multiplication result 
ymm3/m256 and add to ymm2 and put result in ymm1. 
VEX.256.66.0F38.W0 AC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD213PS ymm1, ymm2, ymm1 and ymm2, negate the multiplication result and add 
ymm3/m256 to ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.0 BC /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMADD231PS ymm1, ymm2, ymm2 and ymm3/mem, negate the multiplication result and 
ymm3/m256 add to ymm1 and put result in ymm1. 
EVEX.128.66.0F38.WO SC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD132PS xmm1 {k1}{Z}, AVX512F xmm1 and xmm3/m128/m32bcst, negate the multiplication 
xmm2, xmm3/m128/m32bcst result and add to xmm2 and put result in xmm1. 
EVEX.128.66.0F38.WO AC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD213PS xmm1 {k1}{Z}, AVX512F xmm1 and xmm_2, negate the multiplication result and add 
xmm2, xmm3/m128/m32bcst to xmm3/m128/m32bcst and put result in xmm1. 
EVEX.128.66.0F38.WO BC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD231PS xmm1 {k1}{Z}, AVX512F xmme2 and xmm3/m128/m32bcst, negate the multiplication 
xmm2, xmm3/m128/m32bcst result and add to xmm1 and put result in xmm1. 
EVEX.256.66.0F38.WO SC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD132PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m3 2bcst, negate the multiplication 
ymm_2, ymm3/m256/m32bcst result and add to ymm2 and put result in ymm1. 
EVEX.256.66.0F38.WO AC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD213PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm2, negate the multiplication result and add 
ymme2, ymm3/m256/m32bcst to ymm3/m256/m32bcst and put result in ymm1. 
EVEX.256.66.0F38.WO BC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD231PS ymm1 {k1}{Z}, AVX512F ymme and ymm3/m256/m3 2bcst, negate the multiplication 
ymm_2, ymm3/m256/m32bcst result and add to ymm1 and put result in ymm1. 
EVEX.512.66.0F38.WO SC /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMADD132PS zmm1 {k1}{Z}, AVX512F zmm1 and zmm3/m51 2/m32bcst, negate the multiplication 
zmm2, zmm3/m51 2/m32bcst{er} result and add to zmm2 and put result in zmm1. 
EVEX.512.66.0F38.WO AC /r B VIV AVX512F Multiply packed single-precision floating-point values from 
VFNMADD213PS zmm1 {k1}{Z}, zmm1 and zmm2, negate the multiplication result and add 
zmm2, zmm3/m51 2/m32bcst{er} to zmm3/m512/m32bcst and put result in zmm1. 
EVEX.512.66.0F38.WO BC /r B VIV AVX512F Multiply packed single-precision floating-point values from 


zmme2 and zmm3/m51 2/m32bcst, negate the multiplication 
result and add to zmm1 and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMADD132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand, adds the negated infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the second source operand, performs rounding and stores the resulting four, eight or 
sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFNMADD213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the first source 
operand, adds the negated infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the third source operand, performs rounding and stores the resulting the four, eight or 
sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFNMADD231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand, adds the negated infinite precision intermediate result to the four, eight or sixteen packed single-precision 
floating-point values in the first source operand, performs rounding and stores the resulting four, eight or sixteen 
packed single-precision floating-point values to the destination operand (first source operand). 

EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 

VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 

VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFNMADD132PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(- (DEST[n+31:n]*SRC3[n+3 1 :n]) + SRC2[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:1 28] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFNMADD213PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(- (SRC2[n+31:n]*DEST[n+31:n]) + SRC3[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMADD231PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR(- (SRC2[n+31:n]*SRC3[n+31:n]) + DEST[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(-(DEST[i+3 1 :i]*SRC3[i+31:i]) + SRC2[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMADD132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(DEST[i+31:i]*SRC3[31:0]) + SRC2[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(DEST[i+3 1 :i]*SRC3[i+31:i]) + SRC2[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := 
RoundFPControl(-(SRC2[i+3 1 :i]*DEST[i+31:i]) + SRC3[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VFNMADD213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+31 :iJ*DEST[i+3 1:i]) + SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*DEST[i+31:i]) + SRC3[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(-(SRC2[i+31:i]*SRC3[i+31:i]) + DEST[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMADD231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+31:i]*SRC3[31:0]) + DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*SRC3[i+31:i]) + DEST[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMADDxxxPS __m512_mm512_fnmadd_ps(__m512 a,__m512b,__m512c); 

VFNMADDxxxPS __m512_mm512_fnmadd_round_ps(__m512 a,__m512b,__m512¢, intr); 

VFNMADDxxxPS __m512_mm512_mask_fnmadd_ps(__m512 a,__mmask16 k,__m512b,__m512 c); 
VFNMADDxxxPS __m512_mm512_maskz_fnmadd_ps(__mmask16 k,__m512a,__m512b,__m512 c); 
VFNMADDxxxPS __m512_mm512_mask3_fnmadd_ps(__m512 a,__m512b,__m512c,__mmask16 k); 
VFNMADDxxxPS __m512_mm512_mask_fnmadd_round_ps(__m512 a,__mmask16k,__m512b,__m512, int r); 
VFNMADDxxxPS __m512_mm512_maskz_fnmadd_round_ps(__mmask16 k,__m512 a,__m512b,__m512¢, intr); 
VFNMADDxxxPS __m512_mm512_mask3_fnmadd_round_ps(__m512 a,__m512b,__m512c,__mmask16 k, int r); 
VFNMADDxxxPS __m256 __mm256_mask_fnmadd_ps(__m256 a, ___mmask8 k,__m256 b, __m256 c); 
VFNMADDxxxPS __m256 _mm256_maskz_fnmadd_ps(__mmask8 k,__m256 a,__m256b,__m256 c); 
VFNMADDxxxPS __m256 __mm256_mask3_fnmadd_ps(__m256 a,__m256 b,__m256 c,__mmask8 k); 
VFNMADDxxxPS __m128_mm_mask_fnmadd_ps(__m128 a,__mmask8 k,__m128b,__m128 c); 

VFNMADDxxxPS __m128 _mm_maskz_fnmadd_ps(__mmask8 k,__m128a,__m128b,__m128 c); 
VFNMADDxxxPS __m128 _mm_mask3_fnmadd_ps(__m128 a,__m128b,__m128c,___mmask8 k); 
VFNMADDxxxPS __m128_mm_fnmadd_ps (__m128 a,__m128b,__m128 c); 

VFNMADDxxxPS __m256 __mm256_fnmadd_ps (__m256 a,__m256 b,_m256 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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VFNMADD132SD/VFNMADD213SD/VFNMADD231SD—Fused Negative Multiply-Add of Scalar 


Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.LIG.66.0F38.W1 SD /r A VIN FMA Multiply scalar double-precision floating-point value from 
VFNMADD132SD xmm1, xmm2z, xmm1 and xmm3/mem, negate the multiplication result and 
xmm3/m64 add to xmm2 and put result in xmm1. 
VEX.LIG.66.0F38.W1 AD /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFNMADD213SD xmm1, xmm2, xmm1 and xmm2, negate the multiplication result and add to 
xmm3/m64 xmm3/mem and put result in xmm1. 
VEX.LIG.66.0F38.W1 BD /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFNMADD231SD xmm1, xmm2, xmm2 and xmm3/mem, negate the multiplication result and 
xmm3/m64 add to xmm1 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 9D /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMADD132SD xmm1 {k1}{Z}, xmm1 and xmm3/m64, negate the multiplication result and 
xmm2, xmm3/m64{er} add to xmm2 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 AD /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMADD213SD xmm1 {k1}{Z}, xmm1 and xmm2, negate the multiplication result and add to 
xmm2, xmm3/m64{er} xmm3/m64 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 BD /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMADD231SD xmm1 {k1}{Z}, xmm2 and xmm3/m64, negate the multiplication result and 
xmm2, xmm3/m64{er} add to xmm1 and put result in xmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMADD132SD: Multiplies the low packed double-precision floating-point value from the first source operand to 
the low packed double-precision floating-point value in the third source operand, adds the negated infinite preci- 
sion intermediate result to the low packed double-precision floating-point values in the second source operand, 
performs rounding and stores the resulting packed double-precision floating-point value to the destination operand 
(first source operand). 


VFNMADD213SD: Multiplies the low packed double-precision floating-point value from the second source operand 
to the low packed double-precision floating-point value in the first source operand, adds the negated infinite preci- 
sion intermediate result to the low packed double-precision floating-point value in the third source operand, 
performs rounding and stores the resulting packed double-precision floating-point value to the destination operand 
(first source operand). 


VFNMADD231SD: Multiplies the low packed double-precision floating-point value from the second source to the low 
packed double-precision floating-point value in the third source operand, adds the negated infinite precision inter- 
mediate result to the low packed double-precision floating-point value in the first source operand, performs 
rounding and stores the resulting packed double-precision floating-point value to the destination operand (first 
source operand). 

VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 


The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:64 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low quadword element of the destination is updated according to the writemask. 
Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 
rounding). 


VFNMADD132SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(-(DEST[63:0]*SRC3[63:0]) + SRC2[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFNMADD213SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(-(SRC2[63:0]*DEST[63:0]) + SRC3[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 
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VFNMADD231SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[63:0] := RoundFPControl(-(SRC2[63:0]*SRC3[63:0]) + DEST[63:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFNMADD132SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (DEST[63:0]*SRC3[63:0]) + SRC2[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


VFNMADD213SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (SRC2[63:0]*DEST[63:0]) + SRC3[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


VFNMADD231SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (SRC2[63:0]*SRC3[63:0]) + DEST[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] = 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMADDxxxSD __m128d __mm_fnmadd_round_sd(__m128d a,__m128db,__m128dc, int r); 

VFNMADDxxxSD __m128d _mm_mask_fnmadd_sd(__m128d a, ___mmask8 k,__m128d b,__m128d c); 
VFNMADDxxxSD __m128d _mm_maskz_fnmadd_sd(__mmask8 k,__m128d a,_m128db, ___m128d c); 
VFNMADDxxxSD __m128d _mm_mask3_fnmadd_sd(__m128d a,__m128db,__m128dc,__mmask8 k); 
VFNMADDxxxSD __m128d _mm_mask_fnmadd_round_sd(__m128d a, ___ mmask8 k,__m128db,__m128dc, int r); 
VFNMADDxxxSD __m128d _mm_maskz_fnmadd_round_sd(__mmask8 k,__m128da,__m128db,__m128d, int r); 
VFNMADDxxxSD __m128d _mm_mask3_fnmadd_round_sd(__m128d a,__m128db,__m128dc,__mmask8 k, int r); 
VFNMADDxxxSD __m128d _mm_fnmadd_sd (__m128da,__m128db,__m128d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFNMADD132SS/VFNMADD213SS/VFNMADD231SS—Fused Negative Multiply-Add of Scalar 
Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
VEX.LIG.66.0F38.W0 9D /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMADD132SS xmm1, xmm2, xmm1 and xmm3/m32, negate the multiplication result 
xmm3/m32 and add to xmm2 and put result in xmm1. 
VEX.LIG.66.0F38.W0 AD /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMADD213SS xmm1, xmm2, xmm1 and xmm2, negate the multiplication result and 
xmm3/m32 add to xmm3/m32 and put result in xmm1. 
VEX.LIG.66.0F38.W0 BD /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMADD231SS xmm1, xmm2, xmme2 and xmm3/m32, negate the multiplication result 
xmm3/m32 and add to xmm1 and put result in xmm1. 
EVEX.LLIG.66.0F38.W0 9D /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFNMADD132SS xmm1 {k1}{Z}, xmm1 and xmm3/m32, negate the multiplication result 
xmm2, xmm3/m32{er} and add to xmm2 and put result in xmm1. 
EVEX.LLIG.66.0F38.W0 AD /r B VV AVX512F Multiply scalar single-precision floating-point value from 
VFNMADD213SS xmm1 {k1}{Z}, xmm1 and xmm2, negate the multiplication result and 
xmm2, xmm3/m32{er} add to xmm3/m32 and put result in xmm1. 
EVEX.LLIG.66.0F38.W0 BD /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFNMADD231SS xmm1 {k1}{Z}, xmme2 and xmm3/m32, negate the multiplication result 
xmm2, xmm3/m32{er} and add to xmm1 and put result in xmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMADD132SS: Multiplies the low packed single-precision floating-point value from the first source operand to 
the low packed single-precision floating-point value in the third source operand, adds the negated infinite precision 
intermediate result to the low packed single-precision floating-point value in the second source operand, performs 
rounding and stores the resulting packed single-precision floating-point value to the destination operand (first 
source operand). 


VFNMADD213SS: Multiplies the low packed single-precision floating-point value from the second source operand to 
the low packed single-precision floating-point value in the first source operand, adds the negated infinite precision 
intermediate result to the low packed single-precision floating-point value in the third source operand, performs 
rounding and stores the resulting packed single-precision floating-point value to the destination operand (first 
source operand). 


VFNMADD231SS: Multiplies the low packed single-precision floating-point value from the second source operand to 
the low packed single-precision floating-point value in the third source operand, adds the negated infinite precision 
intermediate result to the low packed single-precision floating-point value in the first source operand, performs 
rounding and stores the resulting packed single-precision floating-point value to the destination operand (first 
source operand). 

VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 


The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:32 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low doubleword element of the destination is updated according to the writemask. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 


column. 


Operation 


In the operations below, “*” and “+” symbols represent multiplication and addition with infinite precision inputs and outputs (no 


rounding). 


VFNMADD132SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(-(DEST[3 1:0]*SRC3[31:0]) + SRC2[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 


VFNMADD213SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(-(SRC2[31:0]*DEST[31:0]) + SRC3[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 
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VFNMADD231SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := RoundFPControl(-(SRC2[3 1:0]*SRC3[63:0]) + DEST[31:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 


VFNMADD132SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(- (DEST[31:0]*SRC3[31:0]) + SRC2[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFNMADD213SS DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(- (SRC2[31:0]*DEST[31:0]) + SRC3[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFNMADD2315S DEST, SRC2, SRC3 (VEX encoded version) 

DEST[31:0] := RoundFPControl_MXCSR(- (SRC2[31:0]*SRC3[31:0]) + DEST[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMADDxxxSS __m128 _mm_fnmadd_round_ss(__m128 a,__m128b,__m128, int 1); 

VFNMADDxxxSS __m128 _mm_mask_fnmadd_ss(__m128 a,__mmask8 k,__m128b,__m128 c); 
VFNMADDxxxSS __m128 _mm_maskz_fnmadd_ss(__mmask8 k,_m128 a,__m128b,__m128 c); 
VFNMADDxxxSS __m128 _mm_mask3_fnmadd_ss(__m128 a,__m128b,__m128c,__mmask8 k); 
VFNMADDxxxSS __m128 _mm_mask_fnmadd_round_ss(__m128 a,__mmask8 k,__m128b,__m128 c, intr); 
VFNMADDxxxSS __m128 _mm_maskz_fnmadd_round_ss(__mmask8 k,__m128a,__m128b,__m128c, int r); 
VFNMADDxxxSS __m128 _mm_mask3_fnmadd_round_ss(__m128 a,__m128b,__m128c,__mmask8 k, int r); 
VFNMADDxxxSS __m128 __mm_fnmadd_ss (__m128 a,__m128b,__m128 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFNMSUB132PD/VFNMSUB213PD/VFNMSUB231PD—Fused Negative Multiply-Subtract of 
Packed Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
VEX.128.66.0F38.W1 9E /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB132PD xmm1, xmm2, xmm1 and xmm3/mem, negate the multiplication result 
xmm3/m128 and subtract xmm_2 and put result in xmm1. 
VEX.128.66.0F38.W1 AE /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB213PD xmm1, xmm2, xmm1 and xmmd2, negate the multiplication result and 
xmm3/m128 subtract xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W1 BE /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB231PD xmm1, xmm2, xmme2 and xmm3/mem, negate the multiplication result 
xmm3/m128 and subtract xmm1 and put result in xmm1. 
VEX.256.66.0F38.W1 9E /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB132PD ymm1, ymm2, ymm1 and ymm3/mem, negate the multiplication result and 
ymm3/m256 subtract ymm_2 and put result in ymm1. 
VEX.256.66.0F38.W1 AE /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB213PD ymm1, ymm2, ymm1 and ymm2, negate the multiplication result and 
ymm3/m256 subtract ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.W1 BE /r A VIV FMA Multiply packed double-precision floating-point values from 
VFNMSUB231PD ymm1, ymm2, ymme2 and ymm3/mem, negate the multiplication result and 
ymm3/m256 subtract ymm1 and put result in ymm1. 
EVEX.128.66.0F38.W1 9E /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB132PD xmm1 {k1}{Z}, AVX512F xmm1 and xmm3/m128/m64bcst, negate the 
xmm2, xmm3/m128/m64bcst multiplication result and subtract xmm_2 and put result in 
xmm1. 
EVEX.128.66.0F38.W1 AE /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB213PD xmm1 {k1}{Z}, AVX512F xmm1 and xmm2, negate the multiplication result and 
xmm2, xmm3/m128/m64bcst subtract xmm3/m128/m64bcst and put result in xmm1. 
EVEX.128.66.0F38.W1 BE /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB231PD xmm1 {k1}{Z}, AVX512F xmme2 and xmm3/m128/m64bcst, negate the 
xmm2, xmm3/m128/m64bcst multiplication result and subtract xmm1 and put result in 
xmm1. 
EVEX.256.66.0F38.W1 9E /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB132PD ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m64bcst, negate the 
ymmc2, ymm3/m256/m64bcst multiplication result and subtract ymm_2 and put result in 
ymm1. 
EVEX.256.66.0F38.W1 AE /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB213PD ymm1 {k1}{Z}, AVX512F ymm1 and ymmz2, negate the multiplication result and 
ymm_2, ymm3/m256/m64bcst subtract ymm3/m256/m64bcst and put result in ymm1. 
EVEX.256.66.0F38.W1 BE /r B VIV AVX512VL | Multiply packed double-precision floating-point values from 
VFNMSUB231PD ymm1 {k1}{Z}, AVX512F ymme2 and ymm3/m256/m64bcst, negate the 
ymm2, ymm3/m256/m64bcst multiplication result and subtract ymm1 and put result in 
ymm1. 
EVEX.512.66.0F38.W1 9E /r B VIV AVX512F Multiply packed double-precision floating-point values from 
VFNMSUB132PD zmm1 {k1}{z}, zmm1 and zmm3/m512/m64bcst, negate the multiplication 
zmm2, zmm3/m51 2/m64bcst{er} result and subtract zmm2 and put result in zmm1. 
EVEX.512.66.0F38.W1 AE /r B VIV AVX512F Multiply packed double-precision floating-point values from 
VFNMSUB213PD zmm1 {k1}{z}, zmm1 and zmm2, negate the multiplication result and 
zmm2, zmm3/m51 2/m64bcst{er} subtract zmm3/m512/m64bcst and put result in zmm1. 
EVEX.512.66.0F38.W1 BE /r B VIV AVX512F Multiply packed double-precision floating-point values from 
VFNMSUB231PD zmm1 {k1}{z}, zmme2 and zmm3/m512/m64bcst, negate the multiplication 
zmm2, zmm3/m51 2/m64bcst{er} result and subtract zmm1 and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMSUB132PD: Multiplies the two, four or eight packed double-precision floating-point values from the first 
source operand to the two, four or eight packed double-precision floating-point values in the third source operand. 
From negated infinite precision intermediate results, subtracts the two, four or eight packed double-precision 
floating-point values in the second source operand, performs rounding and stores the resulting two, four or eight 
packed double-precision floating-point values to the destination operand (first source operand). 


VFNMSUB213PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source operand to the two, four or eight packed double-precision floating-point values in the first source operand. 
From negated infinite precision intermediate results, subtracts the two, four or eight packed double-precision 
floating-point values in the third source operand, performs rounding and stores the resulting two, four or eight 
packed double-precision floating-point values to the destination operand (first source operand). 


VFNMSUB231PD: Multiplies the two, four or eight packed double-precision floating-point values from the second 
source to the two, four or eight packed double-precision floating-point values in the third source operand. From 
negated infinite precision intermediate results, subtracts the two, four or eight packed double-precision floating- 
point values in the first source operand, performs rounding and stores the resulting two, four or eight packed 
double-precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 

VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 

VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFNMSUB132PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR( - (DEST[n+63:n]*SRC3[n+63:n)) - SRC2[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFNMSUB213PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR( - (SRC2[n+63:n]*DEST[n+63:n]) - SRC3[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMSUB231PD DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 64%; 
DEST[n+63:n] := RoundFPControl_MXCSR( - (SRC2[n+63:n]*SRC3[n+63:n)) - DEST[n+63:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMSUB132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(DEST[i+63:i]*SRC3[i+63:i]) - SRC2[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


INSTRUCTION SET REFERENCE, V-Z 
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VFNMSUB132PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(DEST[i+63:i]*SRC3[63:0]) - SRC2[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(DEST[i+63:i]*SRC3[i+63:i]) - SRC2[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMSUB213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(SRC2[i+63:i]*DEST[i+63:i]) - SRC3[i+63:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMSUB213PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*DEST[i+63:i]) - SRC3[63:0]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*DEST[i+63:i]) - SRC3[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMSUB231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := 
RoundFPControl(-(SRC2[i+63:i]*SRC3[i+63:i]) - DEST[i+63:i]) 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMSUB231PD DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*SRC3[63:0]) - DEST[i+63:i]) 
ELSE 
DEST[i+63:i] := 
RoundFPControl_MXCSR(-(SRC2[i+63:i]*SRC3[i+63:i]) - DEST[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMSUBxxxPD __m512d_mm512_fnmsub_pd(__m512da,__m512d b, 
VFNMSUBxxxPD __m512d_mm512_fnmsub_round_pd(__m512da,__m512db,__m512dc, int r); 

VFNMSUBxxxPD __m512d_mm512_mask_fnmsub_pd(__m512da,__mmask8k,__m512db,__m512d c); 
VFNMSUBxxxPD __m512d_mm512_maskz_fnmsub_pd(__mmask8 k,__m512da,__m512db,__m512d c); 
VFNMSUBxxxPD __m512d_mm512_mask3_fnmsub_pd(__m512d a,__m512db,__m512dc,___mmask8 k); 
VFNMSUBxxxPD __m512d_mm512_mask_fnmsub_round_pd(__m512d a,__mmask8 k,__m512db,__m512dc, int r); 
VFNMSUBxxxPD __m512d_mm512_maskz_fnmsub_round_pd(__mmask8 k,__m512da,__m512db,__m512dc, intr); 
VFNMSUBxxxPD __m512d_mm512_mask3_fnmsub_round_pd(__m512da,__m512db,__m512dc,__mmask8 k, int r); 
VFNMSUBxxxPD __m256d__mm256_mask_fnmsub_pd(__m256d a,__mmask8 k,__m256d b,___ m256d c); 
VFNMSUBxxxPD __m256d__mm256_maskz_fnmsub_pd(__mmask8 k,__ m256d a,__m256d b,___m256d c); 
VFNMSUBxxxPD __m256d __mm256_mask3_fnmsub_pd(__m256d a,__m256d b,__m256d c,___mmask8 k); 
VFNMSUBxxxPD __m128d __mm_mask_fnmsub_pd(__m128d a, ___mmask8 k,__m128d b,___m128d c); 
VFNMSUBxxxPD __m128d __mm_maskz_fnmsub_pd(__mmask8 k,__m128d a,__m128db,__m128d c); 
VFNMSUBxxxPD __m128d_mm_mask3_fnmsub_pd(__m128d a,__m128db,__m128dc,__ mmask8 k); 
VFNMSUBxxxPD __m128d __mm_fnmsub_pd (__m128d a,__m128d b,__m128d c); 

VFNMSUBxxxPD __m256d_mm256_fnmsub_pd (__m256d a,__m256db, __ m256d c); 


m512d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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VFNMSUB132PS/VFNMSUB213PS/VFNMSUB231PS—Fused Negative Multiply-Subtract of 
Packed Single-Precision Floating-Point Values 


VFNMSUB231PS zmm1 {k1}{Z}, 
zmm2, zmm3/m51 2/m32bcstf{er} 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
VEX.128.66.0F38.W0 SE /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMSUB132PS xmm1, xmm2, xmm1 and xmm3/mem, negate the multiplication result and 
xmm3/m128 subtract xmme2 and put result in xmm1. 
VEX.128.66.0F38.W0 AE /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMSUB213PS xmm1, xmm2, xmm1 and xmmd2, negate the multiplication result and 
xmm3/m128 subtract xmm3/mem and put result in xmm1. 
VEX.128.66.0F38.W0 BE /r A VV FMA Multiply packed single-precision floating-point values from 
VFNMSUB231PS xmm1, xmm2, xmm2 and xmm3/mem, negate the multiplication result and 
xmm3/m128 subtract xmm1 and put result in xmm1. 
VEX.256.66.0F38.W0 SE /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMSUB132PS ymm1, ymm2, ymm1 and ymm3/mem, negate the multiplication result and 
ymm3/m256 subtract ymm_2 and put result in ymm1. 
VEX.256.66.0F38.W0 AE /r A VV FMA Multiply packed single-precision floating-point values from 
VFNMSUB213PS ymm1, ymm2, ymm1 and ymm2, negate the multiplication result and 
ymm3/m256 subtract ymm3/mem and put result in ymm1. 
VEX.256.66.0F38.0 BE /r A VIV FMA Multiply packed single-precision floating-point values from 
VFNMSUB231PS ymm1, ymm2, ymme2 and ymm3/mem, negate the multiplication result and 
ymm3/m256 subtract ymm1 and put result in ymm1. 
EVEX.128.66.0F38.WO SE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB132PS xmm1 {k1}{Z}, AVX512F xmm1 and xmm3/m128/m32bcst, negate the multiplication 
xmm2, xmm3/m128/m32bcst result and subtract xmm_2 and put result in xmm1. 
EVEX.128.66.0F38.W0 AE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB213PS xmm1 {k1}{Z}, AVX512F xmm1 and xmmd2, negate the multiplication result and 
xmm2, xmm3/m128/m32bcst subtract xmm3/m128/m32bcst and put result in xmm1. 
EVEX.128.66.0F38.WO BE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB231PS xmm1 {k1}{Z}, AVX512F xmm2 and xmm3/m128/m32bcst, negate the multiplication 
xmm2, xmm3/m128/m32bcst result subtract add to xmm1 and put result in xmm1. 
EVEX.256.66.0F38.WO SE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB132PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm3/m256/m32bcst, negate the multiplication 
ymm_2, ymm3/m256/m32bcst result and subtract ymm2 and put result in ymm1. 
EVEX.256.66.0F38.W0 AE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB213PS ymm1 {k1}{Z}, AVX512F ymm1 and ymm2, negate the multiplication result and 
ymm_2, ymm3/m256/m32bcst subtract ynm3/m256/m32bcst and put result in ymm1. 
EVEX.256.66.0F38.WO BE /r B VIV AVX512VL | Multiply packed single-precision floating-point values from 
VFNMSUB231PS ymm1 {k1}{Z}, AVX512F ymme and ymm3/m256/m32bcst, negate the multiplication 
ymm_2, ymm3/m256/m32bcst result subtract add to ymm1 and put result in ymm1. 
EVEX.512.66.0F38.WO SE /r B VV AVX512F Multiply packed single-precision floating-point values from 
VFNMSUB132PS zmm1 {k1}{z}, zmm1 and zmm3/m512/m32bcst, negate the multiplication 
zmm2, zmm3/m51 2/m32bcst{er} result and subtract zmm2 and put result in zmm1. 
EVEX.512.66.0F38.W0O AE /r B VV AVX512F Multiply packed single-precision floating-point values from 
VFNMSUB213PS zmm1 {k1}{z}, zmm1 and zmm2, negate the multiplication result and 
zmm2, zmm3/m51 2/m32bcst{er} subtract zmm3/m512/m32bcst and put result in zmm1. 
EVEX.512.66.0F38.WO BE /r B VV AVX512F Multiply packed single-precision floating-point values from 


zmme2 and zmm3/m512/m32bcst, negate the multiplication 
result subtract add to zmm1 and put result in zmm1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMSUB132PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the first 
source operand to the four, eight or sixteen packed single-precision floating-point values in the third source 
operand. From negated infinite precision intermediate results, subtracts the four, eight or sixteen packed single- 
precision floating-point values in the second source operand, performs rounding and stores the resulting four, eight 
or sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFNMSUB213PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source operand to the four, eight or sixteen packed single-precision floating-point values in the first source 
operand. From negated infinite precision intermediate results, subtracts the four, eight or sixteen packed single- 
precision floating-point values in the third source operand, performs rounding and stores the resulting four, eight 
or sixteen packed single-precision floating-point values to the destination operand (first source operand). 


VFNMSUB231PS: Multiplies the four, eight or sixteen packed single-precision floating-point values from the second 
source to the four, eight or sixteen packed single-precision floating-point values in the third source operand. From 
negated infinite precision intermediate results, subtracts the four, eight or sixteen packed single-precision floating- 
point values in the first source operand, performs rounding and stores the resulting four, eight or sixteen packed 
single-precision floating-point values to the destination operand (first source operand). 


EVEX encoded versions: The destination operand (also first source operand) and the second source operand are 
ZMM/YMM/XMM register. The third source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory loca- 
tion or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is condition- 
ally updated with write mask k1. 

VEX.256 encoded version: The destination operand (also first source operand) is a YMM register and encoded in 
reg_field. The second source operand is a YMM register and encoded in VEX.vvvv. The third source operand is a 
YMM register or a 256-bit memory location and encoded in rm_field. 

VEX.128 encoded version: The destination operand (also first source operand) is a XMM register and encoded in 
reg_field. The second source operand is a XMM register and encoded in VEX.vvvv. The third source operand is a 
XMM register or a 128-bit memory location and encoded in rm_field. The upper 128 bits of the YMM destination 
register are zeroed. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFNMSUB132PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i= 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR( - (DEST[n+31:n]*SRC3[n+31:n]) - SRC2[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 
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VFNMSUB213PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR( - (SRC2[n+31:n]*DEST[n+31:n]) - SRC3[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMSUB231PS DEST, SRC2, SRC3 (VEX encoded version) 
IF (VEX.128) THEN 
MAXNUM := 2 
ELSEIF (VEX.256) 
MAXNUM := 4 
Fl 
For i = 0 to MAXNUM-1 { 
n:= 32%; 
DEST[n+31:n] := RoundFPControl_MXCSR( - (SRC2[n+31:n]*SRC3[n+31:n]) - DEST[n+31:n]) 
} 
IF (VEX.128) THEN 
DEST[MAXVL-1:128] := 0 
ELSEIF (VEX.256) 
DEST[MAXVL-1:256] := 0 
Fl 


VFNMSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl(-(DEST[i+3 1 :i]*SRC3[i+31:i]) - SRC2[i+3 1:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMSUB132PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(DEST[i+3 1 :i]*SRC3[3 1:0]) - SRC2[i+3 1:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(DEST[i+31 :i]*SRC3[i+31:i]) - SRC2[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*DEST[i+31:i]) - SRC3[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMSUB213PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*DEST[i+31:i]) - SRC3[31:0]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*DEST[i+31:i]) - SRC3[i+3 1:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VFNMSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a register) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
RoundFPControl_MXCSR(-(SRC2[i+3 1:i]*SRC3[i+31:i]) - DEST[i+31:i]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VFNMSUB231PS DEST, SRC2, SRC3 (EVEX encoded version, when src3 operand is a memory source) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) 
THEN 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1:i]*SRC3[3 1:0]) - DEST[i+31:i]) 
ELSE 
DEST[i+31:i] := 
RoundFPControl_MXCSR(-(SRC2[i+3 1 :i]*SRC3[i+31:i]) - DEST[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMSUBxxxPS __m512_mm512_fnmsub_ps(__m512 a,__m512b,__m512 c); 

VFNMSUBxxxPS __m512_mm512_fnmsub_round_ps(__m512 a,__m512b,__m512¢, intr); 

VFNMSUBxxxPS __m512_mm512_mask_fnmsub_ps(__m512 a,__mmask16k,__m512b,__m512 c); 
VFNMSUBxxxPS __m512_mm512_maskz_fnmsub_ps(__mmask16 k,__m512 a,__m512b,__m512 c); 
VFNMSUBxxxPS __m512_mm512_mask3_fnmsub_ps(__m512 a,__m512b,__m512 c,__mmask16 k); 
VFNMSUBxxxPS __m512_mm512_mask_fnmsub_round_ps(__m512 a,__mmask16k,__m512b,__m512., intr); 
VFNMSUBxxxPS __m512_mm512_maskz_fnmsub_round_ps(__mmask16 k,__m512a,__m512b,__m512,¢, intr); 
VFNMSUBxxxPS __m512_mm512_mask3_fnmsub_round_ps(__m512 a,__m512b,__m512c,__mmask16 kK, int r); 
VFNMSUBxxxPS __m256 __mm256_mask_fnmsub_ps(__m256 a,__ mmask8 k,__m256 b,__m256 c); 
VFNMSUBxxxPS __m256 _mm256_maskz_fnmsub_ps(__mmask8 k,__m256 a,__m256 b,__m256 c); 
VFNMSUBxxxPS __m256 _mm256_mask3_fnmsub_ps(__m256 a,__m256 b,__ m256c,__ mmask8 k); 
VFNMSUBxxxPS __m128 _mm_mask_fnmsub_ps(__m128 a,__mmask8 k,__m128b,_m128 c); 

VFNMSUBxxxPS __m128 _mm_maskz_fnmsub_ps(__mmask8 k,__m128a,__m128b,__m128 c); 
VFNMSUBxxxPS __m128_mm_mask3_fnmsub_ps(__m128 a,__m128b,__m128c,__mmask8 k); 
VFNMSUBxxxPS __m128_mm_fnmsub_ps (__m128 a,__m128b,__m128 c); 

VFNMSUBxxxPS __m256 _mm256_fnmsub_ps (__m256 a,__m256b,__m256 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions”. 
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VFNMSUB132SD/VFNMSUB213SD/VFNMSUB231SD—Fused Negative Multiply-Subtract of 
Scalar Double-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.LIG.66.0F38.W1 9F /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFNMSUB132SD xmm1, xmm2, xmm1 and xmm3/mem, negate the multiplication result and 
xmm3/m64 subtract xmm2 and put result in xmm1. 
VEX.LIG.66.0F38.W1 AF /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFNMSUB213SD xmm1, xmm2, xmm1 and xmm2, negate the multiplication result and 
xmm3/m64 subtract xmm3/mem and put result in xmm1. 
VEX.LIG.66.0F38.W1 BF /r A VIV FMA Multiply scalar double-precision floating-point value from 
VFNMSUB231SD xmm1, xmm2, xmme2 and xmm3/mem, negate the multiplication result and 
xmm3/m64 subtract xmm1 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 SF /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMSUB132SD xmm1 {k1}{Z}, xmm1 and xmm3/m64, negate the multiplication result and 
xmm2, xmm3/m64{er} subtract xmm2 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 AF /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMSUB213SD xmm1 {k1}{Z}, xmm1 and xmm2, negate the multiplication result and 
xmm2, xmm3/m64{er} subtract xmm3/m64 and put result in xmm1. 
EVEX.LLIG.66.0F38.W1 BF /r B VIV AVX512F Multiply scalar double-precision floating-point value from 
VFNMSUB231SD xmm1 {k1}{zZ}, xmme2 and xmm3/m64, negate the multiplication result and 
xmm2, xmm3/m64{er} subtract xmm1 and put result in xmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMSUB132SD: Multiplies the low packed double-precision floating-point value from the first source operand to 
the low packed double-precision floating-point value in the third source operand. From negated infinite precision 
intermediate result, subtracts the low double-precision floating-point value in the second source operand, performs 
rounding and stores the resulting packed double-precision floating-point value to the destination operand (first 
source operand). 


VFNMSUB213SD: Multiplies the low packed double-precision floating-point value from the second source operand 
to the low packed double-precision floating-point value in the first source operand. From negated infinite precision 
intermediate result, subtracts the low double-precision floating-point value in the third source operand, performs 
rounding and stores the resulting packed double-precision floating-point value to the destination operand (first 
source operand). 


VFNMSUB231SD: Multiplies the low packed double-precision floating-point value from the second source to the low 
packed double-precision floating-point value in the third source operand. From negated infinite precision interme- 
diate result, subtracts the low double-precision floating-point value in the first source operand, performs rounding 
and stores the resulting packed double-precision floating-point value to the destination operand (first source 
operand). 

VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX.vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:64 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 
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EVEX encoded version: The low quadword element of the destination is updated according to the writemask. 
Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 


Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFNMSUB132SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(-(DEST[63:0]*SRC3[63:0]) - SRC2[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFNMSUB213SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(-(SRC2[63:0]*DEST[63:0]) - SRC3[63:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 
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VFNMSUB231SD DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := RoundFPControl(-(SRC2[63:0]*SRC3[63:0]) - DEST[63:0]) 


ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := DEST[127:64] 
DEST[MAXVL-1:128] := 0 


VFNMSUB132SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (DEST[63:0]*SRC3[63:0]) - SRC2[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] := 0 


VFNMSUB2135SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (SRC2[63:0]*DEST[63:0]) - SRC3[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] = 0 


VFNMSUB231SD DEST, SRC2, SRC3 (VEX encoded version) 

DEST[63:0] := RoundFPControl_MXCSR(- (SRC2[63:0]*SRC3[63:0]) - DEST[63:0]) 
DEST[127:64] := DEST[127:64] 

DEST[MAXVL-1:128] = 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMSUBxxxSD __m128d _mm_fnmsub_round_sd(__m128d a,__m128db,__m128d, int r); 

VFNMSUBxxxSD __m128d _mm_mask_fnmsub_sd(__m128d a,__mmask8 k,__m128d b,__m128d c); 
VFNMSUBxxxSD __m128d _mm_maskz_fnmsub_sd(__mmask8 k,__m128da,__m128db,__m128d c); 
VFNMSUBxxxSD __m128d _mm_mask3_fnmsub_sd(__m128d a,__m128db,__m128dc,__ mmask8 k); 
VFNMSUBxxxSD __m128d _mm_mask_fnmsub_round_sd(__m128d a,__mmask8 k,_m128db,__m128dc, int r); 
VFNMSUBxxxSD __m128d _mm_maskz_fnmsub_round_sd(__mmask8 k,___m128d a,__m128d b,__m128dc, int r); 
VFNMSUBxxxSD __m128d _mm_mask3_fnmsub_round_sd(__m128d a,__m128db,___m128dc, ___mmask8 k, int r); 
VFNMSUBxxxSD __m128d _mm_fnmsub_sd (__m128d a,__m128db,_m128d c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFNMSUB132SS/VFNMSUB213SS/VFNMSUB231SS—Fused Negative Multiply-Subtract of 
Scalar Single-Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.LIG.66.0F38.W0 9F /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMSUB132SS xmm1, xmm2, xmm1 and xmm3/m32, negate the multiplication result and 
xmm3/m32 subtract xmm2 and put result in xmm1. 
VEX.LIG.66.0F38.W0 AF /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMSUB213SS xmm1, xmm2, xmm1 and xmm2, negate the multiplication result and 
xmm3/m32 subtract xmm3/m32 and put result in xmm1. 
VEX.LIG.66.0F38.W0 BF /r A VIV FMA Multiply scalar single-precision floating-point value from 
VFNMSUB231SS xmm1, xmm2, xmm2 and xmm3/m32, negate the multiplication result and 
xmm3/m32 subtract xmm1 and put result in xmm1. 
EVEX.LLIG.66.0F38.WO SF /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFNMSUB132SS xmm1 {k1}{Z}, xmm1 and xmm3/m32, negate the multiplication result and 
xmm2, xmm3/m32{er} subtract xmm2 and put result in xmm1. 
EVEX.LLIG.66.0F38.WO AF /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFNMSUB213SS xmm1 {k1}{Z}, xmm1 and xmm2, negate the multiplication result and 
xmm2, xmm3/m32{er} subtract xmm3/m32 and put result in xmm1. 
EVEX.LLIG.66.0F38.WO BF /r B VIV AVX512F Multiply scalar single-precision floating-point value from 
VFNMSUB231SS xmm1 {k1}{zZ}, xmme2 and xmm3/m32, negate the multiplication result and 
xmme2, xmm3/m32{er} subtract xmm1 and put result in xmm1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Tuple1 Scalar ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


VFNMSUB132SS: Multiplies the low packed single-precision floating-point value from the first source operand to 
the low packed single-precision floating-point value in the third source operand. From negated infinite precision 
intermediate result, the low single-precision floating-point value in the second source operand, performs rounding 
and stores the resulting packed single-precision floating-point value to the destination operand (first source 
operand). 


VFNMSUB213SS: Multiplies the low packed single-precision floating-point value from the second source operand to 
the low packed single-precision floating-point value in the first source operand. From negated infinite precision 
intermediate result, the low single-precision floating-point value in the third source operand, performs rounding 
and stores the resulting packed single-precision floating-point value to the destination operand (first source 
operand). 


VFNMSUB231SS: Multiplies the low packed single-precision floating-point value from the second source to the low 
packed single-precision floating-point value in the third source operand. From negated infinite precision interme- 
diate result, the low single-precision floating-point value in the first source operand, performs rounding and stores 
the resulting packed single-precision floating-point value to the destination operand (first source operand). 


VEX.128 and EVEX encoded version: The destination operand (also first source operand) is encoded in reg_field. 
The second source operand is encoded in VEX. vvvv/EVEX.vvvv. The third source operand is encoded in rm_field. 
Bits 127:32 of the destination are unchanged. Bits MAXVL-1:128 of the destination register are zeroed. 


EVEX encoded version: The low doubleword element of the destination is updated according to the writemask. 


Compiler tools may optionally support a complementary mnemonic for each instruction mnemonic listed in the 
opcode/instruction column of the summary table. The behavior of the complementary mnemonic in situations 
involving NANs are governed by the definition of the instruction mnemonic defined in the opcode/instruction 
column. 
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Operation 


In the operations below, “*” and “-” symbols represent multiplication and subtraction with infinite precision inputs and outputs (no 
rounding). 


VFNMSUB132SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(-(DEST[3 1:0]*SRC3[31:0]) - SRC2[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 


VFNMSUB213SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundFPControl(-(SRC2[31:0]*DEST[31:0]) - SRC3[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 
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VFNMSUB231SS DEST, SRC2, SRC3 (EVEX encoded version) 
IF (EVEX.b = 1) and SRC3 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := RoundFPControl(-(SRC2[3 1:0]*SRC3[63:0]) - DEST[31:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := DEST[127:32] 
DEST[MAXVL-1:128] := 0 


VFNMSUB132SS DEST, SRC2, SRC3 (VEX encoded version) 
DEST[31:0] := RoundFPControl_MXCSR(- (DEST[31:0]*SRC3[31:0]) - SRC2[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFNMSUB2135S DEST, SRC2, SRC3 (VEX encoded version) 
DEST[31:0] := RoundFPControl_MXCSR(- (SRC2[31:0]*DEST[31:0]) - SRC3[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


VFNMSUB2315SS DEST, SRC2, SRC3 (VEX encoded version) 
DEST[31:0] := RoundFPControl_MXCSR(- (SRC2[31:0]*SRC3[31:0]) - DEST[31:0]) 
DEST[127:32] := DEST[127:32] 

DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFNMSUBxxxSS __m128 _mm_fnmsub_round_ss(__m128 a,__m128b,__m128c, intr); 

VFNMSUBxxxSS __m128 _mm_mask_fnmsub_ss(__m128 a,__mmask8 k,__m128b,__m128 c); 
VFNMSUBxxxSS __m128 _mm_maskz_fnmsub_ss(__mmask8 k,__m128a,__m128b,__m128 c); 
VFNMSUBxxxSS __m128 _mm_mask3_fnmsub_ss(__m128 a,__m128b,__m128 c,__mmask8 k); 
VFNMSUBxxxSS __m128 _mm_mask_fnmsub_round_ss(__m128 a,__ mmask8 k,__m128b,__m128, int r); 
VFNMSUBxxxSS __m128 _mm_maskz_fnmsub_round_ss(__mmask8 k,__m128a,__m128b,__m128c, intr); 
VFNMSUBxxxSS __m128 _mm_mask3_fnmsub_round_ss(__m128 a,__m128b,__m128c,__mmask8 k, int r); 
VFNMSUBxxxSS __m128 __mm_fnmsub_ss (__m128 a,__m128b,__m128 c); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal 


Other Exceptions 
VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions”. 


EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions”. 
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VFPCLASSPD—Tests Types Of a Packed Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W1 66 /r ib VIV AVX512VL | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPD k2 {k1}, AVX512DQ | +lInfinity, -Infinity, denormal, finite negative. The immediate 
xmm2/m128/m64bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 
EVEX.256.66.0F3A.W1 66 /r ib VIV AVX512VL | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPD k2 {k1}, AVX512DQ | +lInfinity, -Infinity, denormal, finite negative. The immediate 
ymm2/m256/m64bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 
EVEX.512.66.0F3A.W1 66 /r ib VIN AVX512DQ | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPD k2 {k1}, +Infinity, -Infinity, denormal, finite negative. The immediate 
zmm2/m512/m64bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


The FPCLASSPD instruction checks the packed double precision floating point values for special categories, speci- 
fied by the set bits in the imm8 byte. Each set bit in imm8 specifies a category of floating-point values that the 
input data element is classified against. The classified results of all specified categories of an input value are ORed 
together to form the final boolean result for the input element. The result of each element is written to the corre- 
sponding bit in a mask register k2 according to the writemask k1. Bits [MAX_KL-1:8/4/2] of the destination are 
cleared. 


The classification categories specified by imm8 are shown in Figure 5-13. The classification test for each category 
is listed in Table 5-4. 


7 6 5 4 3 2 1 0 


SNaN Neg. INF +INF 


QNaN 


Denormal 


Neg. Finite Neg. 0 +0 


Figure 5-13. Imm8 Byte Specifier of Special Case FP Values for VFPCLASSPD/SD/PS/SS 


Table 5-4. Classifier Operations for VFPCLASSPD/SD/PS/SS 


Bits Imm8[0] Imm8[1] Imm8[2] Imm8[3] Imm8[4] Imm8s[5] Imm8[6] Imm8[7] 

Category | QNAN PosZero NegZero PosINF NegINF Denormal Negative SNAN 

Classifier | Checks for | Checks for | Checks for- | Checks for | Checks for - | Checks for Checks for Checks for 
QNaN +0 0 +INF INF Denormal Negative finite SNaN 


The source operand is aZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector 
broadcasted from a 64-bit memory location. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 
CheckFPClassDP (tsrc[63:0], imm8[7:0]){ 


//* Start checking the source operand for special type *// 
NegNum := tsrc[63]; 
IF (tsrc[62:52]=07FFh) Then ExpAllOnes := 1; Fl; 
IF (tsrc[62:52]=Oh) Then ExpAllZeros := 1; 
IF (ExpAllZeros AND MXCSR.DAZ) Then 
MantAllZeros := 1; 
ELSIF (tsrc[51:0]=O0h) Then 
MantAllZeros := 1; 
Fl; 
ZeroNumber := ExpAllZeros AND MantAllZeros 
SignalingBit := tsrc[51]; 


sNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND NOT(SignalingBit); // sNaN 
qNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND SignalingBit; // qNaN 
Pzero_res := NOT(NegNum) AND ExpAllZeros AND MantaAllZeros; // +0 
Nzero_res := NegNum AND ExpAllZeros AND MantAllZeros; // -0 

Pinf_res := NOT(NegNum) AND ExpAllOnes AND MantAllZeros; // +Inf 

Ninf_res := NegNum AND ExpAllOnes AND MantAllZeros; // -Inf 

Denorm_res := ExpAllZeros AND NOT(MantAllZeros); // denorm 

FinNeg_res := NegNum AND NOT(ExpAllOnes) AND NOT(ZeroNumber); // -finite 


bResult = ( imm8[0] AND qNaN_res ) OR (imm8[1] AND Pzero_res ) OR 
(imm8[2] AND Nzero_res ) OR ( imm8[3] AND Plinf_res ) OR 
(imm8[4] AND Ninf_res ) OR (imm8[5] AND Denorm_res ) OR 
(imm8[6] AND FinNeg_res ) OR ( imm8[7] AND sNaN_res ); 
Return bResult; 
}//* end of CheckFPClassDP() *// 


VFPCLASSPD (EVEX Encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) AND (SRC *is memory*) 
THEN 
DEST{[j] := CheckFPClassDP(SRC1 [63:0], imm8[7:0]); 
ELSE 
DEST{[j] := CheckFPClassDP(SRC1 [i+63:i], imm8[7:0}); 
Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VFPCLASSPD __mmask8 _mm512_fpclass_pd_mask(__m512d a, int c); 

VFPCLASSPD __mmask8 _mm512_mask_fpclass_pd_mask(__mmask8 m,__m512d a, int c) 
VFPCLASSPD __mmask8 _mm256_fpclass_pd_mask(__m256d a, int c) 

VFPCLASSPD __mmask8 _mm256_mask_fpclass_pd_mask(__mmask8 m,___m256d a, int c) 
VFPCLASSPD __mmask8 _mm_fpclass_pd_mask(__m128d a, int c) 
VFPCLASSPD __mmask8 _mm_mask_fpclass_pd_mask(__mmask8 m, 


m128d a, int c) 


SIMD Floating-Point Exceptions 


None 

Other Exceptions 

See Table 2-49, “Type E4 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 66 /rib | A VIV AVX512VL | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPS k2 {k1}, AVX512DQ | +lnfinity, -Infinity, denormal, finite negative. The immediate 
xmme2/m1 28/m32bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 
EVEX.256.66.0F3A.WO0 66 /rib | A VIV AVX512VL | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPS k2 {k1}, AVX512DQ | +lnfinity, -Infinity, denormal, finite negative. The immediate 
ymm2/m256/m32bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 
EVEX.512.66.0F3A.W0 66 /rib | A VIN AVX512DQ | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSPS k2 {k1}, +Infinity, -Infinity, denormal, finite negative. The immediate 
zmm2/m512/m32bcst, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


The FPCLASSPS instruction checks the packed single-precision floating point values for special categories, specified 
by the set bits in the imm8 byte. Each set bit in imm8 specifies a category of floating-point values that the input 
data element is classified against. The classified results of all specified categories of an input value are ORed 
together to form the final boolean result for the input element. The result of each element is written to the corre- 
sponding bit in a mask register k2 according to the writemask k1. Bits [MAX_KL-1:16/8/4] of the destination are 


cleared. 


The classification categories specified by imm8 are shown in Figure 5-13. The classification test for each category 


is listed in Table 5-4. 


The source operand is aZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector 
broadcasted from a 32-bit memory location. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


CheckFPClassSP (tsrc[31:0], imm8[7:0])f{ 


//* Start checking the source operand for special type *// 


NegNum := tsrc[31]; 


IF (tsrc[30:23]=OFFh) Then ExpAllOnes := 1; Fl; 
IF (tsrc[30:23]=0h) Then ExpAllZeros := 1; 
IF (ExpAllZeros AND MXCSR.DAZ) Then 


MantAllZeros := 1; 
ELSIF (tsrc[22:0]=0h) Then 
MantAllZeros := 1; 

Fl; 


ZeroNumber= ExpAllZeros AND MantAllZeros 


SignalingBit= tsrc[22]; 


sNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND NOT(SignalingBit); // sNaN 
qNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND SignalingBit; // qNaN 
Pzero_res := NOT(NegNum) AND ExpAllZeros AND MantAllZeros; // +0 
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Nzero_res := NegNum AND ExpAllZeros AND MantAllZeros; // -0 

Pinf_res := NOT(NegNum) AND ExpAllOnes AND MantAllZeros; // +Inf 

Ninf_res := NegNum AND ExpAllOnes AND MantAllZeros; // -Inf 

Denorm_res := ExpAllZeros AND NOT(MantAllZeros); // denorm 

FinNeg_res := NegNum AND NOT(ExpAllOnes) AND NOT(ZeroNumber); // -finite 


bResult = ( imm8[0] AND qNaN_res ) OR (imm8[1] AND Pzero_res ) OR 
(imm8[2] AND Nzero_res ) OR ( imm8[3] AND Pinf_res ) OR 
(imm8[4] AND Ninf_res ) OR ( imm8[5] AND Denorm_res ) OR 
(imm8[6] AND FinNeg_res ) OR ( imm8[7] AND sNalN_res ); 
Return bResult; 
}//* end of CheckSPClassSP() *// 


VFPCLASSPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b == 1) AND (SRC *is memory’) 
THEN 
DEST{[j] := CheckFPClassDP(SRC1 [31:0], imm8[7:0}]); 
ELSE 
DEST{[j] := CheckFPClassDP(SRC1 [i+31:i], imm8[7:0}); 
Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFPCLASSPS __mmask16 _mm512_fpclass_ps_mask(__m512 a, int c); 
VFPCLASSPS __mmask16 __mm512_mask_fpclass_ps_mask(__mmask16 m, 
VFPCLASSPS __mmask8 _mm256_fpclass_ps_mask(__m256 a, int c) 
VFPCLASSPS __mmask8 _mm256_mask_fpclass_ps_mask(__mmask8 m, 
VFPCLASSPS __mmask8 _mm_fpclass_ps_mask(__m128 a, int c) 
VFPCLASSPS __mmask8 _mm_mask_fpclass_ps_mask(__mmask8 m, 


m512 a, int c) 


m256 a, int c) 


m128 a, int c) 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VFPCLASSSD—Tests Types Of a Scalar Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
EVEX.LLIG.66.0F3A.W1 67 /rib | A VIN AVX512DQ | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSSD k2 {k1}, +Infinity, -Infinity, denormal, finite negative. The immediate 
xmm2/m64, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


The FPCLASSSD instruction checks the low double precision floating point value in the source operand for special 
categories, specified by the set bits in the imm8 byte. Each set bit in imm8 specifies a category of floating-point 
values that the input data element is classified against. The classified results of all specified categories of an input 
value are ORed together to form the final boolean result for the input element. The result is written to the low bit in 
a mask register k2 according to the writemask ki. Bits MAX_KL-1: 1 of the destination are cleared. 

The classification categories specified by imm8 are shown in Figure 5-13. The classification test for each category 
is listed in Table 5-4. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 
CheckFPClassDP (tsrc[63:0], imm8[7:0]){ 


NegNum := tsrc[63]; 
IF (tsrc[62:52]=07FFh) Then ExpAllOnes := 1; Fl; 
IF (tsrc[62:52]=0h) Then ExpAllZeros := 1; 
IF (ExpAllZeros AND MXCSR.DAZ) Then 
MantAllZeros := 1; 
ELSIF (tsrc[51:0]=O0h) Then 
MantAllZeros := 1; 
Fl; 
ZeroNumber := ExpAllZeros AND MantAllZeros 
SignalingBit := tsrc[5 1]; 


sNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND NOT(SignalingBit); // sNaN 
qNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND SignalingBit; // qNaN 
Pzero_res := NOT(NegNum) AND ExpAllZeros AND MantAllZeros; // +0 
Nzero_res := NegNum AND ExpAllZeros AND MantAllZeros; // -0 

Pinf_res := NOT(NegNum) AND ExpAllOnes AND MantAllZeros; // +Inf 

Ninf_res := NegNum AND ExpAllOnes AND MantAllZeros; // -Inf 

Denorm_res := ExpAllZeros AND NOT(MantAllZeros); // denorm 

FinNeg_res := NegNum AND NOT(ExpAllOnes) AND NOT(ZeroNumber); // -finite 


bResult = ( imm8[0] AND qNaN_res ) OR (imm8[1] AND Pzero_res ) OR 
(imm8[2] AND Nzero_res ) OR ( imm8[3] AND Plinf_res ) OR 
(imm8[4] AND Ninf_res ) OR ( imm8[5] AND Denorm_res ) OR 
(imm8[6] AND FinNeg_res ) OR ( imm8[7] AND sNaN_res ); 
Return bResult; 
}//* end of CheckFPClassDP() *// 
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VFPCLASSSD (EVEX encoded version) 


IF k1[0] OR *no writemask* 
THEN DEST[O] := 
CheckFPClassDP(SRC1 [63:0], imm8[7:0]) 
ELSE DEST[O] := 0 ; zeroing-masking only 
Fl; 


DEST[MAX_KL-1:1] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFPCLASSSD __mmask8 _mm_fpclass_sd_mask(__m128d a, int c) 
VFPCLASSSD __mmask8 _mm_mask_fpclass_sd_mask(__mmask8 m,__m128d a, int c) 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.WO 67 /r A VIN AVX512DQ | Tests the input for the following categories: NaN, +0, -0, 
VFPCLASSSS k2 {k1}, +lInfinity, -Infinity, denormal, finite negative. The immediate 
xmm2/m32, imm8 field provides a mask bit for each of these category tests. The 
masked test results are OR-ed together to form a mask result. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


The FPCLASSSS instruction checks the low single-precision floating point value in the source operand for special 
categories, specified by the set bits in the imm8 byte. Each set bit in imm8 specifies a category of floating-point 
values that the input data element is classified against. The classified results of all specified categories of an input 
value are ORed together to form the final boolean result for the input element. The result is written to the low bit in 
a mask register k2 according to the writemask k1. Bits MAX_KL-1: 1 of the destination are cleared. 


The classification categories specified by imm8 are shown in Figure 5-13. The classification test for each category 


is listed in Table 5-4. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


CheckFPClassSP (tsrc[31:0], imm8[7:0])<{ 


//* Start checking the source operand for special type *// 


NegNum := tsrc[31]; 


IF (tsrc[30:23]=OFFh) Then ExpAllOnes := 1; Fl; 
IF (tsrc[30:23]=0h) Then ExpAllZeros := 1; 
IF (ExpAllZeros AND MXCSR.DAZ) Then 


MantAllZeros := 1; 


ELSIF (tsrc[22:0]=0h) Then 


MantAllZeros := 1; 
Fl; 


ZeroNumber= ExpAllZeros AND MantAllZeros 


SignalingBit= tsrc[22]; 


sNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND NOT(SignalingBit); // sNaN 
qNaN_res := ExpAllOnes AND NOT(MantAllZeros) AND SignalingBit; // qNaN 
Pzero_res := NOT(NegNum) AND ExpAllZeros AND MantaAllZeros; // +0 
Nzero_res := NegNum AND ExpAllZeros AND MantAllZeros; // -0 

Pinf_res := NOT(NegNum) AND ExpAllOnes AND MantAllZeros; // +Inf 

Ninf_res := NegNum AND ExpAllOnes AND MantAllZeros; // -Inf 

Denorm_res := ExpAllZeros AND NOT(MantAllZeros); // denorm 

FinNeg_res := NegNum AND NOT(ExpAllOnes) AND NOT(ZeroNumber); // -finite 


bResult = ( imm8[0] AND qNaN_res ) OR (imm8[1] AND Pzero_res ) OR 
(imm8[2] AND Nzero_res ) OR ( imm8[3] AND Pinf_res ) OR 
(imm8[4] AND Ninf_res ) OR (imm8[5] AND Denorm_res ) OR 
(imm8[6] AND FinNeg_res ) OR ( imm8[7] AND sNaN_res ); 


Return bResult; 
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}//* end of CheckSPClassSP() *// 


VFPCLASSSS (EVEX encoded version) 


IF k1[0] OR *no writemask* 
THEN DEST[O] := 
CheckFPClassSP(SRC1 [31:0], imm8[7:0]) 
ELSE DEST[O] := 0 ; zeroing-masking only 
Fl; 


DEST[MAX_KL-1:1] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFPCLASSSS __mmask8 _mm_fpclass_ss_mask(__m128 a, int c) 
VFPCLASSSS __mmask8 _mm_mask_fpclass_ss_mask(__mmask8 m, 


m128 a, int c) 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VGATHERDPD/VGATHERQPD — Gather Packed DP FP Values Using Signed Dword/Qword Indices 


Opcode/ Op/ | 64/3 | CPUID Description 
Instruction En 2-bit | Feature 
Mode | Flag 

VEX.128.66.0F38.W1 92 /r RMV | V/V AVX2 Using dword indices specified in vm32x, gather double-pre- 

VGATHERDPD xmm1, vm32x, xmm2 cision FP values from memory conditioned on mask speci- 
fied by xmm2. Conditionally gathered elements are merged 
into xmm1. 

VEX.128.66.0F38.W1 93 /r RMV | V/V AVX2 Using qword indices specified in vm64x, gather double-pre- 

VGATHERQPD xmm1, vm64x, xmm2 cision FP values from memory conditioned on mask speci- 
fied by xmm2. Conditionally gathered elements are merged 
into xmm1. 

VEX.256.66.0F38.W1 92 /r RMV | V/V AVX2 Using dword indices specified in vm32x, gather double-pre- 

VGATHERDPD ymm1, vm32x, ymm2 cision FP values from memory conditioned on mask speci- 
fied by ymmz. Conditionally gathered elements are merged 
into ymm1. 

VEX.256.66.0F38.W1 93 /r RMV | V/V AVX2 Using qword indices specified in vm64y, gather double-pre- 

VGATHERQPD ymm17, vm64y, ymm2 cision FP values from memory conditioned on mask speci- 
fied by ymm2. Conditionally gathered elements are merged 
into ymm1. 


Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 


RMV ModRM:reg (r,w) BaseReg (R): VSIB:base, VEX.vvvv (r, w) NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally loads up to 2 or 4 double-precision floating-point values from memory addresses 
specified by the memory operand (the second operand) and using qword indices. The memory operand uses the 
VSIB form of the SIB byte to specify a general purpose register operand as the common base, a vector register for 
an array of indices relative to the base and a constant scale factor. 


The mask operand (the third operand) specifies the conditional load operation from each memory address and the 
corresponding update of each data element of the destination operand (the first operand). Conditionality is speci- 
fied by the most significant bit of each data element of the mask register. If an element’s mask bit is not set, the 

corresponding element of the destination register is left unchanged. The width of data element in the destination 

register and mask register are identical. The entire mask register will be set to zero by this instruction unless the 
instruction causes an exception. 


Using dword indices in the lower half of the mask register, the instruction conditionally loads up to 2 or 4 double- 
precision floating-point values from the VSIB addressing memory operand, and updates the destination register. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask operand are partially updated; those elements that have been gathered are placed into the 
destination register and have their mask bits set to zero. If any traps or interrupts are pending from already gath- 
ered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


If the data size and index size are different, part of the destination register and part of the mask register do not 
correspond to any elements being gathered. This instruction sets those parts to zero. It may do this to one or both 
of those registers even if the instruction triggers an exception, and even if the instruction triggers the exception 
before gathering any elements. 
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VEX.128 version: The instruction will gather two double-precision floating-point values. For dword indices, only the 
lower two indices in the vector index register are used. 


VEX.256 version: The instruction will gather four double-precision floating-point values. For dword indices, only the 
lower four indices in the vector index register are used. 


Note that: 


If any pair of the index, mask, or destination registers are the same, this instruction results a #UD fault. 


The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination will be completed (and non-faulting). Individual elements closer 
to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered in the 
conventional order. 

Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 


This instruction does not perform AC checks, and so will never deliver an AC fault. 
This instruction will cause a #UD if the address size attribute is 16-bit. 
This instruction will cause a #UD if the memory operand is encoded without the SIB byte. 


This instruction should not be used to access memory mapped I/O as the ordering of the individual loads it does 
is implementation specific, and some implementations may use loads larger than the data element size or load 
elements an indeterminate number of times. 

The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32- 


bit mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address 
bits are ignored. 


VGATHERDPD/VGATHERQPD — Gather Packed DP FP Values Using Signed Dword/Qword Indices Vol.2C 5-251 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


DEST := SRC1; 

BASE_ADDR: base register encoded in VSIB addressing; 
VINDEX: the vector index register encoded by VSIB addressing; 
SCALE: scale factor encoded by SIB:[7:6]; 

DISP: optional 1, 4 byte displacement; 

MASK := SRC3; 


VGATHERDPD (VEX.128 version) 
MASK[MAXVL-1:128] := 0; 


FOR j :=Oto1 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{[i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=Oto 1 
k:=j * 32; 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX[k+31 :k])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] == FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +63: i] := 0; 
ENDFOR 


DEST[MAXVL-1:128] := 0; 


VGATHERQPD (VEX.128 version) 
MASK[MAXVL-1:128] := 0; 
FOR j :=Oto1 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{[i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=Oto1 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1[i+63:i])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits this instruction 
Fl; 
MASK{i +63: i] := 0; 
ENDFOR 
DEST[MAXVL-1:128] := 0; 
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VGATHERQPD (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 
FOR j :=0 to3 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{[i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=0 to3 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [i+63:i])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK[i +63: i] := 0; 
ENDFOR 
DEST[MAXVL-1:256] := 0; 


VGATHERDPD (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 


FOR j :=0 to3 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{[i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=0 to3 
k:= | * 32; 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [k+31:k])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +63:i] := 0; 
ENDFOR 


DEST[MAXVL-1:256] := 0; 


VGATHERDPD/VGATHERQPD — Gather Packed DP FP Values Using Signed Dword/Qword Indices Vol. 2C 5-253 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VGATHERDPD: __m128d _mm_i32gather_pd (double const * base, 


VGATHERDPD: 
scale); 


VGATHERDPD: 


VGATHERDPD: 
scale); 


VGATHERQPD: __m128d __mm_i64gather_pd (double const * base, 


VGATHEROQPD: 
scale); 


VGATHEROQPD: 


VGATHEROQPD: 
scale); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


m128d_mm_mask_i32gather_pd (__m128d src, double const * base, __m128i index, 


m256d __mm256_mask_i32gather_pd (__m256d src, double const * base, __m128i index, 


m128d_mm_mask_i64gather_pd (__m128d src, double const * base, __m128i index, 


m256d_mm256_i64gather_pd (double const * base, 
m256d _mm256_mask_i64gather_pd (__m256d src, double const * base, __m256i index, 


m1 28i index, const int scale); 


m128d mask, const int 


m256d_mm256_i32gather_pd (double const * base, __m128i index, const int scale); 


m256d mask, const int 


m1 28i index, const int scale); 


m128d mask, const int 


m256i index, const int scale); 


m256d mask, const int 


See Table 2-27, “Type 12 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VGATHERDPS/VGATHEROPS — Gather Packed SP FP values Using Signed Dword/Qword Indices 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode | Flag 

VEX.128.66.0F38.W0 92 /r A VIV AVX2 Using dword indices specified in vm32x, gather single-preci- 

VGATHERDPS xmm1, vm32x, xmm2 sion FP values from memory conditioned on mask specified 
by xmm_e. Conditionally gathered elements are merged into 
xmm1. 

VEX.128.66.0F38.W0 93 /r A VIV AVX2 Using qword indices specified in vm64x, gather single-preci- 

VGATHEROPS xmm1, vm64x, xmm2 sion FP values from memory conditioned on mask specified 
by xmm_e. Conditionally gathered elements are merged into 
xmm1. 

VEX.256.66.0F38.W0 92 /r A VIV AVX2 Using dword indices specified in vm32y, gather single-preci- 

VGATHERDPS ymm1, vm32y, ymm2 sion FP values from memory conditioned on mask specified 
by ymm2. Conditionally gathered elements are merged into 
ymm1. 

VEX.256.66.0F38.W0 93 /r A VIV AVX2 Using qword indices specified in vm64y, gather single-preci- 

VGATHEROPS xmm1, vm64y, xmm2 sion FP values from memory conditioned on mask specified 
by xmm_e. Conditionally gathered elements are merged into 
xmm1. 


Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 


A ModRM:reg (r,w) BaseReg (R): VSIB:base, VEX.vvvv (r, w) NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally loads up to 4 or 8 single-precision floating-point values from memory addresses spec- 
ified by the memory operand (the second operand) and using dword indices. The memory operand uses the VSIB 
form of the SIB byte to specify a general purpose register operand as the common base, a vector register for an 
array of indices relative to the base and a constant scale factor. 


The mask operand (the third operand) specifies the conditional load operation from each memory address and the 
corresponding update of each data element of the destination operand (the first operand). Conditionality is speci- 
fied by the most significant bit of each data element of the mask register. If an element’s mask bit is not set, the 

corresponding element of the destination register is left unchanged. The width of data element in the destination 
register and mask register are identical. The entire mask register will be set to zero by this instruction unless the 
instruction causes an exception. 


Using qword indices, the instruction conditionally loads up to 2 or 4 single-precision floating-point values from the 
VSIB addressing memory operand, and updates the lower half of the destination register. The upper 128 or 256 bits 
of the destination register are zero’ed with qword indices. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask operand are partially updated; those elements that have been gathered are placed into the 
destination register and have their mask bits set to zero. If any traps or interrupts are pending from already gath- 
ered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


If the data size and index size are different, part of the destination register and part of the mask register do not 
correspond to any elements being gathered. This instruction sets those parts to zero. It may do this to one or both 
of those registers even if the instruction triggers an exception, and even if the instruction triggers the exception 
before gathering any elements. 
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VEX.128 version: For dword indices, the instruction will gather four single-precision floating-point values. For 
qword indices, the instruction will gather two values and zero the upper 64 bits of the destination. 


VEX.256 version: For dword indices, the instruction will gather eight single-precision floating-point values. For 
qword indices, the instruction will gather four values and zero the upper 128 bits of the destination. 


Note that: 
e If any pair of the index, mask, or destination registers are the same, this instruction results a UD fault. 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 

¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination will be completed (and non-faulting). Individual elements closer 
to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered in the 
conventional order. 

¢ Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 

¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 

¢ This instruction will cause a #UD if the address size attribute is 16-bit. 

¢ This instruction will cause a #UD if the memory operand is encoded without the SIB byte. 


¢ This instruction should not be used to access memory mapped I/O as the ordering of the individual loads it does 
is implementation specific, and some implementations may use loads larger than the data element size or load 
elements an indeterminate number of times. 

¢ The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32- 
bit mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address 
bits are ignored. 


Operation 


DEST := SRC1; 

BASE_ADDR: base register encoded in VSIB addressing; 
VINDEX: the vector index register encoded by VSIB addressing; 
SCALE: scale factor encoded by SIB:[7:6]; 

DISP: optional 1, 4 byte displacement; 

MASK := SRC3; 
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VGATHERDPS (VEX.128 version) 
MASK[MAXVL-1:128] := 0; 
FOR j :=0 to3 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] := 0; 
Fl; 
ENDFOR 
FOR j := 0 to3 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX[i+31:i])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:1 28] := 0; 


VGATHEROPS (VEX.128 version) 
MASK[MAXVL-1:64] := 0; 
FOR j :=0 to3 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] = 0; 
Fl; 
ENDFOR 
FOR j :=Oto1 
k:=j* 64; 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [k+63:k])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:64] := 0; 
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VGATHERDPS (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 
FOR j :=Oto7 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{[i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] = 0; 
Fl; 
ENDFOR 
FOR j :=Oto7 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1[i+31:i])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:256] := 0; 


VGATHEROPS (VEX.256 version) 
MASK[MAXVL-1:128] := 0; 
FOR j :=Oto7 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] = 0; 
Fl; 
ENDFOR 
FOR j :=O0 to3 
k:=j* 64; 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1[k+63:k])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:128] := 0; 
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Intel C/C++ Compiler Intrinsic Equivalent 
VGATHERDPS: __m128_mm_i32gather_ps (float const * base, 


VGATHERDPS: m256 __mm256_i32gather_ps (float const * base, 


scale); 
VGATHERQPS: __m128_mm_i64gather_ps (float const * base, 


VGATHEROPS: m128_mm256_i64gather_ps (float const * base, 


scale); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-27, “Type 12 Class Exception Conditions”. 
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m1 28i index, const int scale); 
VGATHERDPS: m128 _mm_mask_i32gather_ps (__m128 src, float const * base, _m128i index, 


m256i index, const int scale); 
VGATHERDPS: m256 _mm256_mask_i32gather_ps (__m256 src, float const * base, 


m1 28i index, const int scale); 
VGATHEROPS: m128 __mm_mask_i64gather_ps (__m128 src, float const * base, __m128i index, 


m256i index, const int scale); 
VGATHEROPS: m128 _mm256_mask_i64gather_ps (__m128 src, float const * base, 
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m128 mask, const int scale); 


m256 mask, const int 


m128 mask, const int scale); 


m128 mask, const int 
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VGATHERDPS/VGATHERDPD—Gather Packed Single, Packed Double with Signed Dword 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 92 /vsib A VV AVX512VL | Using signed dword indices, gather single-precision floating- 
VGATHERDPS xmm1 {k1}, vm32x AVX512F point values from memory using k1 as completion mask. 
EVEX.256.66.0F38.W0 92 /vsib A VV AVX512VL | Using signed dword indices, gather single-precision floating- 
VGATHERDPS ymm1 {k1}, vm32y AVX512F point values from memory using k1 as completion mask. 
EVEX.512.66.0F38.W0 92 /vsib A VV AVX512F Using signed dword indices, gather single-precision floating- 
VGATHERDPS zmm1 {k1}, vm32z point values from memory using k1 as completion mask. 
EVEX.128.66.0F38.W1 92 /vsib A VV AVX512VL | Using signed dword indices, gather float64 vector into 
VGATHERDPD xmm1 {k1}, AVX512F float64 vector xmm1 using k1 as completion mask. 
vm32x 
EVEX.256.66.0F38.W1 92 /vsib A VV AVX512VL | Using signed dword indices, gather float64 vector into 
VGATHERDPD ymm1 {k1}, AVX512F float64 vector ymm1 using k1 as completion mask. 
vm32x 
EVEX.512.66.0F38.W1 92 /vsib A VV AVX512F Using signed dword indices, gather float64 vector into 
VGATHERDPD zmm1 {k1}, vm32y float64 vector zmm1 using k1 as completion mask. 


Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


BaseReg (R): VSIB:base, 
VectorReg(R): VSIB:index 


A Tuple1 Scalar ModRM:reg (w) NA NA 


Description 


A set of single-precision/double-precision faulting-point memory locations pointed by base address BASE_ADDR 
and index vector V_INDEX with scale SCALE are gathered. The result is written into a vector register. The elements 
are specified via the VSIB (i.e., the index register is a vector register, holding packed indices). Elements will only be 
loaded if their corresponding mask bit is one. If an element’s mask bit is not set, the corresponding element of the 
destination register is left unchanged. The entire mask register will be set to zero by this instruction unless it trig- 
gers an exception. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the right most one with its mask bit set). When this happens, the destination 
register and the mask register (k1) are partially updated; those elements that have been gathered are placed into 
the destination register and have their mask bits set to zero. If any traps or interrupts are pending from already 
gathered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruc- 
tion breakpoint is not re-triggered when the instruction is continued. 


If the data element size is less than the index element size, the higher part of the destination register and the mask 
register do not correspond to any elements being gathered. This instruction sets those higher parts to zero. It may 
update these unused elements to one or both of those registers even if the instruction triggers an exception, and 
even if the instruction triggers the exception before gathering any elements. 


Note that: 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination zmm will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 


¢ Elements may be gathered in any order, but faults must be delivered in a right-to left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 
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¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 
° Not valid with 16-bit effective addresses. Will deliver a #UD fault. 


INSTRUCTION SET REFERENCE, V-Z 


Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 


ModRM.rm is different than 100b. 


This instruction has special disp8*N and alignment rules. N is considered to be the size of a single vector element. 


The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 


ignored. 


The instruction will #UD fault if the destination vector zmm1 is the same as index vector VINDEX. The instruction 


will #UD fault if the kO mask register is specified. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 


VINDEX stands for the memory operand vector of indices (a vector register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 
DISP is the optional 1 or 4 byte displacement 


VGATHERDPS (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
THEN DEST[i+31:i] = 
MEM[BASE_ADDR + 
SignExtend(VINDEX[i+31:i]) * SCALE + DISP] 
k1[j] := 0 
ELSE *DEST[i+31:i] := remains unchanged* 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 


VGATHERDPD (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1{j] 
THEN DEST[i+63:i] = MEM[BASE_ADDR + 
SignExtend(VINDEX[k+31:k]) * SCALE + DISP] 
k1[j] := 0 
ELSE *DEST[i+63:i] := remains unchanged* 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VGATHERDPD 
VGATHERDPD 
VGATHERDPD 
VGATHERDPD 
VGATHERDPS 
VGATHERDPS 
VGATHERDPS 


GATHERDPS __m128_mm_mmask_i32gather_ps(__m128 s,__ mmask8 k, 


m512d_mm512_i32gather_pd(__m256i vdx, void * base, int scale); 


m512d_mm512_mask_i32gather_pd(__m512ds,___ mmask8 k, __m256i vdx, void * base, int scale); 
m256d_mm256_mmask_i32gather_pd(__m256ds,__ mmask8 k, __m128i vdx, void * base, int scale); 


m128d_mm_mmask_i32gather_pd(__m128ds,__ mmask8 k, __m128i vdx, void * base, int scale); 


m512_mm512_i32gather_ps(__m512i vdx, void * base, int scale); 


m512_mm512_mask_i32gather_ps(__m512s,__ mmask16 k,__m512i vdx, void * base, int scale); 


m256 _mm256_mmask_i32gather_ps(__m256 s,__ mmask8 k,__m256i vdx, void * base, int scale); 


m1 28i vdx, void * base, int scale); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 
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VGATHERQPS/VGATHERQPD—Gather Packed Single, Packed Double with Signed Qword Indices 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F38.W0 93 /vsib A VIV AVX512VL_ | Using signed qword indices, gather single-precision 
VGATHEROPS xmm1 {k1}, vm64x AVX512F floating-point values from memory using k1 as completion 
mask. 
EVEX.256.66.0F38.W0 93 /vsib A VIV AVX512VL_ | Using signed qword indices, gather single-precision 
VGATHERQPS xmm1 {k1}, vm64y AVX512F floating-point values from memory using k1 as completion 
mask. 
EVEX.512.66.0F38.W0 93 /vsib A VIV AVX512F Using signed qword indices, gather single-precision 
VGATHERQPS ymm1 {k1}, vm64z floating-point values from memory using k1 as completion 
mask. 
EVEX.128.66.0F38.W1 93 /vsib A VIV AVX512VL_ | Using signed qword indices, gather float64 vector into 
VGATHERQPD xmm1 {k1}, vm64x AVX512F float64 vector xmm1 using k1 as completion mask. 
EVEX.256.66.0F38.W1 93 /vsib A VIV AVX512VL_ | Using signed qword indices, gather float64 vector into 
VGATHERQPD ymm1 {k1}, vm64y AVX512F float64 vector ymm1 using k1 as completion mask. 
EVEX.512.66.0F38.W1 93 /vsib A VIV AVX512F Using signed qword indices, gather float64 vector into 
VGATHERQPD zmm1 {k1}, vm64z float64 vector zmm1 using k1 as completion mask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
BaseReg (R): VSIB:base, 
A Tuple1 Scalar ModRM:reg (w) aoe VSIB:index NA NA 
Description 


A set of 8 single-precision/double-precision faulting-point memory locations pointed by base address BASE_ADDR 
and index vector V_INDEX with scale SCALE are gathered. The result is written into vector a register. The elements 
are specified via the VSIB (i.e., the index register is a vector register, holding packed indices). Elements will only 

be loaded if their corresponding mask bit is one. If an element’s mask bit is not set, the corresponding element of 
the destination register is left unchanged. The entire mask register will be set to zero by this instruction unless it 

triggers an exception. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask register (k1) are partially updated; those elements that have been gathered are placed into 
the destination register and have their mask bits set to zero. If any traps or interrupts are pending from already 
gathered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruc- 
tion breakpoint is not re-triggered when the instruction is continued. 


If the data element size is less than the index element size, the higher part of the destination register and the mask 
register do not correspond to any elements being gathered. This instruction sets those higher parts to zero. It may 
update these unused elements to one or both of those registers even if the instruction triggers an exception, and 
even if the instruction triggers the exception before gathering any elements. 


Note that: 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination zmm will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 
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¢ Elements may be gathered in any order, but faults must be delivered in a right-to left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 

¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 

* Not valid with 16-bit effective addresses. Will deliver a #UD fault. 


Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 
ModRM.rm is different than 100b. 


This instruction has special disp8*N and alignment rules. N is considered to be the size of a single vector element. 
The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 
ignored. 


The instruction will #UD fault if the destination vector zmm1 is the same as index vector VINDEX. The instruction 
will #UD fault if the kO mask register is specified. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 
VINDEX stands for the memory operand vector of indices (a ZMM register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1 or 4 byte displacement 


VGATHERQPS (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = 
MEM[BASE_ADDR + (VINDEX[k+63:k]) * SCALE + DISP] 
k1[j] :=0 
ELSE *DEST[i+31:i] := remains unchanged* 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL/2] := 0 


VGATHERQPD (EVEX encoded version) 


(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] := MEM[BASE_ADDR + (VINDEX[i+63:i]) * SCALE + DISP] 
k1[j] = 0 
ELSE *DEST[i+63:i] := remains unchanged* 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VGATHERQPD 
VGATHERQPD 
VGATHERQPD 
VGATHERQPD 
VGATHERQPS 
VGATHERQPS 
VGATHERQPS 
VGATHERQPS 


m512d 


mm512_i64gather_pd(__m512i vdx, void * base, int scale); 


m512d 


m256d 


mm512_mask_i64gather_pd(__m512ds,__mmask8 k,___m512i vdx, void * base, int scale); 
mm256_mask_i64gather_pd(__m256d s,__ mmask8 k, __ m256i vdx, void * base, int scale); 


m128d 


mm_mask_i64gather_pd(__m128ds,__ mmask8 k,__m128i vdx, void * base, int scale); 


m256 


mm512_i64gather_ps(_m512i vdx, void * base, int scale); 


m256 


mm512_mask_i64gather_ps(__m256 s,__ mmask16 k,___m512i vdx, void * base, int scale); 


m128 


mm256_mask_i64gather_ps(__m128 s,__ mmask8 k,___ m256i vdx, void * base, int scale); 


m128 


mm_mask_i64gather_ps(__m128s,__mmask8 k,__m128i vdx, void * base, int scale); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 
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VGETEXPPD—Convert Exponents of Packed DP FP Values to DP FP Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W1 42 /r | A VIV AVX512VL | Convert the exponent of packed double-precision floating-point 
VGETEXPPD xmm1 {k1}{z}, AVX512F values in the source operand to DP FP results representing 
xmm2/m1 28/m64bcst unbiased integer exponents and stores the results in the 
destination register. 
EVEX.256.66.0F38.W1 42 /r | A VIV AVX512VL | Convert the exponent of packed double-precision floating-point 
VGETEXPPD ymm1 {k1}{Z}, AVX512F values in the source operand to DP FP results representing 
ymm2/m256/m64bcst unbiased integer exponents and stores the results in the 
destination register. 
EVEX.512.66.0F38.W1 42 /r | A VIV AVX512F Convert the exponent of packed double-precision floating-point 
VGETEXPPD zmm1 {k1}{Z}, values in the source operand to DP FP results representing 
zmm2/m512/m64bcst{sae} unbiased integer exponents and stores the results in the 
destination under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Extracts the biased exponents from the normalized DP FP representation of each qword data element of the source 
operand (the second operand) as unbiased signed integer value, or convert the denormal representation of input 
data to unbiased negative integer values. Each integer value of the unbiased exponent is converted to double- 
precision FP value and written to the corresponding qword elements of the destination operand (the first operand) 
as DP FP numbers. 


The destination operand is aZMM/YMM/XMM register and updated under the writemask. The source operand can 
be a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from 
a 64-bit memory location. 


EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Each GETEXP operation converts the exponent value into a FP number (permitting input value in denormal repre- 
sentation). Special cases of input values are listed in Table 5-5. 


The formula is: 
GETEXP(x) = floor(log>(|x|)) 
Notation floor(x) stands for the greatest integer not exceeding real number x. 


Table 5-5. VGETEXPPD/SD Special Cases 


Input Operand Result Comments 

srcl = NaN QNaN(src1) 

0 < [src1| < INF floor(loga(|src1])) = z mina a #DE 
| src1| = +INF +INF 

|src1]=0 -INF 
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Operation 


NormalizeExp TinyDPFP(SRC[63:0]) 
{ 
// \bit is the hidden integral bit of a FP number. In case of denormal number it has the value of ZERO. 
Src.Jbit := 0; 
Dst.exp := 1; 
Dst.fraction := SRC[51:0]; 
WHILE(Src.Jbit = 0) 


{ 
Src.Jbit := Dst.fraction[51]; // Get the fraction MSB 
Dst.fraction := Dst.fraction << 1; // One bit shift left 
Dst.exp-- ; // Decrement the exponent 
} 
Dst.fraction := 0; // zero out fraction bits 
Dst.sign := 1; // Return negative sign 
TMP[63:0] := MXCSR.DAZ? 0: (Dst.sign << 63) OR (Dst.exp << 52) OR (Dst.fraction) ; 
Return (TMP[63:0}); 
} 
Convert€xpDPFP(SRC[63:0]) 
{ 
Src.sign := 0; // Zero out sign bit 
Src.exp := SRC[62:52]; 
Src.fraction := SRC[51:0); 
// Check for NaN 
IF (SRC = NaN) 
IF (SRC = SNAN ) SET IE; 
Return QNAN(SRC); 
} 
// Check for +INF 
IF (SRC = +INF) Return (SRC); 
// check if zero operand 
IF ((Src.exp = 0) AND ((Src.fraction = 0) OR (MXCSR.DAZ = 1))) Return (-INF); 
} 
ELSE // check if denormal operand (notice that MXCSR.DAZ = 0) 
{ 
IF ((Src.exp = 0) AND (Src.fraction != 0)) 
{ 
TMP[63:0] := NormalizeExpTinyDPFP(SRC[63:0)) ; // Get Normalized Exponent 
Set #DE 
} 
ELSE // exponent value is correct 
TMP[63:0] := (Src.sign << 63) OR (Src.exp << 52) OR (Src.fraction) ; 
} 
TMP := SAR(TMP, 52); // Shift Arithmetic Right 
TMP := TMP - 1023; // Subtract Bias 
Return Cvtl2D(TMP); // Convert INT to Double-Precision FP number 
} 
} 
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VGETEXPPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN 
DEST[i+63:i] := 
Convert€xpDPFP(SRC[63:0]) 
ELSE 
DEST[i+63:i] := 
Convert€xpDPFP(SRC[i+63:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VGETEXPPD __m512d_mm512_getexp_pd(__m512d a); 

VGETEXPPD __m512d_mm512_mask_getexp_pd(__m512ds,__mmask8 k,__m512d a); 
VGETEXPPD __m512d_mm512_maskz_getexp_pd(__mmask8 k,___m512d a); 

VGETEXPPD __m512d_mm512_getexp_round_pd(__m512d a, int sae); 

VGETEXPPD __m512d_mm512_mask_getexp_round_pd(__m512ds,__mmask8 k,___m512d a, int sae); 
VGETEXPPD __m512d_mm512_maskz_getexp_round_pd(__mmask8 k,___m512d a, int sae); 
VGETEXPPD __m256d _mm256_getexp_pd(__m256d a); 

VGETEXPPD __m256d _mm256_mask_getexp_pd(__m256d s,__ mmask8 k,___ m256d a); 
VGETEXPPD __m256d _mm256_maskz_getexp_pd(__mmask8 k,___ m256d a); 

VGETEXPPD __m128d _mm_getexp_pd(__m128d a); 

VGETEXPPD __m128d_mm_mask_getexp_pd(__m128ds,___ mmask8 k,___m128d a); 
VGETEXPPD __m128d _mm_maskz_getexp_pd(__mmask8 k, __m128d a); 


SIMD Floating-Point Exceptions 
Invalid, Denormal 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VGETEXPPS—Convert Exponents of Packed SP FP Values to SP FP Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W0 42 /r A VIV AVX512VL | Convert the exponent of packed single-precision floating-point 
VGETEXPPS xmm1 {k1}{Z}, AVX512F values in the source operand to SP FP results representing 
xmme2/m128/m32bcst unbiased integer exponents and stores the results in the 
destination register. 
EVEX.256.66.0F38.W0 42 /r A VIV AVX512VL | Convert the exponent of packed single-precision floating-point 
VGETEXPPS ymm1 {k1}{z}, AVX512F values in the source operand to SP FP results representing 
ymm2/m256/m32bcst unbiased integer exponents and stores the results in the 
destination register. 
EVEX.512.66.0F38.W0 42 /r A VIV AVX512F Convert the exponent of packed single-precision floating-point 
VGETEXPPS zmm1 {k1}{Z}, values in the source operand to SP FP results representing 
zmm2/m512/m32bcst{sae} unbiased integer exponents and stores the results in the 
destination register. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Extracts the biased exponents from the normalized SP FP representation of each dword element of the source 
operand (the second operand) as unbiased signed integer value, or convert the denormal representation of input 
data to unbiased negative integer values. Each integer value of the unbiased exponent is converted to single-preci- 
sion FP value and written to the corresponding dword elements of the destination operand (the first operand) as SP 
FP numbers. 


The destination operand is a ZMM/YMM/XMM register and updated under the writemask. The source operand can 
be a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from 
a 32-bit memory location. 


EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Each GETEXP operation converts the exponent value into a FP number (permitting input value in denormal repre- 
sentation). Special cases of input values are listed in Table 5-6. 


The formula is: 
GETEXP(x) = floor(logs(|x|)) 
Notation floor(x) stands for maximal integer not exceeding real number x. 


Software usage of VGETEXPxx and VGETMANTxx instructions generally involve a combination of GETEXP operation 
and GETMANT operation (see VGETMANTPD). Thus VGETEXPxx instruction do not require software to handle SIMD 
FP exceptions. 


Table 5-6. VGETEXPPS/SS Special Cases 
Input Operand Result Comments 
srcl = NaN QNaN(src1) 


If (SRC = SNaN) then #IE 


0 < |src1| < INF floor(loga(|src1|)) If (SRC = denormal) then #DE 
| src1| = +INF +INF 
| src1| =O -INF 
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Figure 5-14 illustrates the VGETEXPPS functionality on input values with normalized representation. 


31] 30] 29} 28] 27] 26} 25] 24 | 23} 22] 21] 20} 19| 18] 17| 16] 15] 14] 13] 1211/10} 9} 8} 7} 6} 5} 4) 3} 2} 1] 0 


Src = 2M 


SAR Src, 23 = 080h 


-Bias 


Tmp - Bias = 1 


Cvt_PI2PS(01h) = 2°0 


Figure 5-14. VGETEXPPS Functionality On Normal Input values 


Operation 


NormalizeExpTinySPFP(SRC[31:0]) 
{ 
// \bit is the hidden integral bit of a FP number. In case of denormal number it has the value of ZERO. 
Src.Jbit := 0; 
Dst.exp := 1; 
Dst.fraction := SRC[22:0); 
WHILE(Src.Jbit = 0) 


{ 
Src.Jbit := Dst.fraction[22]; // Get the fraction MSB 
Dst.fraction := Dst.fraction << 1; // One bit shift left 
Dst.exp- ; // Decrement the exponent 

} 

Dst.fraction := 0; // zero out fraction bits 

Dst.sign := 1; // Return negative sign 


TMP[31:0] := MXCSR.DAZ? 0: (Dst.sign << 31) OR (Dst.exp << 23) OR (Dst.fraction) ; 
Return (TMP[31:0)); 
} 
ConvertE€xpSPFP(SRC[31:0]) 
{ 
Src.sign := 0; // Zero out sign bit 
Src.exp := SRC[30:23]; 
Src.fraction := SRC[22:0); 
// Check for NaN 
IF (SRC = NaN) 
{ 
IF (SRC = SNAN ) SET IE; 
Return QNAN(SRC); 


} 
// Check for +INF 
IF (SRC = +INF) Return (SRC); 


// check if zero operand 
IF ((Src.exp = 0) AND ((Src.fraction = 0) OR (MXCSR.DAZ = 1))) Return (-INF); 


ELSE // check if denormal operand (notice that MXCSR.DAZ = 0) 
{ 
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IF ((Src.exp = 0) AND (Src.fraction != 0)) 


{ 
TMP[31:0] := NormalizeExpTinySPFP(SRC[31:0)) ; // Get Normalized Exponent 
Set #DE 

} 

ELSE // exponent value is correct 

{ 
TMP[31:0] := (Src.sign << 31) OR (Src.exp << 23) OR (Src.fraction) ; 

} 

TMP := SAR(TMP, 23); // Shift Arithmetic Right 

TMP := TMP - 127; // Subtract Bias 

Return Cvtl2D(TMP); // Convert INT to Single-Precision FP number 


} 


VGETEXPPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN 
DEST[i+31:i] := 
ConvertE€xpSPFP(SRC[31:0]) 
ELSE 
DEST[i+31:i] := 
Convert€xpSPFP(SRC[i+31:i]) 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VGETEXPPS 


m512 


mm512_getexp_ps(__m512 a); 


VGETEXPPS 


m512 


mm512_mask_getexp_ps(__m512s, 


VGETEXPPS 


m512 


mm512_maskz_getexp_ps( 


VGETEXPPS 


m512 


mm512_getexp_round_ps( 


VGETEXPPS 


m512 


mm512_mask_getexp_round_ps( 


VGETEXPPS 


m512 


mm512_maskz_getexp_round_ps( 


mmask16 k,__m512 a); 


mmask16 k,__m512 a); 
m512 a, int sae); 
m512s,__mmask16 k,__m512 a, int sae); 


mmask16 k,__m512 a, int sae); 


VGETEXPPS 


m256 


mm256_getexp_ps(__m256 a); 


VGETEXPPS 


m256 


mm256_mask_getexp_ps(__m256 s, 


VGETEXPPS 


m256 


mm256_maskz_getexp_ps( 


VGETEXPPS 


m128 


mm_getexp_ps(__m128 a); 


VGETEXPPS 


mi28 


mm_mask_getexp_ps( 


mmask8 k, 


mmask8 k, 
m256 a); 


m256 a); 


m128s,__mmask8 k,___m128 a); 


VGETEXPPS 


m128 


mm_maskz_getexp_ps( 


mmask8 k, 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
If EVEX.vvvv != 1111B. 


#UD 
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VGETEXPSD—Convert Exponents of Scalar DP FP Values to DP FP Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.W1 43 /r A VV AVX512F | Convert the biased exponent (bits 62:52) of the low double- 
VGETEXPSD xmm1 {k1}{Z}, precision floating-point value in xmm3/m64 to a DP FP value 
xmm2, xmm3/m64{sae} representing unbiased integer exponent. Stores the result to 
the low 64-bit of xmm1 under the writemask k1 and merge 
with the other elements of xmm2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Extracts the biased exponent from the normalized DP FP representation of the low qword data element of the 
source operand (the third operand) as unbiased signed integer value, or convert the denormal representation of 
input data to unbiased negative integer values. The integer value of the unbiased exponent is converted to double- 
precision FP value and written to the destination operand (the first operand) as DP FP numbers. Bits (127:64) of 
the XMM register destination are copied from corresponding bits in the first source operand. 


The destination must be a XMM register, the source operand can be a XMM register or a float64 memory location. 


If writemasking is used, the low quadword element of the destination operand is conditionally updated depending 
on the value of writemask register k1. If writemasking is not used, the low quadword element of the destination 
operand is unconditionally updated. 


Each GETEXP operation converts the exponent value into a FP number (permitting input value in denormal repre- 
sentation). Special cases of input values are listed in Table 5-5. 


The formula is: 
GETEXP(x) = floor(logo(|x|)) 
Notation floor(x) stands for maximal integer not exceeding real number x. 


Operation 
// NormalizeExpTinyDPFP(SRC[63:0)) is defined in the Operation section of VGETEXPPD 


// ConvertExpDPFP(SRC[63:0)) is defined in the Operation section of VGETEXPPD 


VGETEXPSD (EVEX encoded version) 


IF k1[0] OR *no writemask* 
THEN DEST[63:0] := 
Convert€xpDPFP(SRC2[63:0]) 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VGETEXPSD 


m128d 


mm. 


getexp_sd(__m128da,__m128d b); 


VGETEXPSD 


m128d 


mm 


mask_getexp_sd(__m128ds,__mmask8 k,___m128da,__m128d b); 


VGETEXPSD 


m128d 


mm. 


maskz_getexp_sd(__mmask8 k,__m128d a,__m128d b); 


VGETEXPSD 


m128d 


mm. 


getexp_round_sd(__m128da,__m128d, int sae); 


VGETEXPSD 


m128d 


mm. 


mask_getexp_round_sd(__m128d s,__mmask8 k,__m128d a,__m128d b, int sae); 


VGETEXPSD 


m128d 


mm. 


maskz_getexp_round_sd(__mmask8 k,__m128da,_m128db, int sae); 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VGETEXPSS—Convert Exponents of Scalar SP FP Values to SP FP Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
EVEX.LLIG.66.0F38.W0 43 /r A VV AVX512F Convert the biased exponent (bits 30:23) of the low single- 
VGETEXPSS xmm1 {k1}{z}, xmm2, precision floating-point value in xmm3/m32 to a SP FP 
xmm3/m32{sae} value representing unbiased integer exponent. Stores the 
result to xmm1 under the writemask k1 and merge with the 
other elements of xmme2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Extracts the biased exponent from the normalized SP FP representation of the low doubleword data element of the 
source operand (the third operand) as unbiased signed integer value, or convert the denormal representation of 
input data to unbiased negative integer values. The integer value of the unbiased exponent is converted to single- 
precision FP value and written to the destination operand (the first operand) as SP FP numbers. Bits (127:32) of 
the XMM register destination are copied from corresponding bits in the first source operand. 

The destination must be a XMM register, the source operand can be a XMM register or a float32 memory location. 


If writemasking is used, the low doubleword element of the destination operand is conditionally updated depending 
on the value of writemask register k1. If writemasking is not used, the low doubleword element of the destination 
operand is unconditionally updated. 


Each GETEXP operation converts the exponent value into a FP number (permitting input value in denormal repre- 
sentation). Special cases of input values are listed in Table 5-6. 

The formula is: 

GETEXP(x) = floor(logo(|x|)) 

Notation floor(x) stands for maximal integer not exceeding real number x. 

Software usage of VGETEXPxx and VGETMANTxx instructions generally involve a combination of GETEXP operation 


and GETMANT operation (see VGETMANTPD). Thus VGETEXPxx instruction do not require software to handle SIMD 
FP exceptions. 


Operation 


// NormalizeExpTinySPFP(SRC[31:0]) is defined in the Operation section of VGETEXPPS 
// ConvertExpSPFP(SRC[31:0]) is defined in the Operation section of VGETEXPPS 


VGETEXPSS (EVEX encoded version) 
IF k1[0] OR *no writemask* 
THEN DEST[31:0] := 
Convert€xpDPFP(SRC2[31:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0]:= 0 
Fl 
Fl; 
ENDFOR 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] = 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


mi28 a,__m128b); 


mmask8 k,__m128a,__m128 b); 


m128s,__mmask8 k,__m128a,__m128b, int sae); 


VGETEXPSS __m128_mm m128 b); 

VGETEXPSS __m128_mm_mask_getexp_ss(__m128s,__ mmask8 k, 
VGETEXPSS __m128_mm_maskz_getexp_ss( 

VGETEXPSS __m128_mm_getexp_round_ss(__m128 a,__m128}, int sae); 
VGETEXPSS __m128_mm_mask_getexp_round_ss( 

VGETEXPSS __m128_mm_maskz_getexp_round_ss( 


mmask8 k,__m128 a,__m128 b, int sae); 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 


See Table 2-47, “Type E3 Class Exception Conditions”. 
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VGETMANTPD—Extract Float64 Vector of Normalized Mantissas from Float64 Vector 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W1 26 /r ib A VN AVX512VL | Get Normalized Mantissa from float64 vector 
VGETMANTPD xmm1 {k1}{Z}, AVX512F xmm2/m128/m64bcst and store the result in xmm1, using 
xmm2/m128/m64bcst, imm8 immé for sign control and mantissa interval normalization, 
under writemask. 
EVEX.256.66.0F3A.W1 26 /r ib A VN AVX512VL | Get Normalized Mantissa from float64 vector 
VGETMANTPD ymm1 {k1}{Z}, AVX512F ymm2/m256/m64bcst and store the result in ymm1, using 
ymm2/m256/m64bcst, imm8 immé for sign control and mantissa interval normalization, 
under writemask. 
EVEX.512.66.0F3A.W1 26 /r ib A VN AVX512F Get Normalized Mantissa from float64 vector 
VGETMANTPD zmm1 {k1}{z}, zmm2/m512/m64bcst and store the result in zmm1, using 
zmm2/m512/m64bcst{sae}, immé for sign control and mantissa interval normalization, 
imm8 under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Convert double-precision floating values in the source operand (the second operand) to DP FP values with the 
mantissa normalization and sign control specified by the imm§8 byte, see Figure 5-15. The converted results are 
written to the destination operand (the first operand) using writemask ki. The normalized mantissa is specified by 
interv (imm8[1:0]) and the sign control (sc) is specified by bits 3:2 of the immediate byte. 


The destination operand is a ZMM/YMM/XMM register updated under the writemask. The source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 64- 
bit memory location. 


7 6 5 4 3 2 1 0 
imm8 Must Be Zero Sign Control (SC) Normaiization Interval 
Z Imm8[1:0] = 00b : Interval is [ 1, 2) 
Imm8[3:2] = 00b : sign(SRC) Imm8[1:0] = 01b : Interval is [1/2, 2) 
Imm8[3:2] = 01b:0 Imm8[1:0] = 10b : Interval is [ 1/2, 1) 
Imm8[3] = 1b : qNan_Indefinite if sign(SRC) != 0, regardless of imm8[2]. Imm8[1:0] = 11b : Interval is [3/4, 3/2) 


Figure 5-15. Imm8 Controls for VGETMANTPD/SD/PS/SS 


For each input DP FP value x, The conversion operation is: 


GetMant(x) = +£2‘|x.significand| 
where: 


1 <= |x.significand| < 2 


Unbiased exponent k depends on the interval range defined by interv and whether the exponent of the source is 
even or odd. The sign of the final result is determined by sc and the source sign. 
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If interv != 0 then k = -1, otherwise K = 0. The encoded value of imm8[1:0] and sign control are shown in 
Figure 5-15. 


Each converted DP FP result is encoded according to the sign control, the unbiased exponent k (adding bias) anda 
mantissa normalized to the range specified by interv. 


The GetMant() function follows Table 5-7 when dealing with floating-point special numbers. 


This instruction is writemasked, so only those elements with the corresponding bit set in vector mask register ki 
are computed and stored into the destination. Elements in zmmi with the corresponding bit clear in ki retain their 
previous values. 


Note: EVEX.vvvv is reserved and must be 1111b; otherwise instructions will #UD. 


Table 5-7. GetMant() Special Float Values Behavior 


Input Result Exceptions / Comments 
NaN QNaN(SRC) Ignore interv 
If (SRC = SNaN) then #1E 
+0 1.0 Ignore interv 
+0 1.0 Ignore interv 
-0 IF (SC[O]) THEN +1.0 Ignore interv 
ELSE -1.0 
- IF (SC[1]) THEN {QNaN_Indefinite} Ignore interv 
ELSE { If (SC[1]) then #IE 
IF (SC[O]) THEN +1.0 
ELSE -1.0 
negative SC[1] ? QNaN_Indefinite : Getmant(SRC)' If (SC[1]) then #IE 
NOTES: 


1. In case SC[1]==0, the sign of Getmant(SRC) is declared according to SC[O}. 


Operation 


def getmant_fp64(src, sign_control, normalization_interval): 

bias := 1023 
dst.sign := sign_control[O] ? 0: src.sign 
signed_one := sign_control[O] ? +1.0:-1.0 
dst.exp := src.exp 
dst.fraction := src.fraction 
zero := (dst.exp = O) and ((dst.fraction = 0) or (MXCSR.DAZ=1)) 
denormal := (dst.exp = 0) and (dst.fraction != 0) and (MXCSR.DAZ=0) 
infinity := (dst.exp = Ox7FF) and (dst.fraction = 0) 
nan := (dst.exp = Ox7FF) and (dst.fraction != 0) 
src_signaling := src.fraction[51] 
snan := nan and (src_signaling = 0) 
positive := (src.sign = 0) 
negative := (src.sign = 1) 
if nan: 

if snan: 

MXCSRLIE := 1 
return qnan(src) 


if positive and (zero or infinity): 
return 1.0 

if negative: 
if zero: 
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return signed_one 
if infinity: 
if sign_control[1]: 
MXCSR.IE := 1 
return QNaN_Indefinite 
return signed_one 
if sign_control[1]: 
MXCSR.IE := 1 
return QNaN_Indefinite 


if denormal: 
if MXCSR.DAZ: 
dst.fraction := 0 
else: 
jbit = 0 
dst.exp := bias 
while jbit = 0: 
jbit = dst.fraction[51] 
dst.fraction := dst.fraction << 1 
dst.exp : = dst.exp - 1 
MXCSR.DE := 1 


unbiased_exp := dst.exp - bias 

odd_exp := unbiased_exp[0] 

signaling_bit := dst.fraction[51] 

if normalization_interval = ObOO: 
dst.exp := bias 

else if normalization_interval = Ob0O1: 
dst.exp := odd_exp ? bias-1 : bias 

else if normalization_interval = 0b10: 
dst.exp := bias-1 

else if normalization_interval = 0b11: 
dst.exp := signaling_bit ? bias-1 : bias 

return dst 


VGETMANTPD (EVEX encoded versions) 
VGETMANTPD dest{k1}, src, imm8 

VL = 128, 256, or 512 

KL:= VL/64 

sign_control := imm8[3:2] 
normalization_interval := imm8[1:0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
IF SRC is memory and (EVEX.b = 1): 
tsrc := src.double[0] 
ELSE: 
tsrc := src.double{i] 
DEST.double[i] := getmant_fp64(tsrc, sign_control, normalization_interval) 
ELSE IF *zeroing*: 
DEST.double[i] := 0 
//else DEST.double[i] remains unchanged 


DEST[MAX_VL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 
VGETMANTPD 


m512d 


mm512 


getmant_pd( 


m512d 


mm512 


mask_getmant_pd( 


m512d a, enum intv, enum sgn); 


m512ds,__mmask8 k,__m512d a, enum intv, enum sgn); 


m512d 


mm512 


maskz_getmant_pd( 


mmask8 k, __m512d a, enum intv, enum sgn); 


m512d 


mm512 


getmant_round_pd( 


m512d 


mm512 


mask_getmant_round_pd( 


m512d a, enum intv, enum sgn, int r); 
m512ds,__mmask8 k,__m512d a, enum intv, enum sgn, int r); 


m512d 


mm512 


maskz_getmant_round_pd( 


mmask8 k,___m512d a, enum intv, enum sgn, int r); 


m256d 


mm256 


getmant_pd( 


m256d 


mm256_mask_getmant_pd( 


m256d a, enum intv, enum sgn); 


m256d s,__ mmask8 k,__ m256d a, enum intv, enum sgn); 


m256d 


mm256_maskz_getmant_pd( 


mmask8 k, __m256d a, enum intv, enum sgn); 


m128d 


mm_getmant_pd( 


m128d 


mm_mask_getmant_pd( 


m1 28d a, enum intv, enum sgn); 


m128d 


mm_maskz_getmant_pd( 


m128ds,__mmask8 k,___m128d a, enum intv, enum sgn); 
mmask8 k,___m128d a, enum intv, enum sgn); 


SIMD Floating-Point Exceptions 


Denormal, Invalid 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 


#UD 
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VGETMANTPS—E€Extract Float32 Vector of Normalized Mantissas from Float32 Vector 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 26 /rib | A VIN AVX512VL | Get normalized mantissa from float32 vector 
VGETMANTPS xmm1 {k1}{Z}, AVX512F xmm2/m128/m32bcst and store the result in xmm1, using 
xmm2/m128/m32bcst, imm8 immé for sign control and mantissa interval normalization, 
under writemask. 
EVEX.256.66.0F3A.WO 26 /rib | A VIN AVX512VL | Get normalized mantissa from float32 vector 
VGETMANTPS ymm1 {k1}{z}, AVX512F ymm2/m256/m32bcst and store the result in ymm1, using 
ymm2/m256/m32bcst, imm8 immé for sign control and mantissa interval normalization, 
under writemask. 
EVEX.512.66.0F3A.WO 26 /rib | A VIV AVX512F Get normalized mantissa from float32 vector 
VGETMANTPS zmm1 {k1}{Z}, zmm2/m512/m32bcst and store the result in zmm1, using 
zmm2/m512/m32bcst{sae}, immé for sign control and mantissa interval normalization, 
imm8 under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Convert single-precision floating values in the source operand (the second operand) to SP FP values with the 
mantissa normalization and sign control specified by the imm§8 byte, see Figure 5-15. The converted results are 
written to the destination operand (the first operand) using writemask ki. The normalized mantissa is specified by 
interv (imm8[1:0]) and the sign control (sc) is specified by bits 3:2 of the immediate byte. 


The destination operand is a ZMM/YMM/XMM register updated under the writemask. The source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a 32- 
bit memory location. 


For each input SP FP value x, The conversion operation is: 
GetMant(x) = +£2‘|x.significand| 
where: 


1 <= |x.significand| < 2 


Unbiased exponent k depends on the interval range defined by interv and whether the exponent of the source is 
even or odd. The sign of the final result is determined by sc and the source sign. 

if interv != 0 then k = -1, otherwise K = O. The encoded value of imm8[1:0] and sign control are shown 
in Figure 5-15. 


Each converted SP FP result is encoded according to the sign control, the unbiased exponent k (adding bias) anda 
mantissa normalized to the range specified by interv. 


The GetMant() function follows Table 5-7 when dealing with floating-point special numbers. 


This instruction is writemasked, so only those elements with the corresponding bit set in vector mask register ki 
are computed and stored into the destination. Elements in zmmi with the corresponding bit clear in k1 retain their 
previous values. 


Note: EVEX.vvvv is reserved and must be 1111b, VEX.L must be 0; otherwise instructions will #UD. 


VGETMANTPS—Extract Float32 Vector of Normalized Mantissas from Float32 Vector Vol.2C 5-281 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


def getmant_fp32(src, sign_control, normalization_interval): 

bias := 127 
dst.sign := sign_control[O] ? 0: src.sign 
signed_one := sign_control[O] ? +1.0:-1.0 
dst.exp := src.exp 
dst.fraction := src.fraction 
zero := (dst.exp = 0) and (dst.fraction = 0) 
denormal := (dst.exp = 0) and (dst.fraction != 0) 
infinity := (dst.exp = OxFF) and (dst.fraction = 0) 
nan := (dst.exp = OxFF) and (dst.fraction != 0) 
src_signaling := src.fraction[22] 
snan := nan and (src_signaling = 0) 
positive := (src.sign = 0) 
negative := (src.sign = 1) 
if nan: 

if snan: 

MXCSR.IE := 1 
return qnan(src) 


if positive and (zero or infinity): 
return 1.0 
if negative: 
if zero: 
return signed_one 
if infinity: 
if sign_control[1]: 
MXCSR.IE := 1 
return QNaN_Indefinite 
return signed_one 
if sign_control[1]: 
MXCSR.IE := 1 
return QNaN_Indefinite 


if denormal: 
if MXCSR.DAZ: 
dst.fraction := 0 
else: 
jbit = 0 
dst.exp := bias 
while jbit = 0: 
jbit := dst.fraction[22] 
dst.fraction := dst.fraction << 1 
dst.exp : = dst.exp - 1 
MXCSR.DE := 1 


unbiased_exp := dst.exp - bias 

odd_exp := unbiased_exp[0] 

signaling_bit := dst.fraction[22] 

if normalization_interval = ObOO: 
dst.exp := bias 

else if normalization_interval = Ob0O1: 
dst.exp := odd_exp ? bias-1 : bias 

else if normalization_interval = 0b10: 
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dst.exp := bias-1 
else if normalization_interval = 0b11: 
dst.exp := signaling_bit ? bias-1 : bias 
return dst 


VGETMANTPS (EVEX encoded versions) 
VGETMANTPS dest{k1}, src, imm8 

VL = 128, 256, or 512 

KL:= VL/32 

sign_control := imm8[3:2] 
normalization_interval := imm8[1:0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
IF SRC is memory and (EVEX.b = 1): 
tsrc := src.float[O] 
ELSE: 
tsrc := src.float[i] 


DEST. float[i] := getmant_fp32(tsrc, sign_control, normalization_interval) 


ELSE IF *zeroing*: 
DEST. float[i] := 0 
//else DEST.float[i] remains unchanged 


DEST[MAX_VL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VGETMANTPS __m512_mm512_getmant_ps(__m512 a, enum intv, enum sgn); 
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VGETMANTPS __m512_mm512_mask_getmant_ps(__m512 s,__ mmask16 k,__m512 a, enum intv, enum sgn; 


VGETMANTPS __m512_mm512_maskz_getmant_ps(__mmask16 k, 


VGETMANTPS __m512_mm512_mask_getmant_round_ps(__m512 s, 


m512 a, enum intv, enum sgn); 
VGETMANTPS __m512_mm512_getmant_round_ps(__m512 a, enum intv, enum sgn, int r); 
mmask16 k,__m512 a, enum intv, enum sgn, int r); 


VGETMANTPS __m512_mm512_maskz_getmant_round_ps(__mmask16 k,___m512 a, enum intv, enum sgn, int r); 


VGETMANTPS __m256 _mm256_getmant_ps(_m256 a, enum intv, enum sgn); 


VGETMANTPS __m256_mm256_mask_getmant_ps(__m256 s,__ mmask8 k,__m256 a, enum intv, enum sgn); 
VGETMANTPS __m256 _mm256_maskz_getmant_ps(__mmask8 k,___m256 a, enum intv, enum sgn); 


VGETMANTPS __m128_mm_getmant_ps(__m128 a, enum intv, enum sgn); 


VGETMANTPS __m128_mm_mask_getmant_ps(__m128 s,__ mmask8 k,___m128 a, enum intv, enum sgn); 


VGETMANTPS __m128_mm_maskz_getmant_ps(__mmask8 k,___m128 a, enum intv, enum sgn); 


SIMD Floating-Point Exceptions 
Denormal, Invalid 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VGETMANTSD—Extract Float64 of Normalized Mantissas from Float64 Scalar 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.W1 27 /r ib A VIN AVX512F | Extract the normalized mantissa of the low float64 
VGETMANTSD xmm1 {k1}{z}, xmm2, element in xmm3/m64 using imm8 for sign control and 
xmm3/m64{sae}, imm8 mantissa interval normalization. Store the mantissa to 
xmm1 under the writemask k1 and merge with the 
other elements of xmm2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Convert the double-precision floating values in the low quadword element of the second source operand (the third 
operand) to DP FP value with the mantissa normalization and sign control specified by the imm8 byte, see 

Figure 5-15. The converted result is written to the low quadword element of the destination operand (the first 
operand) using writemask k1. Bits (127:64) of the XMM register destination are copied from corresponding bits in 
the first source operand. The normalized mantissa is specified by interv (imm8[1:0]) and the sign control (sc) is 
specified by bits 3:2 of the immediate byte. 


The conversion operation is: 
GetMant(x) = £2*|x.significand| 
where: 


1 <= |x.significand| < 2 


Unbiased exponent k depends on the interval range defined by interv and whether the exponent of the source is 
even or odd. The sign of the final result is determined by sc and the source sign. 

If interv != 0 then k = -1, otherwise K = 0. The encoded value of imm8[1:0] and sign control are shown in 
Figure 5-15. 

The converted DP FP result is encoded according to the sign control, the unbiased exponent k (adding bias) and a 
mantissa normalized to the range specified by interv. 

The GetMant() function follows Table 5-7 when dealing with floating-point special numbers. 


If writemasking is used, the low quadword element of the destination operand is conditionally updated depending 
on the value of writemask register k1. If writemasking is not used, the low quadword element of the destination 
operand is unconditionally updated. 
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// getmant_fp64(src, sign_control, normalization_interval) is defined in the operation section of VGETMANTPD 


VGETMANTSD (EVEX encoded version) 
SignCtrl[1:0] := IMM8[3:2]; 


Interv[1:0] := IMM8[1:0]; 


IF k1[0] OR *no writemask* 
THEN DEST[63:0] := 
getmant_fp64(src, sign_control, normalization_interval) 


ELSE 


IF *merging-masking* 


ELSE 


Fl 
Fl; 


; merging-masking 
THEN *DEST[63:0] remains unchanged* 
; zeroing-masking 


DEST[63:0] := 0 


DEST[127:64] := SRC1[127:64] 


DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VGETMANTSD 
VGETMANTSD 
VGETMANTSD 
VGETMANTSD 
VGETMANTSD 
VGETMANTSD 


m128d 


mm 


m128d 


mm 


getmant_sd(__m128d a,__m128 b, enum intv, enum sgn); 
mask_getmant_sd(__m128d s,__ mmask8 k,__m128d a, _m128d b, enum intv, enum sgn); 


m128d 


mm. 


maskz_getmant_sd(__mmask8 k,__m128 a, ___m128d b, enum intv, enum sgn); 


m128d 


mm. 


getmant_round_sd(__m128d a,__m128 b, enum intv, enum sgn, int r); 


m128d 


mm. 


mask_getmant_round_sd( 


m128ds,__mmask8 k,___m128d a,__m128d b, enum intv, enum sgn, int r); 


m128d 


mm. 


maskz_getmant_round_sd( 


mmask8 k,___m128d a,__m128d b, enum intv, enum sgn, int r); 


SIMD Floating-Point Exceptions 


Denormal, Invalid 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VGETMANTSS—Extract Float32 Vector of Normalized Mantissa from Float32 Vector 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.WO 27 /r ib A VIN AVX512F Extract the normalized mantissa from the low float32 
VGETMANTSS xmm1 {k1}{z}, xmm2, element of xmm3/m32 using imm8 for sign control and 
xmm3/m32{sae}, imm8 mantissa interval normalization, store the mantissa to 
xmm1 under the writemask k1 and merge with the 
other elements of xmme2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Convert the single-precision floating values in the low doubleword element of the second source operand (the third 
operand) to SP FP value with the mantissa normalization and sign control specified by the imm§8 byte, see 

Figure 5-15. The converted result is written to the low doubleword element of the destination operand (the first 
operand) using writemask k1. Bits (127:32) of the XMM register destination are copied from corresponding bits in 
the first source operand. The normalized mantissa is specified by interv (imm8[1:0]) and the sign control (sc) is 
specified by bits 3:2 of the immediate byte. 


The conversion operation is: 
GetMant(x) = £2*|x.significand| 
where: 


1 <= |x.significand| < 2 


Unbiased exponent k depends on the interval range defined by interv and whether the exponent of the source is 
even or odd. The sign of the final result is determined by sc and the source sign. 

If interv != 0 then k = -1, otherwise K = 0. The encoded value of imm8[1:0] and sign control are shown in 
Figure 5-15. 


The converted SP FP result is encoded according to the sign control, the unbiased exponent k (adding bias) and a 
mantissa normalized to the range specified by interv. 


The GetMant() function follows Table 5-7 when dealing with floating-point special numbers. 


If writemasking is used, the low doubleword element of the destination operand is conditionally updated depending 
on the value of writemask register k1. If writemasking is not used, the low doubleword element of the destination 
operand is unconditionally updated. 
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// getmant_fp32(src, sign_control, normalization_interval) is defined in the operation section of VGETMANTPS 


VGETMANTSS (EVEX encoded version) 
SignCtrl[1:0] := IMM8[3:2]; 


Interv[1:0] := IMM8[1:0]; 


IF k1[0] OR *no writemask* 


THEN DEST[31:0] := 


getmant_fp32(src, sign_control, normalization_interval) 


ELSE 


IF *merging-masking* 


ELSE 


Fl 
Fl; 


; merging-masking 
THEN *DEST[31:0] remains unchanged* 
; zeroing-masking 


DEST[31:0] := 0 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 


getmant_ss(__m128 a,__m128 b, enum intv, enum sgn); 
mask_getmant_ss(__m128s,__mmask8 k,__m128 a,__m128 b, enum intv, enum sgn); 


m128 b, enum intv, enum sgn); 


getmant_round_ss(_m128 a,__m128 b, enum intv, enum sgn, int r); 


m128s,__mmask8 k,__m128 a, 


mi28_mm 

mi28_mm 

m128 _mm_maskz_getmant_ss(__mmask8 k,__m128 a, 
mi28_mm 

m128 _mm_mask_getmant_round_ss( 

m128 __mm_maskz_getmant_round_ss( 


mmask8 k,___m128 a,__m128 b, enum intv, enum sgn, int r); 


SIMD Floating-Point Exceptions 


Denormal, Invalid 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VINSERTF 1 28/VINSERTF32x4/VINSERTF64x2/VINSERTF32x8/VINSERTF64x4—Insert Packed 
Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
VEX.256.66.0F3A.WO 18 /r ib A VIV AVX Insert 128 bits of packed floating-point values from 
VINSERTF128 ymm1, ymm2, xmm3/m128 and the remaining values from ymm2 
xmm3/m1 28, imm8 into ymm1. 
EVEX.256.66.0F3A.WO 18 /r ib C VIV AVX512VL | Insert 128 bits of packed single-precision floating- 
VINSERTF32X4 ymm1 {k1}{z}, ymm2, AVX512F point values from xmm3/m128 and the remaining 
xmm3/m128, imm8 values from ymm_2 into ymm1 under writemask k1. 
EVEX.512.66.0F3A.WO 18 /r ib C VIV AVX512F Insert 128 bits of packed single-precision floating- 
VINSERTF32X4 zmm1 {k1}{z}, zmm2, point values from xmm3/m128 and the remaining 
xmm3/m128, imm8 values from zmm2 into zmm1 under writemask k1. 
EVEX.256.66.0F3A.W1 18 /r ib B VIV AVX512VL | Insert 128 bits of packed double-precision floating- 
VINSERTF64X2 ymm1 {k1}{z}, ymm2, AVX512DQ | point values from xmm3/m128 and the remaining 
xmm3/m128, imm8 values from ymm_2 into ymm1 under writemask k1. 
EVEX.512.66.0F3A.W1 18 /r ib B VV AVX512DQ | Insert 128 bits of packed double-precision floating- 
VINSERTF64X2 zmm1 {k1}{z}, zmm2, point values from xmm3/m128 and the remaining 
xmm3/m128, imm8 values from zmm2 into zmm1 under writemask k1. 
EVEX.512.66.0F3A.WO 1A /r ib D VIN AVX512DQ | Insert 256 bits of packed single-precision floating- 
VINSERTF32X8 zmm1 {k1}{z}, zmm2, point values from ymm3/m256 and the remaining 
ymm3/m256, imm8 values from zmm_2 into zmm1 under writemask k1. 
EVEX.512.66.0F3A.W1 1A /r ib C VIV AVX512F Insert 256 bits of packed double-precision floating- 
VINSERTF64X4 zmm1 {k1}{z}, zmm2, point values from ymm3/m256 and the remaining 
ymm3/m256, imm8 values from zmm_2 into zmm1 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
B Tuple2 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s8 
C Tuple4 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
D Tuple8 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


VINSERTF128/VINSERTF32x4 and VINSERTF64x2 insert 128-bits of packed floating-point values from the second 
source operand (the third operand) into the destination operand (the first operand) at an 128-bit granularity offset 
multiplied by imm8[0] (256-bit) or imm8[1:0]. The remaining portions of the destination operand are copied from 
the corresponding fields of the first source operand (the second operand). The second source operand can be either 
an XMM register or a 128-bit memory location. The destination and first source operands are vector registers. 


VINSERTF32x4: The destination operand is a ZMM/YMM register and updated at 32-bit granularity according to the 
writemask. The high 6/7 bits of the immediate are ignored. 


VINSERTF64x2: The destination operand is a ZMM/YMM register and updated at 64-bit granularity according to the 
writemask. The high 6/7 bits of the immediate are ignored. 


VINSERTF32x8 and VINSERTF64x4 inserts 256-bits of packed floating-point values from the second source operand 
(the third operand) into the destination operand (the first operand) at a 256-bit granular offset multiplied by 
imm8[0]. The remaining portions of the destination are copied from the corresponding fields of the first source 
operand (the second operand). The second source operand can be either an YMM register or a 256-bit memory 
location. The high 7 bits of the immediate are ignored. The destination operand is a ZMM register and updated at 
32/64-bit granularity according to the writemask. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VINSERTF32x4 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC2[127:0] 
1: TMP_DEST[255:128] := SRC2[127:0] 
ESAC. 
Fl; 
IF VL= 512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC2[127:0] 
01: TMP_DEST[255:1 28] := SRC2[127:0] 
10: TMP_DEST[383:256] := SRC2[127:0] 
11: TMP_DEST[51 1:384] := SRC2[127:0] 
ESAC. 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VINSERTF64x2 (EVEX encoded versions) 
(KL, VL) = (4, 256), (8, 512) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC2[127:0] 
1: TMP_DEST[255:128] := SRC2[127:0] 
ESAC. 
Fl; 
IF VL= 512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC2[127:0] 
01: TMP_DEST[255:1 28] := SRC2[127:0] 
10: TMP_DEST[383:256] := SRC2[127:0] 
11: TMP_DEST[51 1:384] := SRC2[127:0] 
ESAC. 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
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IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VINSERTF32x8 (EVEX.U1.512 encoded version) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC2[255:0] 
1: TMP_DEST[511:256] := SRC2[255:0] 
ESAC. 


FOR j:=0TO015 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VINSERTF64x4 (EVEX.512 encoded version) 
VL=512 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
CASE (imm8[0]) OF 

0: TMP_DEST[255:0] := SRC2[255:0] 

1: TMP_DEST[511:256] := SRC2[255:0] 
ESAC. 


FOR j :=OTO7 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VINSERTF128 (VEX encoded version) 
TEMP[255:0] := SRC1[255:0] 
CASE (imm8[0]) OF 

0: TEMP[1 27:0] := SRC2[127:0] 

1: TEMP[255:128] := SRC2[127:0] 
ESAC 
DEST := TEMP 


Intel C/C++ Compiler Intrinsic Equivalent 


VINSERTF32x4 ___m512_mm512_insertf32x4(__m512 a,__m128b, int imm); 

VINSERTF32x4 __m512 _mm512_mask_insertf32x4(__m512 s,__mmask16 k,__m512 a,__m128 5, int imm); 
VINSERTF32x4 __m512 __mm512_maskz_insertf32x4(__mmask16 k,__m512 a,__m128, int imm); 
VINSERTF32x4 ___m256 _mm256_insertf32x4(__m256 a,__m128b, int imm); 

VINSERTF32x4 __m256 __mm256_mask_insertf32x4(__m256 s,__ mmask8 k,__ m256 a,__m128 }, int imm); 
VINSERTF32x4 __m256 _mm256_maskz_insertf32x4(__mmask8 k,__m256 a,__m128 b, int imm); 
VINSERTF32x8 __m512_mm512_insertf32x8(__m512 a,__m256 b, int imm); 

VINSERTF32x8 __m512_mm512_mask_insertf32x8(__m512 s,__mmask16 k,__m512 a,__m256 b, int imm); 
VINSERTF32x8 __m512_mm512_maskz_insertf32x8(__mmask16 k,__m512 a,__m256 b, int imm); 
VINSERTF64x2 __m512d_mm512_insertf64x2(__m512da,__m128d b, int imm); 

VINSERTF64x2 __m512d_mm512_mask_insertf64x2(__m512ds,__mmask8 k,__m512da,__m128d , int imm); 
VINSERTF64x2 __m512d_mm512_maskz_insertf64x2(__mmask8 k,__m512da,__m128d 5, int imm); 
VINSERTF64x2 _ m256d_mm256_insertf64x2(__m256d a,___m128d b, int imm); 

VINSERTF64x2 __m256d_mm256_mask_insertf64x2(__m256d s,__ mmask8 k,__ m256d a,__m128d b, int imm); 
VINSERTF64x2 _ m256d_mm256_maskz_insertf64x2(__mmask8 k,__ m256d a, __m128d 5, int imm); 
VINSERTF64x4 _ m512d_mm512_insertf64x4(__m512da,__m256d b, int imm); 

VINSERTF64x4 __m512d_mm512_mask_insertf64x4(__m512ds,__mmask8 k,__m512da,__m256d b, int imm); 
VINSERTF64x4 _ m512d_mm512_maskz_insertf64x4(__mmask8 k,__m512da,__m256d b, int imm); 
VINSERTF128 __m256 __mm256_insertf128_ps (_m256 a,__m128b, int offset); 

VINSERTF128 __m256d_mm256_insertf128_pd (__m256d a,__m128d }, int offset); 

VINSERTF128 __m256i __mm256_insertf128_si256 (_m256ia,__m128i}, int offset); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

VEX-encoded instruction, see Table 2-23, “Type 6 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0. 

EVEX-encoded instruction, see Table 2-54, “Type E6NF Class Exception Conditions”. 
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VINSERTI1 28/VINSERTI32xX4/VINSERTI64x2/VINSERTI32x8/VINSERTI64x4—Insert Packed 


Integer Values 
Opcode/ Op/ 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 

VEX.256.66.0F3A.WO 38 /r ib A VIV AVX2 Insert 128 bits of integer data from xmm3/m128 and 
VINSERTI128 ymm1, ymm2, the remaining values from ymm_2 into ymm1. 
xmm3/m128, imm8 
EVEX.256.66.0F3A.WO 38 /r ib C VIV AVX512VL | Insert 128 bits of packed doubleword integer values 
VINSERTI32X4 ymm1 {k1}{z}, ymm2, AVX512F from xmm3/m128 and the remaining values from 
xmm3/m1 28, imm8 ymm_2 into ymm1 under writemask k1. 
EVEX.512.66.0F3A.WO 38 /r ib C VIV AVX512F Insert 128 bits of packed doubleword integer values 
VINSERTI32X4 zmm1 {k1}{z}, zmm2, from xmm3/m128 and the remaining values from 
xmm3/m128, imm8 zmm_2 into zmm1 under writemask k1. 
EVEX.256.66.0F3A.W1 38 /r ib B VIV AVX512VL | Insert 128 bits of packed quadword integer values 
VINSERTI64X2 ymm1 {k1}{z}, ymm2, AVX512DQ_ | from xmm3/m128 and the remaining values from 
xmm3/m128, imm8 ymm_2 into ymm1 under writemask k1. 
EVEX.512.66.0F3A.W1 38 /r ib B VIN AVX512DQ | Insert 128 bits of packed quadword integer values 
VINSERTI64X2 zmm1 {k1}{z}, zmm2, from xmm3/m128 and the remaining values from 
xmm3/m128, imm8 zmm_2 into zmm1 under writemask k1. 
EVEX.512.66.0F3A.WO 3A /r ib D VIN AVX512DQ | Insert 256 bits of packed doubleword integer values 
VINSERTI32X8 zmm1 {k1}{z}, zmm2, from ymm3/m256 and the remaining values from 
ymm3/m256, imm8 zmmcz into zmm1 under writemask k1. 
EVEX.512.66.0F3A.W1 3A /r ib C VIV AVX512F Insert 256 bits of packed quadword integer values 
VINSERTI64X4 zmm1 {k1}{z}, zmm2, from ymm3/m256 and the remaining values from 
ymm3/m256, imm8 zmm_2 into zmm1 under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imms 
B Tuple2 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
C Tuple4 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8 
D Tuple8 ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


VINSERTI32x4 and VINSERTI64x2 inserts 128-bits of packed integer values from the second source operand (the 
third operand) into the destination operand (the first operand) at an 128-bit granular offset multiplied by imm8[0] 
(256-bit) or imm8[1:0]. The remaining portions of the destination are copied from the corresponding fields of the 
first source operand (the second operand). The second source operand can be either an XMM register or a 128-bit 
memory location. The high 6/7bits of the immediate are ignored. The destination operand is a ZMM/YMM register 
and updated at 32 and 64-bit granularity according to the writemask. 


VINSERTI32x8 and VINSERTI64x4 inserts 256-bits of packed integer values from the second source operand (the 
third operand) into the destination operand (the first operand) at a 256-bit granular offset multiplied by imm8[0]. 
The remaining portions of the destination are copied from the corresponding fields of the first source operand (the 
second operand). The second source operand can be either an YMM register or a 256-bit memory location. The 
upper bits of the immediate are ignored. The destination operand is a ZMM register and updated at 32 and 64-bit 
granularity according to the writemask. 


VINSERTI128 inserts 128-bits of packed integer data from the second source operand (the third operand) into the 
destination operand (the first operand) at a 128-bit granular offset multiplied by imm8[0]. The remaining portions 
of the destination are copied from the corresponding fields of the first source operand (the second operand). The 
second source operand can be either an XMM register or a 128-bit memory location. The high 7 bits of the imme- 
diate are ignored. VEX.L must be 1, otherwise attempt to execute this instruction with VEX.L=0 will cause #UD. 
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Operation 


VINSERTI32x4 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC2[127:0] 
1: TMP_DEST[255:128] := SRC2[127:0] 
ESAC. 
Fl; 
IF VL= 512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC2[127:0] 
01: TMP_DEST[255:1 28] := SRC2[127:0] 
10: TMP_DEST[383:256] := SRC2[127:0] 
11: TMP_DEST[51 1:384] := SRC2[127:0] 
ESAC. 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VINSERTI64x2 (EVEX encoded versions) 
(KL, VL) = (4, 256), (8, 512) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
IF VL = 256 
CASE (imm8[0]) OF 
0: TMP_DEST[127:0] := SRC2[127:0] 
1: TMP_DEST[255:128] := SRC2[127:0] 
ESAC. 
Fl; 
IF VL= 512 
CASE (imm8[1:0]) OF 
00: TMP_DEST[127:0] := SRC2[127:0] 
01: TMP_DEST[255:1 28] := SRC2[127:0] 
10: TMP_DEST[383:256] := SRC2[127:0] 
11: TMP_DEST[51 1:384] := SRC2[127:0] 
ESAC. 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
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IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VINSERTI32x8 (EVEX.U1.512 encoded version) 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
CASE (imm8[0]) OF 
0: TMP_DEST[255:0] := SRC2[255:0] 
1: TMP_DEST[511:256] := SRC2[255:0] 
ESAC. 


FOR j:=0TO015 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VINSERTI64x4 (EVEX.512 encoded version) 
VL=512 
TEMP_DEST[VL-1:0] := SRC1[VL-1:0] 
CASE (imm8[0]) OF 

0: TMP_DEST[255:0] := SRC2[255:0] 

1: TMP_DEST[511:256] := SRC2[255:0] 
ESAC. 


FOR j :=OTO7 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


5-294 Vol. 2C VINSERTI128/VINSERTI32x4/VINSERTI64x2/VINSERTI32x8/VINSERTI64x4—Insert Packed Integer Values 


INSTRUCTION SET REFERENCE, V-Z 


VINSERTI128 
TEMP[255:0] = SRC1[255:0] 
CASE (imm8[0]) OF 

0: TEMP[127:0] := SRC2[127:0] 

1: TEMP[255:128] := SRC2[127:0] 
ESAC 
DEST := TEMP 


Intel C/C++ Compiler Intrinsic Equivalent 


VINSERTI32x4 __mm512i _inserti32x4(__m512i a,__m128ib, int imm); 

VINSERTI32x4 __mm512i_mask_inserti32x4(__m512is,__ mmask16 k,__m512ia,__m128i b, int imm); 
VINSERTI32x4 __mm512i_maskz_inserti32x4(__ mmask16 k,__m512i a, ___m128i, int imm); 

VINSERTI32x4 __m256i __mm256_inserti32x4(__m256i a,__m128ib, int imm); 

VINSERTI32x4 __m256i__mm256_mask_inserti32x4(__m256is,__ mmask8 k,__ m25Gi a,___m128i, int imm); 
VINSERTI32x4 __m256i __mm256_maskz_inserti32x4(__ mmask8 k,___ m256i a,___m128ib, int imm); 
VINSERTI32x8 __m512i_mm512_inserti32x8(__m512i a, ___m256ib, int imm); 

VINSERTI32x8 __m512i_mm512_mask_inserti32x8(__m512is,__ mmask16 k,___m512ia,__m256i b, int imm); 
VINSERTI32x8 __m512i_mm512_maskz_inserti32x8(___mmask16 k,__m512i a,__ m256i b, int imm); 
VINSERTI64x2 __ m512i_mm512_inserti64x2(__m512i a,__m128ib, int imm); 

VINSERTI64x2 __ m512i_mm512_mask_inserti64x2(__m512is,__ mmask8 k,__m512i a, __m128i, int imm); 
VINSERTI64x2 __ m512i_mm512_maskz_inserti64x2(__ mmask8 k,__ m512i a,__m128ib, int imm); 
VINSERTI64x2 __ m256i_mm256_inserti64x2(__ m256i a,___m128ib, int imm); 

VINSERTI64x2 __ m256i_mm256_mask_inserti64x2(__m256i s,__ mmask8 k,___ m256i a, __m128i }, int imm); 
VINSERTI64x2 __ m256i_mm256_maskz_inserti64x2(__ mmask8 k, __ m256i a, __m128ib, int imm); 
VINSERTI64x4 _mm512_inserti64x4(__m512i a,__m256i b, int imm); 

VINSERTI64x4 _mm512_mask_inserti64x4(__m512is,__ mmask8 k,___m512i a, ___m256i b, int imm); 
VINSERTI64x4 _mm512_maskz_inserti64x4(__ mmask m,___m512i a,__m256i b, int imm); 

VINSERTI128 __m256i __mm256_insertf128_si256 (__m256i a,__m128i, int offset); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

VEX-encoded instruction, see Table 2-23, “Type 6 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0. 

EVEX-encoded instruction, see Table 2-54, “Type E6NF Class Exception Conditions”. 
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VMASKMOV—Conditional SIMD Packed Loads and Stores 


Opcode/ Op/ | 64/32-bit | CPUID Description 
Instruction En |Mode Feature 

Flag 
VEX.128.66.0F38.W0 2C /r RVM | V/V AVX Conditionally load packed single-precision values from 
VMASKMOVPS xmm1, xmm2, m128 m128 using mask in xmm2 and store in xmm17. 
VEX.256.66.0F38.W0 2C /r RVM | V/V AVX Conditionally load packed single-precision values from 
VMASKMOVPS ymm1, ymm2, m256 m256 using mask in ymm2 and store in ymm17. 
VEX.128.66.0F38.W0 2D /r RVM | V/V AVX Conditionally load packed double-precision values from 
VMASKMOVPD xmm1, xmm2, m128 m128 using mask in xmm2 and store in xmm17. 
VEX.256.66.0F38.W0 2D /r RVM | V/V AVX Conditionally load packed double-precision values from 
VMASKMOVPD ymm1, ymm2, m256 m256 using mask in ymm2 and store in ymm1. 
VEX.128.66.0F38.W0 2€E /r MVR | V/V AVX Conditionally store packed single-precision values from 
VMASKMOVPS m128, xmm1, xmm2 xmmé using mask in xmm/. 
VEX.256.66.0F38.W0 2€E /r MVR | V/V AVX Conditionally store packed single-precision values from 
VMASKMOVPS m256, ymm1, ymm2 ymm_2 using mask in ymm7. 
VEX.128.66.0F38.WO 2F /r MVR | V/V AVX Conditionally store packed double-precision values from 
VMASKMOVPD m128, xmm1, xmm2 xmmé using mask in xmm/. 
VEX.256.66.0F38.W0 2F /r MVR | V/V AVX Conditionally store packed double-precision values from 
VMASKMOVPD m256, ymm1, ymm2 ymmeé using mask in ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
MVR ModRM:r/m (w) VEX.vvvv (r) ModRM:reg (r) NA 

Description 


Conditionally moves packed data elements from the second source operand into the corresponding data element of 
the destination operand, depending on the mask bits associated with each data element. The mask bits are speci- 
fied in the first source operand. 


The mask bit for each data element is the most significant bit of that element in the first source operand. If a mask 
is 1, the corresponding data element is copied from the second source operand to the destination operand. If the 
mask is 0, the corresponding data element is set to zero in the load form of these instructions, and unmodified in 
the store form. 


The second source operand is a memory address for the load form of these instruction. The destination operand is 
a memory address for the store form of these instructions. The other operands are both XMM registers (for 
VEX.128 version) or YMM registers (for VEX.256 version). 


Faults occur only due to mask-bit required memory accesses that caused the faults. Faults will not occur due to 
referencing any memory location if the corresponding mask bit for that memory location is 0. For example, no 
faults will be detected if the mask bits are all zero. 


Unlike previous MASKMOV instructions (MASKMOVQ and MASKMOVDQU), a nontemporal hint is not applied to 
these instructions. 

Instruction behavior on alignment check reporting with mask bits of less than all 1s are the same as with mask bits 
of all is. 


VMASKMOV should not be used to access memory mapped I/O and un-cached memory as the access and the 
ordering of the individual loads or stores it does is implementation specific. 
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In cases where mask bits indicate data should not be loaded or stored paging A and D bits will be set in an imple- 
mentation dependent way. However, A and D bits are always set for pages where data is actually loaded/stored. 


Note: for load forms, the first source (the mask) is encoded in VEX.vvvv; the second source is encoded in rm_field, 


and the destination register is encoded in reg_field. 


Note: for store forms, the first source (the mask) is encoded in VEX.vvvv; the second source register is encoded in 


reg_field, and the destination memory location is encoded in rm_field. 


Operation 


VMASKMOVPS -1 28-bit load 

DEST[31:0] := IF (SRC1[31]) Load_32(mem) ELSE 0 
DEST[63:32] := IF (SRC1[63]) Load_32(mem + 4) ELSE 0 
DEST[95:64] := IF (SRC1[95]) Load_32(mem + 8) ELSE 0 
DEST[127:97] := IF (SRC1[127]) Load_32(mem + 12) ELSE O 
DEST[MAXVL-1:128] := 0 


VMASKMOVPS - 256-bit load 

DEST[31:0] := IF (SRC1[31]) Load_32(mem) ELSE O 
DEST[63:32] := IF (SRC1[63]) Load_32(mem + 4) ELSE 0 
DEST[95:64] := IF (SRC1[95]) Load_32(mem + 8) ELSE 0 
DEST[127:96] := IF (SRC1[127]) Load_32(mem + 12) ELSE O 
DEST[159:128] := IF (SRC1[159]) Load_32(mem + 16) ELSE O 
DEST[191:160] := IF (SRC1[191]) Load_32(mem + 20) ELSE O 
DEST[223:192] := IF (SRC1[223]) Load_32(mem + 24) ELSE O 
DEST[255:224] := IF (SRC1[255]) Load_32(mem + 28) ELSE O 


VMASKMOVPD - 128-bit load 

DEST[63:0] := IF (SRC1[63]) Load_64(mem) ELSE O 
DEST[127:64] := IF (SRC1[127]) Load_64(mem + 16) ELSE O 
DEST[MAXVL-1:128] := 0 


VMASKMOVPD - 256-bit load 

DEST[63:0] := IF (SRC1[63]) Load_64(mem) ELSE O 
DEST[127:64] := IF (SRC1[127]) Load_64(mem + 8) ELSE 0 
DEST[195:128] := IF (SRC1[191]) Load_64(mem + 16) ELSE O 
DEST[255:196] := IF (SRC1[255]) Load_64(mem + 24) ELSE 0 


VMASKMOVPS - 128-bit store 

IF (SRC1[31]) DEST[31:0] := SRC2[31:0] 

IF (SRC1[63]) DEST[63:32] := SRC2[63:32] 

IF (SRC1[95]) DEST[95:64] = SRC2[95:64] 

IF (SRC1[127]) DEST[127:96] := SRC2[127:96] 


VMASKMOVPS - 256-bit store 

IF (SRC1[31]) DEST[31:0] := SRC2[31:0] 

IF (SRC1[63]) DEST[63:32] = SRC2[63:32] 

IF (SRC1[95]) DEST[95:64] := SRC2[95:64] 

IF (SRC1[127]) DEST[127:96] := SRC2[127:96] 

IF (SRC1[159]) DEST[159:128] :-=SRC2[159:128] 
IF (SRC1[191]) DEST[191:160] := SRC2[191:160] 
IF (SRC1[223]) DEST[223:192] := SRC2[223:192] 
IF (SRC1[255]) DEST[255:224] := SRC2[255:224] 


a) 
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VMASKMOVPD - 128-bit store 
IF (SRC1[63]) DEST[63:0] := SRC2[63:0] 
IF (SRC1[127]) DEST[127:64] = SRC2[127:64] 


VMASKMOVPD - 256-bit store 

IF (SRC1[63]) DEST[63:0] := SRC2[63:0] 

IF (SRC1[127]) DEST[127:64] = SRC2[127:64] 

IF (SRC1[191]) DEST[191:128] := SRC2[191:128] 
IF (SRC1[255]) DEST[255:1 92] := SRC2[255:192] 


Intel C/C++ Compiler Intrinsic Equivalent 


m256 _mm256_maskload_ps(float const *a, 


void _mm256_maskstore_ps(float *a, 
m256d __mm256_maskload_pd(double *a, 


void _mm256_maskstore_pd(double *a, 


__m128 _mm_maskload_ps(float const *a, 


void _mm_maskstore_ps(float *a, 


m128d _mm_maskload_pd(double const *a, __m128i mask); 


void +_mm_maskstore_pd(double *a, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


m256i mask, 
m256i mask); 
m256i mask, 
m128i mask) 


m128i mask, 


m128i mask, 


See Table 2-23, “Type 6 Class Exception Conditions” (No AC# reported for any mask bit combinations); 


additionally: 
#UD If VEX.W = 1. 
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VP2INTERSECTD/VP2INTERSECTQ—Compute Intersection Between DWORDS/QUADWORDS to a 


Pair of Mask Registers 


Opcode/ Op/ | 64/32 CPUID Feature Flag Description 
Instruction En bit Mode 
Support 
EVEX.NDS.128.F2.0F38.W0 68 /r A VIV AVX512VL Store, in an even/odd pair of mask registers, 
VP2INTERSECTD k1+1, xmm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
xmm3/m128/m32bcst matches between dwords in 
xmm3/m128/m32bcst and xmm2. 
EVEX.NDS.256.F2.0F38.W0 68 /r A VIV AVX512VL Store, in an even/odd pair of mask registers, 
VP2INTERSECTD k1+1, ymm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
ymm3/m256/m32bcst matches between dwords in 
ymm3/m256/m32bcst and ymm2. 
EVEX.NDS.512.F2.0F38.W0 68 /r A VIV AVX512F Store, in an even/odd pair of mask registers, 
VP2INTERSECTD k1+1, zmm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
zmm3/m512/m32bcst matches between dwords in 
zmm3/m512/m32bcst and zmm_2. 
EVEX.NDS.128.F2.0F38.W1 68 /r A VIV AVX512VL Store, in an even/odd pair of mask registers, 
VP2INTERSECTQ k1+1, xmm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
xmm3/m128/m64bcst matches between quadwords in 
xmm3/m128/m64bcst and xmm2. 
EVEX.NDS.256.F2.0F38.W1 68 /r A VIV AVX512VL Store, in an even/odd pair of mask registers, 
VP2INTERSECTQ k1+1, ymm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
ymm3/m256/m64bcst matches between quadwords in 
ymm3/m256/m64bcst and ymmz. 
EVEX.NDS.512.F2.0F38.W1 68 /r A VIV AVX512F Store, in an even/odd pair of mask registers, 
VP2INTERSECTQ k1+1, zmm2, AVX512_VP2INTERSECT | the indicators of the locations of value 
zmm3/m512/m64bcst matches between quadwords in 
zmm3/m512/m64bcst and zmm2. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction writes an even/odd pair of mask registers. The mask register destination indicated in the 
MODRM.REG field is used to form the basis of the register pair. The low bit of that field is masked off (set to zero) 
to create the first register of the pair. 


EVEX.aaa and EVEX.z must be zero. 
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Operation 


VP2INTERSECTD destmask, src1, src2 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


// dest_mask_reg_id is the register id specified in the instruction for destmask 
dest_base := dest_mask_reg_id & ~1 


// maskregs[ ] is an array representing the mask registers 
maskregs[dest_base+O][MAX_KL-1:0] := 0 
maskregs[dest_base+1 ][MAX_KL-1:0] := 0 


FOR i := 0 to KL-1: 
FOR j := 0 to KL-1: 
match := (src1.dword[i] == src2.dword[j]) 
maskregs[dest_base+O].bit[i] |= match 
maskregs[dest_base+1 ].bit[j] |= match 


VP2INTERSECTQ destmask, src1, src2 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


// dest_mask_reg_id is the register id specified in the instruction for destmask 
dest_base := dest_mask_reg_id & ~1 


// maskregs[ ] is an array representing the mask registers 
maskregs[dest_base+O][MAX_KL-1:0] := 0 
maskregs[dest_base+1 ][MAX_KL-1:0] := 0 


FOR i = 0 to KL-1: 
FOR j = 0 to KL-1: 
match := (src1.qword[i] == src2.qword[j]) 
maskregs[dest_base+O].bit[i] |= match 
maskregs[dest_base+1 ].bit[j] |= match 


Intel C/C++ Compiler Intrinsic Equivalent 


VP2INTERSECTD void _mm_2intersect_epi32(__m128i,__m128i,__ mmask8 *,___ mmask8 *); 
VP2INTERSECTD void __mm256_2intersect_epi32(__m256i,__m256i,___ mmask8 *, __ mmask8 *); 
VP2INTERSECTD void __mm512_2intersect_epi32(__m512i,__m512i,__ mmask16 *, __ mmask16 *); 
VP2INTERSECTQ void __mm_2intersect_epi64(__m128i, __m128i, __ mmask8 *, __mmask8 *); 
VP2INTERSECTQ void __mm256_2intersect_epi64(__m256i,___ m256i,___ mmask8 *, __mmask8 *); 
VP2INTERSECTQ void _mm512_2intersect_epi64(__m512i,___m512i,___mmask8 *, __mmask8 *); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode | Flag 
VEX.128.66.0F3A.W0 02 /r ib RVMI | V/V AVX2 Select dwords from xmm2 and xmm3/m128 from 
VPBLENDD xmm1, xmm2, xmm3/m128, imm8 mask specified in imm8 and store the values into 
xmm1. 
VEX.256.66.0F3A.WO O2 /r ib RVMI | V/V AVX2 Select dwords from ymm2 and ymm3/m256 from 
VPBLENDD ymm1, ymm2, ymm3/m256, imm8 mask specified in imm8 and store the values into 
ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Dword elements from the source operand (second operand) are conditionally written to the destination operand 
(first operand) depending on bits in the immediate operand (third operand). The immediate bits (bits 7:0) forma 
mask that determines whether the corresponding word in the destination is copied from the source. If a bit in the 
mask, corresponding to a word, is “1", then the word is copied, else the word is unchanged. 


VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register 


are zeroed. 


VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


Operation 
VPBLENDD (VEX.256 encoded version) 


IF (imm8[0] == 1) THEN DEST[31:0] := SRC2[31:0] 


ELSE DEST[31:0] := SRC1[31:0] 


IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32] 


ELSE DEST[63:32] := SRC1[63:32] 


IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64] 


ELSE DEST[95:64] := SRC1[95:64] 


IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96] 


ELSE DEST[1 27:96] := SRC1[127:96] 


IF (imm8[4] == 1) THEN DEST[159:128] := SRC2[159:128] 


ELSE DEST[159:1 28] := SRC1[159:128] 


IF (imm8[5] == 1) THEN DEST[191:160] := SRC2[191:160] 


ELSE DEST[191:160] := SRC1[191:160] 


IF (imm8[6] == 1) THEN DEST[223:192] := SRC2[223:192] 


ELSE DEST[223:192] := SRC1[223:192] 


IF (imm8[7] == 1) THEN DEST[255:224] := SRC2[255:224] 


ELSE DEST[255:224] := SRC1[255:224] 
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VPBLENDD (VEX.128 encoded version) 

IF (imm8[0] == 1) THEN DEST[31:0] := SRC2[31:0] 
ELSE DEST[31:0] := SRC1[31:0] 

IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32] 
ELSE DEST[63:32] := SRC1[63:32] 

IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64] 
ELSE DEST[95:64] := SRC1[95:64] 

IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96] 
ELSE DEST[1 27:96] := SRC1[127:96] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VPBLENDD: m128i_mm_blend_epi32 (__m128i v1,__m128i v2, const int mask) 
VPBLENDD: m256i _mm256_blend_epi32 (__m256i v1, 


m256i v2, const int mask) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.W = 1. 
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VPBLENDMB/VPBLENDMW-—Blend Byte/Word Vectors Using an Opmask Control 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F38.WO 66 /r A VV AVX512VL | Blend byte integer vector xmm2 and byte vector 
VPBLENDMB xmm1 {k1}{Z}, AVX512BW | xmm3/m128 and store the result in xmm1, under control 
xmm2, xmm3/m128 mask. 
EVEX.256.66.0F38.WO 66 /r A VV AVX512VL | Blend byte integer vector ymm2 and byte vector 
VPBLENDMB ymm1 {k1}{Z}, AVX512BW | ymm3/m256 and store the result in ymm1, under control 
ymm2, ymm3/m256 mask. 
EVEX.512.66.0F38.WO 66 /r A VIV AVX512BW | Blend byte integer vector zmm2 and byte vector 
VPBLENDMB zmm1 {k1}{Z}, zmm3/m512 and store the result in zmm1, under control 
zmme2, zmm3/m512 mask. 
EVEX.128.66.0F38.W1 66 /r A VV AVX512VL | Blend word integer vector xmm2 and word vector 
VPBLENDMW xmm1 {k1}{z}, AVX512BW | xmm3/m128 and store the result in xmm1, under control 
xmm2, xmm3/m128 mask. 
EVEX.256.66.0F38.W1 66 /r A VV AVX512VL_ | Blend word integer vector ymm2 and word vector 
VPBLENDMW ymm1 {k1}{zZ}, AVX512BW | ymm3/m256 and store the result in ymm1, under control 
ymm2, ymm3/m256 mask. 
EVEX.512.66.0F38.W1 66 /r A VIV AVX512BW | Blend word integer vector zmm2 and word vector 
VPBLENDMW zmm1 {k1}{z}, zmm3/m512 and store the result in zmm1, under control 
zmm2, zmm3/m512 mask. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an element-by-element blending of byte/word elements between the first source operand byte vector 
register and the second source operand byte vector from memory or register, using the instruction mask as 
selector. The result is written into the destination byte vector register. 


The destination and first source operands are ZMM/YMM/XMM registers. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit memory location. 


The mask is not used as a writemask for this instruction. Instead, the mask is used as an element selector: every 
element of the destination is conditionally selected between first source or second source using the value of the 
related mask bit (0 for first source, 1 for second source). 
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Operation 


VPBLENDMB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


FOR j :=0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST{i+7:i] := SRC2[i+7:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN DEST[i+7:i] := SRC1[i+7:i] 
ELSE ; zeroing-masking 

DEST[i+7:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0; 


VPBLENDMW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] = SRC2[i+15:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN DEST{i+1 5:i] = SRC1[i+ 153i] 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPBLENDMB __m512i_mm512_mask_blend_epi8(__mmask64 m,__m512i a,__m512i b); 
VPBLENDMB __m256i __mm256_mask_blend_epi8(__mmask32 m, ___m256i a, __m256i b); 
VPBLENDMB __m128i _mm_mask_blend_epi8(__mmask16 m, __m128i a, __m128i b); 
VPBLENDMW __m512i_mm512_mask_blend_epi16(__mmask32 m,__m512ia,_m512ib); 
VPBLENDMW __m256i _mm256_mask_blend_epi16(__mmask16 m,__m256i a, __m256i b); 
VPBLENDMW __m128i _mm_mask_blend_epi16(__mmask8 m, __m128i a, ___m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 


5-304 Vol. 2C 


VPBLENDMB/VPBLENDMW-—Blend Byte/Word Vectors Using an Opmask Control 


INSTRUCTION SET REFERENCE, V-Z 


VPBLENDMD/VPBLENDMQ—Blend Int32/Int64 Vectors Using an OpMask Control 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W0 64 /r A VIV AVX512VL | Blend doubleword integer vector xmm2 and doubleword 
VPBLENDMD xmm1 {k1}{Z}, AVX512F vector xmm3/m128/m32bcst and store the result in 
xmm_2, xmm3/m1 28/m32bcst xmm1, under control mask. 
EVEX.256.66.0F38.W0 64 /r A VIV AVX512VL | Blend doubleword integer vector ymm2 and doubleword 
VPBLENDMD ymm1 {k1}{z}, ymm2, AVX512F vector ymm3/m256/m32bcst and store the result in 
ymm3/m256/m32bcst ymm1, under control mask. 
EVEX.512.66.0F38.W0O 64 /r A VIV AVX512F Blend doubleword integer vector zmm2 and doubleword 
VPBLENDMD zmm1 {k1}{z}, zmm2, vector zmm3/m512/m32bcst and store the result in 
zmm3/m512/m32bcst zmm1, under control mask. 
EVEX.128.66.0F38.W1 64 /r A VIV AVX512VL | Blend quadword integer vector xmm2 and quadword 
VPBLENDMQ xmm1 {k1}{z}, AVX512F vector xmm3/m128/m64bcst and store the result in 
xmm_2, xmm3/m128/m64bcst xmm1, under control mask. 
EVEX.256.66.0F38.W1 64 /r A VIV AVX512VL | Blend quadword integer vector ymm2 and quadword 
VPBLENDMQ ymm1 {k1}{z}, AVX512F vector ymm3/m256/m64bcst and store the result in 
ymm_2, ymm3/m256/m64bcst ymm1, under control mask. 
EVEX.512.66.0F38.W1 64 /r A VIV AVX512F Blend quadword integer vector zmm2 and quadword 
VPBLENDMQ zmm1 {k1}{z}, zmm2, vector zmm3/m512/m64bcst and store the result in 
zmm3/m512/m64bcst zmm1, under control mask. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs an element-by-element blending of dword/qword elements between the first source operand (the second 
operand) and the elements of the second source operand (the third operand) using an opmask register as select 
control. The blended result is written into the destination. 


The destination and first source operands are ZMM registers. The second source operand can be a ZMM register, a 
512-bit memory location or a 512-bit vector broadcasted from a 32-bit memory location. 


The opmask register is not used as a writemask for this instruction. Instead, the mask is used as an element 
selector: every element of the destination is conditionally selected between first source or second source using the 
value of the related mask bit (0 for the first source operand, 1 for the second source operand). 


If EVEX.z is set, the elements with corresponding mask bit value of 0 in the destination operand are zeroed. 
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Operation 

VPBLENDMD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no controlmask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] = SRC2[31:0] 
ELSE 
DEST[i+31:i] = SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN DEST{[i+31:i] = SRC1[i+31:i] 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0; 


VPBLENDMD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no controlmask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] = SRC2[31:0] 
ELSE 
DEST[i+31:i] := SRC2[i+31:i] 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN DEST{[i+31:i] = SRC1[i+31:i] 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPBLENDMD __m512i__mm512_mask_blend_epi32(__mmask16 k,___m512ia,__m512i b); 
m256i a,__m256i b); 
VPBLENDMD __m128i__mm_mask_blend_epi32(__mmask8 m, __m128i a, ___m128i b); 

m512ia,__m512ib); 
VPBLENDMQ __m256i _mm256_mask_blend_epi64(__mmask8 m, __m256i a, __m256i b); 
VPBLENDMQ __m128i _mm_mask_blend_epi64(__mmask8 m, __m128i a, 


VPBLENDMD __m256i__mm256_mask_blend_epi32(__mmask8 m, 


VPBLENDMQ __m512i__mm512_mask_blend_epi64(__mmask8 k, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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VPBROADCASTB/W/D/Q—Load with Broadcast Integer Data from General Purpose Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Feature 

Mode Flag 

Support 
EVEX.128.66.0F38.W0 7A /r A VIV AVX512VL_ | Broadcast an 8-bit value from a GPR to all bytes in the 
VPBROADCASTB xmm1 {k1}{Z}, reg AVX512BW | 128-bit destination subject to writemask k1. 
EVEX.256.66.0F38.W0 7A /r A VIV AVX512VL_ | Broadcast an 8-bit value from a GPR to all bytes in the 
VPBROADCASTB ymm1 {k1}{z}, reg AVX512BW | 256-bit destination subject to writemask k1. 
EVEX.512.66.0F38.W0O 7A /r A VIV AVX512BW | Broadcast an 8-bit value from a GPR to all bytes in the 
VPBROADCASTB zmm1 {k1}{Z}, reg 512-bit destination subject to writemask k1. 
EVEX.128.66.0F38.W0 7B /r A VIV AVX512VL_ | Broadcast a 16-bit value from a GPR to all words in the 
VPBROADCASTW xmm1 {k1}{Z}, reg AVX512BW | 128-bit destination subject to writemask k1. 
EVEX.256.66.0F38.W0 7B /r A VIV AVX512VL_ | Broadcast a 16-bit value from a GPR to all words in the 
VPBROADCASTW ymm1 {k1}{z}, reg AVX512BW | 256-bit destination subject to writemask k1. 
EVEX.512.66.0F38.W0 7B /r A VIV AVX512BW | Broadcast a 16-bit value from a GPR to all words in the 
VPBROADCASTW zmm1 {k1}{2}, reg 512-bit destination subject to writemask k1. 
EVEX.128.66.0F38.W0O 7C /r A VIV AVX512VL_ | Broadcast a 32-bit value from a GPR to all double-words 
VPBROADCASTD xmm1 {k1}{z}, r32 AVX512F in the 128-bit destination subject to writemask k1. 
EVEX.256.66.0F38.W0O 7C /r A VIV AVX512VL_ | Broadcast a 32-bit value from a GPR to all double-words 
VPBROADCASTD ymm1 {k1}{z}, r32 AVX512F in the 256-bit destination subject to writemask k1. 
EVEX.512.66.0F38.WO 7C /r A VIV AVX512F Broadcast a 32-bit value from a GPR to all double-words 
VPBROADCASTD zmm1 {k1}{2}, r32 in the 512-bit destination subject to writemask k1. 
EVEX.128.66.0F38.W1 7C /r A VINE. AVX512VL_ | Broadcast a 64-bit value from a GPR to all quad-words in 
VPBROADCASTQ xmm1 {k1}{z}, r64 AVX512F the 128-bit destination subject to writemask k1. 
EVEX.256.66.0F38.W1 7C /r A VINE. AVX512VL_ | Broadcast a 64-bit value from a GPR to all quad-words in 
VPBROADCASTQ ymm1 {k1}{z}, r64 AVX512F the 256-bit destination subject to writemask k1. 
EVEX.512.66.0F38.W1 7C /r A VINE. AVX512F Broadcast a 64-bit value from a GPR to all quad-words in 
VPBROADCASTQ zmm1 {k1}{z}, r64 the 512-bit destination subject to writemask k1. 


NOTES: 


1. EVEX.W in non-64 bit is ignored; the instructions behaves as if the WO version is used. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Broadcasts a 8-bit, 16-bit, 32-bit or 64-bit value from a general-purpose register (the second operand) to all the 
locations in the destination vector register (the first operand) using the writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VPBROADCASTB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SRC[7:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+7:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPBROADCASTW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SRC[15:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPBROADCASTD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[31:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPBROADCASTQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[63:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPBROADCASTB __m512i_mm512_mask_set1_epi8(__m512is,__ mmask64 k, int a); 
VPBROADCASTB __m512i_mm512_maskz_set1_epi8(__mmask64 k, int a); 
VPBROADCASTB __m256i__mm256_mask_set1_epi8(__m256i s,__ mmask32 k, int a); 
VPBROADCASTB __m256i__mm256_maskz_set1_epi8(__mmask32 k, int a); 
VPBROADCASTB __m128i_mm_mask_set1_epi8(__m128is,__ mmask16 k, int a); 
VPBROADCASTB __m128i__mm_maskz_set1_epi8(__mmask16 kK, int a); 
VPBROADCASTD __m512i_mm512_mask_set1_epi32(__m512is,__mmask16 kK, int a); 
VPBROADCASTD __m512i_mm512_maskz_set1_epi32(__mmask16 k, int a); 
VPBROADCASTD __m256i__mm256_mask_set1_epi32(__m256is,__ mmask8 k, int a); 
VPBROADCASTD __m256i __mm256_maskz_set1_epi32(__mmask8 k, int a); 
VPBROADCASTD __m128i __mm_mask_set1_epi32(__m128i s, __mmask8 k, int a); 
VPBROADCASTD __m128i_mm_maskz_set1_epi32(__mmask8 k, int a); 
VPBROADCASTQ __m512i__mm512_mask_set1_epi64(__m512i s,___mmask8 k, __int64 a); 
VPBROADCASTQ __m512i_mm512_maskz_set1_epi64(__mmask8 k, __int64 a); 
VPBROADCASTQ __m256i__mm256_mask_set1_epi64(__m256i s,___ mmask8 k, __int64 a); 
VPBROADCASTQ __m256i__mm256_maskz_set1_epi64(_mmask8 k, __int64 a); 
VPBROADCASTQ __m128i __mm_mask_set1_epi64(__m128i s,__mmask8 k, __int64 a); 
VPBROADCASTQ __m128i__mm_maskz_set1_epi64(__mmask8 k, __int64 a); 
VPBROADCASTW __m512i_mm512_mask_set1_epi16(__m512is, __ mmask32 k, int a); 
VPBROADCASTW __m512i_mm512_maskz_set1_epi16(__mmask32 k, int a); 
VPBROADCASTW __m256i_mm256_mask_set1_epi16(__m256i s,___ mmask16 kK, int a); 
VPBROADCASTW __m256i__mm256_maskz_set1_epi16(__mmask16 k, int a); 
VPBROADCASTW __m128i_mm_mask_set1_epi16(__m128i s,___ mmask8 k, int a); 
VPBROADCASTW __m128i __mm_maskz_set1_epi16(__mmask8 k, int a); 


Exceptions 


EVEX-encoded instructions, see Table 2-55, “Type E7NM Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
VEX.128.66.0F38.W0 78 /r A VIV AVX2 Broadcast a byte integer in the source operand 
VPBROADCASTB xmm1, xmm2/m8 to sixteen locations in xmm1. 
VEX.256.66.0F38.W0 78 /r A VIV AVX2 Broadcast a byte integer in the source operand 
VPBROADCASTB ymm1, xmm2/m8 to thirty-two locations in ymm1. 
EVEX.128.66.0F38.W0 78 /r B VV AVX512VL_ | Broadcast a byte integer in the source operand 
VPBROADCASTB xmm1{k1}{z}, xmm2/m8 AVX512BW | to locations in xmm1 subject to writemask k1. 
EVEX.256.66.0F38.W0O 78 /r B VIV AVX512VL | Broadcast a byte integer in the source operand 
VPBROADCASTB ymm1{k1}{z}, xmm2/m8 AVX512BW | to locations in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W0O 78 /r B VIV AVX512BW | Broadcast a byte integer in the source operand 
VPBROADCASTB zmm1{k1}{z}, xmm2/m8 to 64 locations in zmm1 subject to writemask 
k1. 
VEX.128.66.0F38.W0 79 /r A VIV AVX2 Broadcast a word integer in the source 
VPBROADCASTW xmm1, xmm2/m16 operand to eight locations in xmm1. 
VEX.256.66.0F38.W0 79 /r A VIV AVX2 Broadcast a word integer in the source 
VPBROADCASTW ymm1, xmm2/m16 operand to sixteen locations in ymm1. 
EVEX.128.66.0F38.W0O 79 /r B VIV AVX512VL_ | Broadcast a word integer in the source 
VPBROADCASTW xmm1{k1}{z}, xmm2/m16 AVX512BW | operand to locations in xmm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W0 79 /r B VIV AVX512VL_ | Broadcast a word integer in the source 
VPBROADCASTW ymm1{k1}{z}, xmm2/m16 AVX512BW | operand to locations in ymm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W0 79 /r B VIV AVX512BW | Broadcast a word integer in the source 
VPBROADCASTW zmm1{k1}{z}, xmm2/m16 operand to 32 locations in zmm1 subject to 
writemask k1. 
VEX.128.66.0F38.W0 58 /r A VIV AVX2 Broadcast a dword integer in the source 
VPBROADCASTD xmm1, xmm2/m32 operand to four locations in xmm1. 
VEX.256.66.0F38.W0 58 /r A VIV AVX2 Broadcast a dword integer in the source 
VPBROADCASTD ymm1, xmm2/m32 operand to eight locations in ymm1. 
EVEX.128.66.0F38.W0 58 /r B VIV AVX512VL_ | Broadcast a dword integer in the source 
VPBROADCASTD xmm1 {k1}{z}, xmm2/m32 AVX512F operand to locations in xmm1 subject to 
writemask k1. 
EVEX.256.66.0F38.W0 58 /r B VIV AVX512VL_ | Broadcast a dword integer in the source 
VPBROADCASTD ymm1 {k1}{z}, xmm2/m32 AVX512F operand to locations in ymm1 subject to 
writemask k1. 
EVEX.512.66.0F38.W0 58 /r B VIV AVX512F Broadcast a dword integer in the source 
VPBROADCASTD zmm1 {k1}{z}, xmm2/m32 operand to locations in zmm1 subject to 
writemask k1. 
VEX.128.66.0F38.W0 59 /r A VIV AVX2 Broadcast a qword element in source operand 
VPBROADCASTQ xmm1, xmm2/m64 to two locations in xmm1. 
VEX.256.66.0F38.W0 59 /r A VIV AVX2 Broadcast a qword element in source operand 
VPBROADCASTQ ymm1, xmm2/m64 to four locations in ymm1. 
EVEX.128.66.0F38.W1 59 /r B VIV AVX512VL_ | Broadcast a qword element in source operand 
VPBROADCASTQ xmm1 {k1}{z}, xmm2/m64 AVX512F to locations in xmm1 subject to writemask k1. 
EVEX.256.66.0F38.W1 59 /r B VIV AVX512VL_ | Broadcast a qword element in source operand 
VPBROADCASTQ ymm1 {k1}{z}, xmm2/m64 AVX512F to locations in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W1 59 /r B VIV AVX512F Broadcast a qword element in source operand 
VPBROADCASTQ zmm1 {k1}{z}, xmm2/m64 to locations in zmm1 subject to writemask k1. 
EVEX.128.66.0F38.W0 59 /r C VIN AVX512VL_ | Broadcast two dword elements in source 
VBROADCASTI32x2 xmm1 {k1}{z}, xmm2/m64 AVX512DQ_ | operand to locations in xmm1 subject to 


writemask k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

EVEX.256.66.0F38.W0 59 /r C VIN AVX512VL | Broadcast two dword elements in source 

VBROADCASTI32x2 ymm1 {k1}{z}, xmm2/m64 AVX512DQ | operand to locations in ymm1 subject to 
writemask k1. 

EVEX.512.66.0F38.W0 59 /r C VV AVX512DQ | Broadcast two dword elements in source 

VBROADCASTI32x2 zmm1 {k1}{z}, xmm2/m64 operand to locations in zmm1 subject to 
writemask k1. 

VEX.256.66.0F38.W0 5A /r A VIV AVX2 Broadcast 128 bits of integer data in mem to 

VBROADCASTI128 ymm1, m128 low and high 128-bits in ymm1. 

EVEX.256.66.0F38.W0 5A /r D VIV AVX512VL | Broadcast 128 bits of 4 doubleword integer 

VBROADCASTI32X4 ymm1 {k1}{z}, m128 AVX512F data in mem to locations in ymm1 using 
writemask k1. 

EVEX.512.66.0F38.W0 5A /r D VIV AVX512F Broadcast 128 bits of 4 doubleword integer 

VBROADCASTI32X4 zmm1 {k1}{z}, m128 data in mem to locations in zmm1 using 
writemask k1. 

EVEX.256.66.0F38.W1 5A /r C VIV AVX512VL_ | Broadcast 128 bits of 2 quadword integer data 

VBROADCASTI64X2 ymm1 {k1}{z}, m128 AVX512DQ | inmem to locations in ymm1 using writemask 
k1, 

EVEX.512.66.0F38.W1 5A /r C VIV AVX512DQ | Broadcast 128 bits of 2 quadword integer data 

VBROADCASTI64X2 zmm1 {k1}{z}, m128 in mem to locations in zmm1 using writemask 
k1, 

EVEX.512.66.0F38.W0 5B /r E VIV AVX512DQ | Broadcast 256 bits of 8 doubleword integer 

VBROADCASTI32X8 zmm1 {k1}{z}, m256 data in mem to locations in zmm1 using 
writemask k1. 

EVEX.512.66.0F38.W1 5B /r D VIV AVX512F Broadcast 256 bits of 4 quadword integer data 

VBROADCASTI64X4 zmm1 {k1}{z}, m256 in mem to locations in zmm1 using writemask 
k1, 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) NA NA 
B Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
C Tuple2 ModRM:reg (w) ModRM:r/m (r) NA NA 
D Tuple4 ModRM:reg (w) ModRM:r/m (r) NA NA 
E Tuple8 ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Load integer data from the source operand (the second operand) and broadcast to all elements of the destination 


operand (the first operand). 


VEX256-encoded VPBROADCASTB/W/D/Q: The source operand is 8-bit, 16-bit, 32-bit, 64-bit memory location or 
the low 8-bit, 16-bit 32-bit, 64-bit data in an XMM register. The destination operand is a YMM register. 
VPBROADCASTI128 support the source operand of 128-bit memory location. Register source encodings for 
VPBROADCASTI128 is reserved and will #UD. Bits (MAXVL-1:256) of the destination register are zeroed. 
EVEX-encoded VPBROADCASTD/Q: The source operand is a 32-bit, 64-bit memory location or the low 32-bit, 64- 
bit data in an XMM register. The destination operand is a ZMM/YMM/XMM register and updated according to the 
writemask k1. 
VPBROADCASTI32X4 and VPBROADCASTI64X4: The destination operand is a ZMM register and updated according 
to the writemask k1. The source operand is 128-bit or 256-bit memory location. Register source encodings for 
VBROADCASTI32X4 and VBROADCASTI64X4 are reserved and will #UD. 
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Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 
If VPBROADCASTI128 is encoded with VEX.L= 0, an attempt to execute the instruction encoded with VEX.L= 0 will 


cause an #UD exception. 


DEST| XO 


XO 


XO 


XO 


XO 


XO 


XO 


XO 


Figure 5-16. VPBROADCASTD Operation (VEX.256 encoded version) 


m32 x0 
DES 0) 0) 0 0) 0) Xo a) 0) 
Figure 5-17. VPBROADCASTD Operation (128-bit version) 
m64 [ x | 
DEST| xo Xo xo xo 
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Figure 5-18. VPBROADCASTQ Operation (256-bit version) 
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m128 


DEST| xo 


Figure 5-19. VBROADCASTI128 Operation (256-bit version) 


m256 


DES xO 


Figure 5-20. VBROADCASTI256 Operation (512-bit version) 


Operation 


VPBROADCASTB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN DEST{i+7:i] := SRC[7:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPBROADCASTW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+1 5:i] = SRC[15:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPBROADCASTD (128 bit version) 
temp := SRC[31:0] 

DEST[31:0] := temp 

DEST[63:32] := temp 

DEST[95:64] := temp 

DEST[127:96] := temp 
DEST[MAXVL-1:128] := 0 


VPBROADCASTD (VEX.256 encoded version) 
temp := SRC[31:0] 
DEST[31:0] := temp 
DEST[63:32] := temp 
DEST[95:64] := temp 
DEST[127:96] := temp 
DEST[159:1 28] := temp 
DEST[191:160] := temp 
DEST[223:192] := temp 
DEST[255:224] := temp 
DEST[MAXVL-1:256] := 0 


VPBROADCASTD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i= j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := SRC[31:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPBROADCASTQ (VEX.256 encoded version) 
temp := SRC[63:0] 

DEST[63:0] := temp 

DEST[127:64] := temp 

DEST[191:128] := temp 

DEST[255:192] := temp 

DEST[MAXVL-1:256] := 0 


VPBROADCASTQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[63:0] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
VBROADCASTI32x2 (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 

i:=j* 32 

n:= (j mod 2) * 32 

IF k1[j] OR *no writemask* 

THEN DEST[i+31:i] = SRC[n+31:n] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VBROADCASTI1 28 (VEX.256 encoded version) 
temp := SRC[127:0] 

DEST[127:0] := temp 

DEST[255:1 28] := temp 

DEST[MAXVL-1:256] := 0 
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VBROADCASTI32X4 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
n:= (j modulo 4) * 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[n+31:n] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VBROADCASTI64X2 (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
n:= (j modulo 2) * 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[n+63:n] 


ELSE 

IF *merging-masking* ; mMerging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] = 0 
Fl 
Fl; 
ENDFOR; 


VBROADCASTI32X8 (EVEX.U1.512 encoded version) 
FOR j:=0TO15 
i:=j* 32 
n:= (j modulo 8) * 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SRC[n+31:n] 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VBROADCASTI64X4 (EVEX.512 encoded version) 
FOR j :=OTO7 
i:=j* 64 
n:= (j modulo 4) * 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = SRC[n+63:n] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPBROADCASTB __m512i_mm512_broadcastb_epi8(__m128i a); 

VPBROADCASTB __m512i_mm512_mask_broadcastb_epi8(__m512is,__ mmask64 k,___m128i a); 
VPBROADCASTB __m512i_mm512_maskz_broadcastb_epi8(__ mmask64 k,__m128i a); 
VPBROADCASTB __m256i__mm256_broadcastb_epi8(__m1 28i a); 

VPBROADCASTB __m256i__mm256_mask_broadcastb_epi8(__m256i s,__ mmask32 k,___m128i a); 
VPBROADCASTB __m256i__mm256_maskz_broadcastb_epi8(__mmask32 k,__m128i a); 
VPBROADCASTB __m128i__mm_mask_broadcastb_epi8(__m128i s,__ mmask16 k,__m128i a); 
VPBROADCASTB __m128i__mm_maskz_broadcastb_epi8(__mmask16 k,___m128i a); 
VPBROADCASTB __m128i__mm_broadcastb_epi8(__m128i a); 

VPBROADCASTD __m512i_mm512_broadcastd_epi32(__m128i a); 

VPBROADCASTD __m512i_mm512_mask_broadcastd_epi32(__m512is,__ mmask16 k,___m128i a); 
VPBROADCASTD __m512i_mm512_maskz_broadcastd_epi32(__ mmask16 k, __m128i a); 
VPBROADCASTD __m256i__mm256_broadcastd_epi32(__m128i a); 

VPBROADCASTD __m256i __mm256_mask_broadcastd_epi32(__m256i s,___ mmask8 k, 
VPBROADCASTD __m256i__mm256_maskz_broadcastd_epi32(__mmask8 k, __m128i a); 
VPBROADCASTD __m128i _mm_broadcastd_epi32(__m128i a); 

VPBROADCASTD __m128i __mm_mask_broadcastd_epi32(__m128i s,___mmask8 k,___m128i a); 
VPBROADCASTD __m128i_mm_maskz_broadcastd_epi32(__mmask8 k, __m128i a); 
VPBROADCASTQ __m512i_mm512_broadcastq_epi64( __m128i a); 

VPBROADCASTQ __m512i_mm512_mask_broadcastq_epi64(__m512i s,___mmask8 k, __m128i a); 
VPBROADCASTQ __m512i_mm512_maskz_broadcastq_epi64(_mmask8 k, __m128i a); 
VPBROADCASTQ __m256i __mm256_broadcastq_epi64(__m128i a); 

VPBROADCASTQ __m256i__mm256_mask_broadcastq_epi64(__m256i s, ___mmask8 k, __m128i a); 
VPBROADCASTQ __m256i _mm256_maskz_broadcastq_epi64(__mmask8 k, __m128i a); 
VPBROADCASTQ __m128i __mm_broadcastq_epi64(__m128i a); 

VPBROADCASTQ __m128i __mm_mask_broadcastq_epi64(__m128is,__ mmask8 k, 
VPBROADCASTQ __m128i __mm_maskz_broadcastq_epi64(__mmask8 k, __m128i a); 
VPBROADCASTW __m512i_mm512_broadcastw_epi16(__m128i a); 

VPBROADCASTW __m512i_mm512_mask_broadcastw_epi16(__m512is,__ mmask32 k, __m128i a); 
VPBROADCASTW __m512i_mm512_maskz_broadcastw_epi16(__mmask32 k,___m128i a); 
VPBROADCASTW __m256i __mm256_broadcastw_epi16(__m128i a); 

VPBROADCASTW __m256i __mm256_mask_broadcastw_epi16(__m256i s,__ mmask16 k, 
VPBROADCASTW __m256i __mm256_maskz_broadcastw_epi16(__mmask16 k,___m128i a); 
VPBROADCASTW __m128i __mm_broadcastw_epi16(__m128i a); 

VPBROADCASTW __m128i_mm_mask_broadcastw_epi16(__m128is,__ mmask8 k, __m128i a); 
VPBROADCASTW __m128i _mm_maskz_broadcastw_epi16(___mmask8 k, _m128i a); 
VBROADCASTI32x2 __m512i_mm512_broadcast_i32x2(__m128i a); 


m1 28i a); 


m128i a); 


m1 28i a); 
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mm512_mask_broadcast_i32x2(__m512is,__ mmask16 k,__m128i a); 


VBROADCASTI32x2 __m512i 


mm512_maskz_broadcast_i32x2(___mmask16 k,___m128i a); 


VBROADCASTI32x2 __m256i 


mm256_broadcast_i32x2(__m128i a); 


VBROADCASTI32x2 __m256i __mm256_mask_broadcast_i32x2(__m256i s,__ mmask8 k,__m128i a); 
VBROADCASTI32x2 __m256i __mm256_maskz_broadcast_i32x2(__mmask8 k, __m128i a); 
VBROADCASTI32x2 __m128i __mm_broadcast_i32x2(__m128i a); 
VBROADCASTI32x2 __m128i __mm_mask_broadcast_i32x2(__m128i s,__ mmask8 k, 
VBROADCASTI32x2 __m128i __mm_maskz_broadcast_i32x2(__mmask8 k, __m128i a); 
VBROADCASTI32x4 __m512i_mm512_broadcast_i32x4(__m128i a); 


m128i a); 


VBROADCASTI32x4 __m512i__mm512_mask_broadcast_i32x4(__m512is,__ mmask16 k,__m128i a); 


VBROADCASTI32x4 __m512i_mm512_maskz_broadcast_i32x4(__mmask16 k, __m128i a); 
VBROADCASTI32x4 __m256i__mm256_broadcast_i32x4(__m128i a); 

VBROADCASTI32x4 __m256i _mm256_mask_broadcast_i32x4(__m256i s,___ mmask8 k,___m128i a); 
VBROADCASTI32x4 __m256i __mm256_maskz_broadcast_i32x4(__mmask8 k, __m128i a); 
VBROADCASTI32x8 __m512i_mm512_broadcast_i32x8(__m256i a); 


VBROADCASTI32x8 __m512i__mm512_mask_broadcast_i32x8(__m512i s,___ mmask16 k,___m256i a); 


VBROADCASTI32x8 __m512i_mm512_maskz_broadcast_i32x8(__mmask16 k, __m256i a); 
VBROADCASTI64x2 __m512i_mm512_broadcast_i64x2(__m128i a); 

VBROADCASTI64x2 __ m512i_mm512_mask_broadcast_i64x2(__m512i s,__ mmask8 k,___m128i a); 
VBROADCASTI64x2 _ m512i_mm512_maskz_broadcast_i64x2(__mmask8 k, __m128i a); 
VBROADCASTI64x2 __m256i__mm256_broadcast_i64x2(__m128i a); 

VBROADCASTI64x2 __ m256i __mm256_mask_broadcast_i64x2(__m256i s,___ mmask8 k,__m128i a); 
VBROADCASTI64x2 __ m256i __mm256_maskz_broadcast_i64x2(__mmask8 k, __m128i a); 
VBROADCASTI64x4 __ _m512i_mm512_broadcast_i64x4(__m256i a); 

VBROADCASTI64x4 _ m512i__mm512_mask_broadcast_i64x4(__m512i s,___ mmask8 k, __ m256i a); 
VBROADCASTI64x4 _—_m512i_mm512_maskz_broadcast_i64x4(__mmask8 k, __m256i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instructions, see Table 2-23, “Type 6 Class Exception Conditions”. 


EVEX-encoded instructions, syntax with reg/mem operand, see Table 2-53, “Type E6 Class Exception Conditions”. 


Additionally: 

#UD If VEX.L = 0 for VPBROADCASTQ, VPBROADCASTI128. 
If EVEX.L’L = 0 for VBROADCASTI32X4/VBROADCASTI64X2. 
If EVEX.L’L < 10b for VBROADCASTI32X8/VBROADCASTI64X4. 
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VPBROADCASTM—Broadcast Mask to Vector Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support Flag 
EVEX.128.F3.0F38.W1 2A /r RM VIV AVX512VL | Broadcast low byte value in k1 to two locations in xmm1. 
VPBROADCASTMB2Q xmm1, k1 AVX512CD 
EVEX.256.F3.0F38.W1 2A /r RM VIV AVX512VL | Broadcast low byte value in k1 to four locations in ymm1. 
VPBROADCASTMB2Q ymm1, k1 AVX512CD 
EVEX.512.F3.0F38.W1 2A /r RM VIV AVX512CD | Broadcast low byte value in k1 to eight locations in zmm1. 
VPBROADCASTMB2Q zmm1, k1 
EVEX.128.F3.0F38.W0 3A /r RM VIV AVX512VL | Broadcast low word value in k1 to four locations in xmm1. 
VPBROADCASTMW2D xmm1, k1 AVX512CD 
EVEX.256.F3.0F38.W0 3A /r RM VIV AVX512VL | Broadcast low word value in k1 to eight locations in ymm1. 
VPBROADCASTMW2D ymm1, k1 AVX512CD 
EVEX.512.F3.0F38.W0 3A /r RM VV AVX512CD | Broadcast low word value in k1 to sixteen locations in 
VPBROADCASTMW2D zmm1, k1 zmm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Broadcasts the zero-extended 64/32 bit value of the low byte/word of the source operand (the second operand) to 
each 64/32 bit element of the destination operand (the first operand). The source operand is an opmask register. 
The destination operand is a ZMM register (EVEX.512), YMM register (EVEX.256), or XMM register (EVEX.128). 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Operation 


VPBROADCASTMB2Q 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 

i:= j*64 

DEST[i+63:i] := ZeroExtend(SRC[7:0]) 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPBROADCASTMW2D 
(KL, VL) = (4, 128), (8, 256),(16, 512) 
FOR j := 0 TOKL-1 

i:= j*32 

DEST[i+31:i] := ZeroExtend(SRC[15:0]) 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPBROADCASTMB2Q __m512i_mm512_broadcastmb_epi64(__mmask8); 
VPBROADCASTMW2D __m512i_mm512_broadcastmw_epi32(__mmask16); 
VPBROADCASTMB2Q __m256i__mm256_broadcastmb_epi64(___mmask8); 
VPBROADCASTMW2D __m256i __mm256_broadcastmw_epi32(__mmask8); 
VPBROADCASTMB2Q __m128i __mm_broadcastmb_epi64( ___mmask8); 
VPBROADCASTMW2D __m128i__mm_broadcastmw_epi32(__mmask8); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


EVEX-encoded instruction, see Table 2-54, “Type E6NF Class Exception Conditions”. 
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VPCMPB/VPCMPUB—Compare Packed Byte Values Into Mask 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 3F /r ib A VIV AVX512VL_ | Compare packed signed byte values in xmm3/m128 and 
AVX512BW | xmmz using bits 2:0 of imm8 as a comparison predicate 
VPCMPB k1 {k2}, xmm2, with writemask k2 and leave the result in mask register 
xmm3/m128, imm8 k1, 
EVEX.256.66.0F3A.WO 3F /r ib A VV AVX512VL_ | Compare packed signed byte values in ymm3/m256 and 
AVX512BW | ymm2 using bits 2:0 of imm8 as a comparison predicate 
VPCMPB k1 {k2}, ymm2, with writemask k2 and leave the result in mask register 
ymm3/m256, imm8 k1. 
EVEX.512.66.0F3A.WO 3F /r ib A VIN AVX512BW | Compare packed signed byte values in zmm3/m512 and 
VPCMPB k1 {k2}, zmm2, zmm_2 using bits 2:0 of imm8 as a comparison predicate 
zmm3/m51 2, imm8 with writemask k2 and leave the result in mask register 
k1. 
EVEX.128.66.0F3A.WO 3€ /r ib A VIV AVX512VL_ | Compare packed unsigned byte values in xmm3/m128 
AVX512BW | and xmm2 using bits 2:0 of imm8 as a comparison 
VPCMPUB k1 {k2}, xmm2, predicate with writemask k2 and leave the result in mask 
xmm3/m128, imm8 register k1. 
EVEX.256.66.0F3A.WO 3€ /r ib A VIV AVX512VL_ | Compare packed unsigned byte values in ymm3/m256 
AVX512BW | and ymm2 using bits 2:0 of imm8 as a comparison 
VPCMPUB k1 {k2}, ymm2, predicate with writemask k2 and leave the result in mask 
ymm3/m256, imm8 register k1. 
EVEX.512.66.0F3A.WO 3€ /r ib A VV AVX512BW | Compare packed unsigned byte values in zmm3/m512 
VPCMPUB k1 {k2}, zmm2, and zmm2 using bits 2:0 of imm8 as a comparison 
zmm3/m512, imm8 predicate with writemask k2 and leave the result in mask 
register k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed byte values in the second source operand and the first source operand and 
returns the results of the comparison to the mask destination operand. The comparison predicate operand (imme- 
diate byte) specifies the type of comparison performed on each pair of packed values in the two source operands. 
The result of each comparison is a single mask bit result of 1 (comparison true) or 0 (comparison false). 


VPCMPB performs a comparison between pairs of signed byte values. 
VPCMPUB performs a comparison between pairs of unsigned byte values. 


The first source operand (second operand) is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand (first operand) is a mask 
register k1. Up to 64/32/16 comparisons are performed with results written to the destination operand under the 
writemask k2. 
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The comparison predicate operand is an 8-bit immediate: bits 2:0 define the type of comparison to be performed. 
Bits 3 through 7 of the immediate are reserved. Compiler can implement the pseudo-op mnemonic listed in Table 
5-8. 


Table 5-8. Pseudo-Op and VPCMP* Implementation 


Pseudo-Op PCMPM Implementation 
VPCMPEQ* reg, reg2, reg3 VPCMP* reg1, reg2, reg3, O 
VPCMPLT* reg1, reg2, reg3 VPCMP*reg1, reg2, reg3, 1 
VPCMPLE* reg1, reg2, reg3 VPCMP* reg1, reg2, reg3, 2 
VPCMPNEOQ* reg1, reg2, reg3 VPCMP* reg1, reg2, reg3, 4 
VPPCMPNLT* reg1, reg2, reg3 VPCMP* reg1, reg2, reg3, 5 
VPCMPNLE* reg1, reg2, reg3 VPCMP* reg1, reg2, reg3, 6 
Operation 
CASE (COMPARISON PREDICATE) OF 
O: OP := EQ; 
1: OP := LT; 
2: OP := LE; 
3: OP := FALSE; 
4: OP := NEQ; 
5: OP := NLT; 
6: OP := NLE; 
7: OP := TRUE; 
ESAC; 


VPCMPB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 


i:=j*8 
IF k2[j] OR *no writemask* 
THEN 
CMP := SRC1[i+7:i] OP SRC2[i+7:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{[j] = 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 
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VPCMPUB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 


i:=j*8 
IF k2[j] OR *no writemask* 
THEN 
CMP := SRC1[i+7:i] OP SRC2[i+7:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; Fl; 
ELSE DEST{[j] = 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCMPB __mmask64 _mm512_cmp_epi8_mask(__m512i a, __m512i b, int cmp); 

VPCMPB __mmask64 _mm512_mask_cmp_epi8_mask(___mmask64 m,__m512i a, ___m512ib, int cmp); 

VPCMPB __mmask32 _mm256_cmp_epi8_mask(__m256i a, __ m256i b, int cmp); 

VPCMPB __mmask32 _mm256_mask_cmp_epi8_mask( ___mmask32 m,__m256i a, __m256i b, int cmp); 

VPCMPB __mmask16 _mm_cmp_epi8_mask(__m128i a,___m128i b, int cmp); 

VPCMPB __mmask16 _mm_mask_cmp_epi8_mask(__mmask16 m,__m128i a, ___m128i b, int cmp); 

VPCMPB __mmask64 _mm512_cmp[eq|gelgt|le|lt|neq]_epi8_mask(_m512i a,__m512ib); 

VPCMPB __mmask64 _mm512_mask_cmp[eq|gelgtlle|ItIneq]_epi8_mask(__mmask64 m,_m512i a,__m512i b); 
VPCMPB __mmask32 _mm256_cmp[eq|gelgt|le|lt|neq]_epi8_mask( __m256i a, __m256i b); 

VPCMPB __mmask32 _mm256_mask_cmp[eq|gelgtlle|It|neq]_epi8_mask(__mmask32 m,__m256i a,__ m256i b); 
VPCMPB __mmask16 _mm_cmpfeq|ge|gt|le|lt|neq]_epi8_mask(__m128i a, ___m128i b); 

VPCMPB __mmask16 _mm_mask_cmp[eq|gel|gtlle|It|neq]_epi8_mask(__mmask16 m, ___m128i a,__m128i b); 

VPCMPUB __mmask64_mm512_cmp_epu8_mask(__m512ia,__m512ib, int cmp); 

VPCMPUB __mmask64 __mm512_mask_cmp_epu8_mask(__mmask64 m,_m512i a,__m512i, int cmp); 

VPCMPUB __mmask32 _mm256_cmp_epu8_mask(__m256i a,__ m256i b, int cmp); 

VPCMPUB __mmask32 _mm256_mask_cmp_epu8_mask(__mmask32 m,__m256i a,__ m256i b, int cmp); 

VPCMPUB __mmask16 _mm_cmp_epu8_mask(__m128i a,__m128ib, int cmp); 

VPCMPUB __mmask16 _mm_mask_cmp_epu8_mask(__mmask16 m, __m128i a, ___m128i, int cmp); 

VPCMPUB __mmask64_mm512_cmpf[eq|ge|gtlle|It|neq]_epu8_mask(__m512i a,__m512i b, int cmp); 

VPCMPUB __mmask64 __mm512_mask_cmp[eq|ge|gt|le|lt|neq]_epu8_mask(___ mmask64 m,__m512i a,__m512ib, int cmp); 
VPCMPUB __mmask32 _mm256_cmp[eq|ge|gtlle|It|neq]_epu8_mask(__m256i a, ___ m256i b, int cmp); 

VPCMPUB __mmask32 _mm256_mask_cmp[eq|ge|gt|le|lt|neq]_epu8_mask(_mmask32 m,__m256i a, ___m256i b, int cmp); 
VPCMPUB __mmask16 _mm_cmp[eq|gelgtlle|It|Ineq]_epu8_mask(__m128i a,__m128i b, int cmp); 

VPCMPUB __mmask16 _mm_mask_cmp[eq|ge|gt|le|lt|neq]_epu8_mask(___mmask16 m,__m128i a,__m128i b, int cmp); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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VPCMPD/VPCMPUD—Compare Packed Integer Values into Mask 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

EVEX.128.66.0F3A.WO 1F /r ib A VIV AVX512VL | Compare packed signed doubleword integer values in 

VPCMPD k1 {k2}, xmm2, AVX512F xmm3/m128/m32bcst and xmm2z using bits 2:0 of imm8 

xmm3/m128/m32bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.256.66.0F3A.WO 1F /r ib A VIV AVX512VL | Compare packed signed doubleword integer values in 

VPCMPD k1 {k2}, ymm2, AVX512F ymm3/m256/m32bcst and ymmz using bits 2:0 of imm8 

ymm3/m256/m32bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.512.66.0F3A.WO 1F /r ib A VIV AVX512F Compare packed signed doubleword integer values in 

VPCMPD k1 {k2}, zmm2, zmm2 and zmm3/m512/m32bcst using bits 2:0 of imm8 

zmm3/m512/m32bcst, imm8 as a comparison predicate. The comparison results are 
written to the destination k1 under writemask k2. 

EVEX.128.66.0F3A.WO 1€ /r ib A VIV AVX512VL | Compare packed unsigned doubleword integer values in 

VPCMPUD k1 {k2}, xmm2, AVX512F xmm3/m128/m32bcst and xmm2z using bits 2:0 of imm8 

xmm3/m128/m32bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.256.66.0F3A.WO 1€ /r ib A VIV AVX512VL | Compare packed unsigned doubleword integer values in 

VPCMPUD k1 {k2}, ymm2, AVX512F ymm3/m256/m32bcst and ymmz using bits 2:0 of imm8 

ymm3/m256/m32bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.512.66.0F3A.WO 1€ /r ib A VIV AVX512F Compare packed unsigned doubleword integer values in 

VPCMPUD k1 {k2}, zmm2, zmme2 and zmm3/m512/m32bcst using bits 2:0 of imm8 

zmm3/m512/m32bcst, imm8 as a comparison predicate. The comparison results are 
written to the destination k1 under writemask k2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Performs a SIMD compare of the packed integer values in the second source operand and the first source operand 
and returns the results of the comparison to the mask destination operand. The comparison predicate operand 
(immediate byte) specifies the type of comparison performed on each pair of packed values in the two source oper- 
ands. The result of each comparison is a single mask bit result of 1 (comparison true) or 0 (comparison false). 


VPCMPD/VPCMPUD performs a comparison between pairs of signed/unsigned doubleword integer values. 
The first source operand (second operand) is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location or a 512-bit vector broadcasted from a 32-bit 


memory location. The destination operand (first operand) is a mask register k1. Up to 16/8/4 comparisons are 
performed with results written to the destination operand under the writemask k2. 


The comparison predicate operand is an 8-bit immediate: bits 2:0 define the type of comparison to be performed. 
Bits 3 through 7 of the immediate are reserved. Compiler can implement the pseudo-op mnemonic listed in Table 
5-8. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


CASE (COMPARISON PREDICATE) OF 
O: OP := EQ; 
1: OP := LT; 
2: OP :=LE; 
3: OP := FALSE; 
4: OP := NEQ; 
5: OP := NLT; 
6: OP := NLE; 
7: OP := TRUE; 
ESAC; 


VPCMPD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN CMP := SRC1[i+31:i] OP SRC2[31:0]; 
ELSE CMP := SRC1[i+31:i] OP SRC2[i+31:i]; 
Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FA; 
ELSE DEST{[j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPCMPUD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN CMP := SRC1[i+31:i] OP SRC2[31:0]; 
ELSE CMP := SRC1[i+31:i] OP SRC2[i+31:i]; 
Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FA; 
ELSE DEST{[j] := 0 ; zeroing-masking onlyFl; 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 
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VPCMPD/VPCMPUD—Compare Packed Integer Values into Mask 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCMPD __mmask16 __mm512_cmp_epi32_mask(__m512i a,__m512ib, int imm); 

VPCMPD __mmask16 _mm512_mask_cmp_epi32_mask(__mmask16 k,___m512i a,__m512ib, int imm); 
VPCMPD __mmask16 _mm512_cmpfeq|lge|gtlle|lt|neq]_epi32_mask(_m512i a,__m512i b); 

VPCMPD __mmask16 _mm512_mask_cmp[eq|ge|gt|le|lt|neq]_epi32_mask(__mmask16 k,___m512i a,__m512i b); 
VPCMPUD __mmask16 _mm512_cmp_epu32_mask(__m512ia,__m512i, int imm); 

VPCMPUD __mmask16 __mm512_mask_cmp_epu32_mask(__mmask16 k,__m512i a,__m512ib, int imm); 
VPCMPUD __mmask16 _mm512_cmp[eq|gelgt|le|Itjneq]_epu32_mask(__m512i a,__m512ib); 


VPCMPUD __mmask16 __mm512_mask_cmpf[eq|ge|gtlle|lt|neq]_epu32_mask(__mmask16 k,__m512i a,__m512i b); 
VPCMPD __mmask8 _mm256_cmp_epi32_mask(__m256i a,__m256ib, int imm); 

VPCMPD __mmask8 _mm256_mask_cmp_epi32_mask(__mmask8 k,___m256i a, __ m256i b, int imm); 

VPCMPD __mmask8 _mm256_cmpfeq|ge|gt|le|lt|neq]_epi32_mask(__m256i a, __m256i b); 

VPCMPD __mmask8 _mm256_mask_cmp[eq|gelgt|le|ltIneq]_epi32_mask(__mmask8 k, __ m256i a, __m256i b); 
VPCMPUD __mmask8 __mm256_cmp_epu32_mask(__m256i a,__ m256i b, int imm); 

VPCMPUD __mmask8 _mm256_mask_cmp_epu32_mask(__mmask8 k, __ m256i a,__m256i b, int imm); 
VPCMPUD __mmask8 _mm256_cmp[eq|gelgtlle|Itineq]_epu32_mask(__m256i a, ___m256i b); 

VPCMPUD __mmask8 _mm256_mask_cmp[eq|ge|gtlle|lt|neq]_epu32_mask(__mmask8 k,___m256i a, __ m256i b); 
VPCMPD __mmask8 _mm_cmp_epi32_mask(__m128i a,__m128ib, int imm); 

VPCMPD __mmask8 _mm_mask_cmp_epi32_mask(__mmask8 k, __m128i a, ___m128i b, int imm); 

VPCMPD __mmask8 _mm_cmpfeaq|lge|gtlle|lt|neq]_epi32_mask(___m128i a,__m128i b); 

VPCMPD __mmask8 _mm_mask_cmp[eq|ge|gtle|lt|neq]_epi32_mask(__mmask8 k, __m128i a,__m128i b); 


VPCMPUD __mmask8 _mm_cmp_epu32_mask(__m128i a, __m128i b, int imm); 

VPCMPUD __mmask8 _mm_mask_cmp_epu32_mask(__mmask8 k, __m128i a,__m128ib, int imm); 
VPCMPUD __mmask8 _mm_cmp[eq|gelgtlle|Itineq]_epu32_mask(__m128i a,__m128i b); 

VPCMPUD __mmask8 _mm_mask_cmp[eq|lge|gtlle|lt|neq]_epu32_mask(__mmask8 k, __m128i a, ___m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPCMPQ/VPCMPUQ—Compare Packed Integer Values into Mask 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

EVEX.128.66.0F3A.W1 1F /r ib A VIV AVX512VL | Compare packed signed quadword integer values in 

VPCMPQ k1 {k2}, xmm2, AVX512F xmm3/m128/m64bcst and xmm_z using bits 2:0 of imm8 

xmm3/m128/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.256.66.0F3A.W1 1F /r ib A VIV AVX512VL | Compare packed signed quadword integer values in 

VPCMPQ k1 {k2}, ymm2, AVX512F ymm3/m256/m64bcst and ymmz using bits 2:0 of imm8 

ymm3/m256/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.512.66.0F3A.W1 1F /r ib A VIV AVX512F Compare packed signed quadword integer values in 

VPCMPQ k1 {k2}, zmm2, zmm3/m512/m64bcst and zmm2 using bits 2:0 of imm8 

zmm3/m512/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.128.66.0F3A.W1 1€ /r ib A VIV AVX512VL | Compare packed unsigned quadword integer values in 

VPCMPUQ k1 {k2}, xmm2, AVX512F xmm3/m128/m64bcst and xmmz using bits 2:0 of imm8 

xmm3/m1 28/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.256.66.0F3A.W1 1€ /r ib A VIV AVX512VL | Compare packed unsigned quadword integer values in 

VPCMPUQ k1 {k2}, ymm2, AVX512F ymm3/m256/m64bcst and ymmz using bits 2:0 of imm8 

ymm3/m256/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 

EVEX.512.66.0F3A.W1 1€ /r ib A VIV AVX512F Compare packed unsigned quadword integer values in 

VPCMPUQ k1 {k2}, zmm2, zmm3/m512/m64bcst and zmm_2 using bits 2:0 of imm8 

zmm3/m512/m64bcst, imm8 as a comparison predicate with writemask k2 and leave 
the result in mask register k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imms 
Description 


Performs a SIMD compare of the packed integer values in the second source operand and the first source operand 
and returns the results of the comparison to the mask destination operand. The comparison predicate operand 
(immediate byte) specifies the type of comparison performed on each pair of packed values in the two source oper- 
ands. The result of each comparison is a single mask bit result of 1 (comparison true) or 0 (comparison false). 


VPCMPQ/VPCMPUQ performs a comparison between pairs of signed/unsigned quadword integer values. 
The first source operand (second operand) is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location or a 512-bit vector broadcasted from a 64-bit 


memory location. The destination operand (first operand) is a mask register k1. Up to 8/4/2 comparisons are 
performed with results written to the destination operand under the writemask k2. 


The comparison predicate operand is an 8-bit immediate: bits 2:0 define the type of comparison to be performed. 
Bits 3 through 7 of the immediate are reserved. Compiler can implement the pseudo-op mnemonic listed in Table 
5-8. 
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Operation 


CASE (COMPARISON PREDICATE) OF 
O: OP := EQ; 
1: OP := LT; 
2: OP :=LE; 
3: OP := FALSE; 
4: OP := NEQ; 
5: OP := NLT; 
6: OP := NLE; 
7: OP := TRUE; 
ESAC; 


VPCMPQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN CMP := SRC1[i+63:i] OP SRC2[63:0]; 
ELSE CMP := SRC1[i+63:i] OP SRC2[i+63:i); 


Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{[j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 


VPCMPUQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k2[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN CMP := SRC1[i+63:i] OP SRC2[63:0]; 
ELSE CMP := SRC1[i+63:i] OP SRC2[i+63:i); 


Fl; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FI; 
ELSE DEST{[j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 


VPCMPQ/VPCMPUQ—Compare Packed Integer Values into Mask 


INSTRUCTION SET REFERENCE, V-Z 


Vol. 2C 5-329 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCMPQ __mmask8 _mm512_cmp_epi64_mask(__m512i a, __m512i b, int imm); 

VPCMPQ __mmask8 __mm512_mask_cmp_epi64_mask(__mmask8 k, __m512i a, __m512ib, int imm); 
VPCMPQ __mmask8 _mm512_cmp[eq|gelgtlle|Itineq]_epi64_mask(__m512i a, ___m512i b); 
VPCMPQ __mmask8 _mm512_mask_cmpf[eq|lge|gt|le|lt|neq]_epi64_mask(__mmask8 k, __m512i a, 
VPCMPUQ __mmask8 __mm512_cmp_epu64_mask(__m512i a, __m512ib, int imm); 

VPCMPUQ __mmask8 _mm512_mask_cmp_epu64_mask(__mmask8 k,___m512i a, __m512i b, int imm); 
VPCMPUQ __mmask8 _mm512_cmpfeq|ge|gt|le|lt|neq]_epu64_mask(__m512i a,__m512i b); 


m512i b); 


VPCMPUQ __mmask8 _mm512_mask_cmp[eq|gel|gtlle|ItIneq]_epu64_mask(__mmask8 k,___m512i a,__m512ib); 
VPCMPQ __mmask8 _mm256_cmp_epi64_mask(__m256i a, __m256i b, int imm); 

VPCMPQ __mmask8 _mm256_mask_cmp_epi64_mask(__mmask8 k, __m256i a, __m256i b, int imm); 

VPCMPQ __mmask8 _mm256_cmp[eq|gelgtlle|Itineq]_epi64_mask(__m256i a, __ m256i b); 

VPCMPQ __mmask8 _mm256_mask_cmp[eq|lge|gt|le|lt|neq]_epi64_mask(__mmask8 k, __ m256i a, ___m256i b); 
VPCMPUQ __mmask8 _mm256_cmp_epu64_mask(__m256i a, __m256i b, int imm); 

VPCMPUQ __mmask8 _mm256_mask_cmp_epu64_mask(__mmask8 k, __m256i a, __m256i b, int imm); 
VPCMPUQ __mmask8 _mm256_cmpfeq|ge|gt|le|lt|neq]_epu64_mask(__m256i a, _ m256i b); 

VPCMPUQ __mmask8 _mm256_mask_cmp[eq|ge|gtlle|It|neq]_epu64_mask(__mmask8 k, __ m256i a, ___m256i b); 


VPCMPQ __mmask8 _mm_cmp_epi64_mask(__m128i a, __m128i , int imm); 
VPCMPQ __mmask8 _mm_mask_cmp_epi64_mask(__mmask8 k, __m128i a, __m128i b, int imm); 
VPCMPQ __mmask8 _mm_cmp[eq|lge|gtlle|ItIneq]_epi64_mask(__m128i a,__m128i b); 

VPCMPQ __mmask8 _mm_mask_cmp[eq|ge|gtlle|lt|neq]_epi64_mask(__mmask8 k, __m128i a,__m128i b); 
VPCMPUQ __mmask8 _mm_cmp_epu64_mask(__m128i a, __m128i b, int imm); 

VPCMPUQ __mmask8 _mm_mask_cmp_epu64_mask(__mmask8 k, __m128i a, __m128ib, int imm); 
VPCMPUQ __mmask8 _mm_cmpfeq|lge|gtlle|lt|neq]_epu64_mask(__m128i a, __m128i b); 
VPCMPUQ __mmask8 _mm_mask_cmp[eq|ge|gt|le|ItIneq]_epu64_mask(__mmask8 k, __m128i a, 


m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPCMPW/VPCMPUW—Compare Packed Word Values Into Mask 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W1 3F /r ib A VIV AVX512VL_ | Compare packed signed word integers in xmm3/m128 
AVX512BW | and xmm2 using bits 2:0 of imm8 as a comparison 
VPCMPW k1 {k2}, xmm2, predicate with writemask k2 and leave the result in 
xmm3/m128, imm8 mask register k1. 
EVEX.256.66.0F3A.W1 3F /r ib A VIV AVX512VL_ | Compare packed signed word integers in ymm3/m256 
AVX512BW | and ymm2 using bits 2:0 of imm8 as a comparison 
VPCMPW k1 {k2}, ymm2, predicate with writemask k2 and leave the result in 
ymm3/m256, imm8 mask register k1. 
EVEX.512.66.0F3A.W1 3F /r ib A VIV AVX512BW | Compare packed signed word integers in zmm3/m512 
VPCMPW k1 {k2}, zmm2, and zmmz using bits 2:0 of imm8 as a comparison 
zmm3/m512, imm8 predicate with writemask k2 and leave the result in 
mask register k1. 
EVEX.128.66.0F3A.W1 3€ /r ib A VIV AVX512VL_ | Compare packed unsigned word integers in xmm3/m128 
AVX512BW | and xmm2 using bits 2:0 of imm8 as a comparison 
VPCMPUW k1 {k2}, xmm2, predicate with writemask k2 and leave the result in 
xmm3/m128, imm8 mask register k1. 
EVEX.256.66.0F3A.W1 3€ /r ib A VIV AVX512VL_ | Compare packed unsigned word integers in ymm3/m256 
AVX512BW | and ymm2 using bits 2:0 of imm8 as a comparison 
VPCMPUW k1 {k2}, ymm2, predicate with writemask k2 and leave the result in 
ymm3/m256, imm8 mask register k1. 
VPCMPUW k1 {k2}, zmm2, A VIV AVX512BW | Compare packed unsigned word integers inzmm3/m512 
zmm3/m51 2, imm8 and zmmz using bits 2:0 of imm8 as a comparison 
predicate with writemask k2 and leave the result in 
mask register k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a SIMD compare of the packed integer word in the second source operand and the first source operand 
and returns the results of the comparison to the mask destination operand. The comparison predicate operand 
(immediate byte) specifies the type of comparison performed on each pair of packed values in the two source oper- 
ands. The result of each comparison is a single mask bit result of 1 (comparison true) or 0 (comparison false). 


VPCMPW performs a comparison between pairs of signed word values. 
VPCMPUW performs a comparison between pairs of unsigned word values. 


The first source operand (second operand) is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand (first operand) is a mask 
register k1. Up to 32/16/8 comparisons are performed with results written to the destination operand under the 
writemask k2. 


The comparison predicate operand is an 8-bit immediate: bits 2:0 define the type of comparison to be performed. 
Bits 3 through 7 of the immediate are reserved. Compiler can implement the pseudo-op mnemonic listed in Table 
5-8. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


CASE (COMPARISON PREDICATE) OF 
O: OP := EQ; 
1: OP := LT; 
2: OP :=LE; 
3: OP := FALSE; 
4: OP := NEQ; 
5: OP := NLT; 
6: OP := NLE; 
7: OP := TRUE; 
ESAC; 


VPCMPW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 


i:=j*16 
IF k2[j] OR *no writemask* 
THEN 
ICMP := SRC1[i+15:i] OP SRC2[i+15:i]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FA; 
ELSE DEST{[j] = 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 


VPCMPUW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 


i:=j*16 
IF k2[j] OR *no writemask* 
THEN 
CMP := SRC1[i+15:i] OP SRC2[i+1 5:1]; 
IF CMP = TRUE 
THEN DEST{j] := 1; 
ELSE DEST{j] := 0; FA; 
ELSE DEST{[j] = 0 ; zeroing-masking only 
Fl; 
ENDFOR 


DEST[MAX_KL-1:KL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCMPW __mmask32 _mm512_cmp_epi16_mask(__m512i a, ___m512i, int cmp); 

VPCMPW __mmask32 _mm512_mask_cmp_epi16_mask(__mmask32 m,__m512i a,__m512ib, int cmp); 
VPCMPW __mmask16 _mm256_cmp_epi16_mask(__m256i a, __ m256i b, int cmp); 

VPCMPW __mmask16 _mm256_mask_cmp_epi16_mask(__mmask16 m,___m256i a,___m256i b, int cmp); 
VPCMPW __mmask8 _mm_cmp_epi16_mask(__m128i a,__m128ib, int cmp); 

VPCMPW __mmask8 _mm_mask_cmp_epi16_mask(__mmask8 m, __m128i a,__m128ib, int cmp); 
VPCMPW __mmask32 _mm512_cmpfeq|lge|gtle|lt|neq]_epi16_mask(_m512i a,__m512i b); 


VPCMPW __mmask32 _mm512_mask_cmp[eq|gelgt|le|lt|neq]_epi16_mask(__ mmask32 m,_m512i a, ___m512i b); 
VPCMPW __mmask16 _mm256_cmpfeq|lge|gtlle|lt|neq]_epi16_mask(_ m256i a, __m256i b); 

VPCMPW __mmask16 _mm256_mask_cmp[eq|gelgtle|lt|neq]_epi16_mask(__mmask16 m,___m256i a, __m256i b); 
VPCMPW __mmask8 _mm_cmpfeaq|lge|gtlle|lt|neq]_epi1 6_mask(_m128i a, __m128i b); 

VPCMPW __mmask8 _mm_mask_cmp[eq|ge|gt|le|lt|neq]_epi16_mask(__mmask8 m,__m128i a, ___m128i b); 


VPCMPUW __mmask32 _mm512_cmp_epu16_mask(__m512ia,__m512ib, int cmp); 
VPCMPUW __mmask32 _mm512_mask_cmp_epu16_mask(__mmask32 m,__m512ia, 
VPCMPUW __mmask16 _mm256_cmp_epu16_mask(__m256i a,__ m256i b, int cmp); 
VPCMPUW __mmask16 __mm256_mask_cmp_epu16_mask(_mmask16 m,__m256i a, 
VPCMPUW __mmask8 _mm_cmp_epu16_mask(__m128i a, ___m128i b, int cmp); 
VPCMPUW __mmask8 _mm_mask_cmp_epu16_mask(__mmask8 m,__m128i a, 
VPCMPUW __mmask32 _mm512_cmp[eq|gelgtlle|It|neq]_epu16_mask(__m512ia, 


m512i b, int cmp); 


m256i b, int cmp); 


m1 28i b, int cmp); 
m512i b, int cmp); 


VPCMPUW __mmask32 _mm512_mask_cmp[eq|ge|gtlle|lt|neq]_epu16_mask(_mmask32 m,_m512i a,__m512ib, int cmp); 
VPCMPUW __mmask16 __mm256_cmpf[eq|gelgtlle|It|neq]_epu16_mask(__m256i a, ___m256i b, int cmp); 
VPCMPUW __mmask16 __mm256_mask_cmp[eq|ge|gtle|lt|neq]_epu16_mask(__mmask16 m,___m256i a, ___m256i b, int cmp); 


VPCMPUW __mmask8 _mm_cmp[eq|gelgtlle|itineq]_epu16_mask(__m128i a,__m128i b, int cmp); 


VPCMPUW __mmask8 _mm_mask_cmp[eq|ge|gtle|It|neq]_epu16_mask(__mmask8 m, __m128i a,__m128ib, int cmp); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPCOMPRESSB/VCOMPRESSW —Store Sparse Packed Byte/Word Integer Values into Dense 


Memory/Register 
Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.W0 63 /r A VIV AVX512_VBMI2 Compress up to 128 bits of packed byte values 
VPCOMPRESSB m1 28{k1}, xmm1 AVX512VL from xmm1 to m128 with writemask k1. 
EVEX.128.66.0F38.W0 63 /r B VIV AVX512_VBMI2 Compress up to 128 bits of packed byte values 
VPCOMPRESSB xmm1{k1}{z}, xmm2 AVX512VL from xmm2 to xmm1 with writemask k1. 
EVEX.256.66.0F38.W0 63 /r A VIV AVX512_VBMI2 Compress up to 256 bits of packed byte values 
VPCOMPRESSB m256{k1}, ymm1 AVX512VL from ymm1 to m256 with writemask k1. 
EVEX.256.66.0F38.W0 63 /r B VIV AVX512_VBMI2 Compress up to 256 bits of packed byte values 
VPCOMPRESSB ymm1{k1}{z}, ymm2 AVX512VL from ymm_2 to ymm1 with writemask k1. 
EVEX.512.66.0F38.W0 63 /r A VIV AVX512_VBMI2 Compress up to 512 bits of packed byte values 
VPCOMPRESSB m51 2{k1}, zmm1 from zmm1 to m512 with writemask k1. 
EVEX.512.66.0F38.W0 63 /r B VIV AVX512_VBMI2 Compress up to 512 bits of packed byte values 
VPCOMPRESSB zmm1{k1}{z}, zmm2 from zmm2 to zmm1 with writemask k1. 
EVEX.128.66.0F38.W1 63 /r A VIV AVX512_VBMI2 Compress up to 128 bits of packed word values 
VPCOMPRESSW m128{k1}, xmm1 AVX512VL from xmm1 to m128 with writemask k1. 
EVEX.128.66.0F38.W1 63 /r B VIV AVX512_VBMI2 Compress up to 128 bits of packed word values 
VPCOMPRESSW xmm1{k1}{z}, xmm2 AVX512VL from xmm2 to xmm1 with writemask k1. 
EVEX.256.66.0F38.W1 63 /r A VIV AVX512_VBMI2 Compress up to 256 bits of packed word values 
VPCOMPRESSW m256{k1}, ymm1 AVX512VL from ymm1 to m256 with writemask k1. 
EVEX.256.66.0F38.W1 63 /r B VIV AVX512_VBMI2 Compress up to 256 bits of packed word values 
VPCOMPRESSW ymm1{k1}{z}, ymm2 AVX512VL from ymm2 to ymm1 with writemask k1. 
EVEX.512.66.0F38.W1 63 /r A VIV AVX512_VBMI2 Compress up to 512 bits of packed word values 
VPCOMPRESSW m512{k1}, zmm1 from zmm1 to m512 with writemask k1. 
EVEX.512.66.0F38.W1 63 /r B VIV AVX512_VBMI2 Compress up to 512 bits of packed word values 
VPCOMPRESSW zmm1{k1}{z}, zmm2 from zmm2 to zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
B NA ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Compress (stores) up to 64 byte values or 32 word values from the source operand (second operand) to the desti- 
nation operand (first operand), based on the active elements determined by the writemask operand. Note: 
EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Moves up to 512 bits of packed byte values from the source operand (second operand) to the destination operand 
(first operand). This instruction is used to store partial contents of a vector register into a byte vector or single 
memory location using the active elements in operand writemask. 


Memory destination version: Only the contiguous vector is written to the destination memory location. EVEX.z 
must be zero. 


Register destination version: If the vector length of the contiguous vector is less than that of the input vector in the 
source operand, the upper bits of the destination register are unmodified if EVEX.z is not set, otherwise the upper 
bits are zeroed. 


This instruction supports memory fault suppression. 


5-334 Vol. 2C VPCOMPRESSB/VCOMPRESSW —Store Sparse Packed Byte/Word Integer Values into Dense Memory/Register 


INSTRUCTION SET REFERENCE, V-Z 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 


instead of the size of the full vector. 


Operation 


VPCOMPRESSB store form 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
k:=0 
FOR j := 0 TO KL-1: 
IF k1[j] OR *no writemask*: 
DEST.byte[k] := SRC.byte[j] 
k:=k+1 


VPCOMPRESSB reg-reg form 

(KL, VL) = (16, 128), (32, 256), (64, 512) 
k:=0 

FOR j := 0 TOKL-1: 

IF k1[j] OR *no writemask*: 
DEST.byte[k] := SRC.byte[j] 
k:i=k+1 

IF *merging-masking*: 
*DEST[VL-1:k*8] remains unchanged* 
ELSE DEST[VL-1:k*8] := 0 
DEST[MAX_VL-1:VL] := 0 


VPCOMPRESSW store form 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
k:=0 
FOR j := 0 TOKL-1: 
IF k1[j] OR *no writemask*: 
DEST.word[k] := SRC.word[j] 
k:i=k+1 


VPCOMPRESSW reg-reg form 

(KL, VL) = (8, 128), (16, 256), (32, 512) 
k:=0 

FOR j := 0 TOKL-1: 

IF k1[j] OR *no writemask*: 
DEST.word[k] := SRC.word[j] 
k:i=k+1 

IF *merging-masking*: 
*DEST[VL-1:k*16] remains unchanged* 
ELSE DEST[VL-1:k*16] := 0 
DEST[MAX_VL-1:VL] := 0 


VPCOMPRESSB/VCOMPRESSW —Store Sparse Packed Byte/Word Integer Values into Dense Memory/Register 


Vol. 2C 5-335 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCOMPRESSB __m128i_mm_mask_compress_epi8(__m128i, _ mmask16, __m128i); 
VPCOMPRESSB __m128i __mm_maskz_compress_epi8(__mmask16, __m128i); 
VPCOMPRESSB __m256i __mm256_mask_compress_epi8(__m256i,__ mmask32, __m256i); 
VPCOMPRESSB __m256i __mm256_maskz_compress_epi8(__mmask32, __m256i); 
VPCOMPRESSB __m512i__mm512_mask_compress_epi8(__m512i,__ mmask64,___m512i); 
VPCOMPRESSB __m512i__mm512_maskz_compress_epi8(__mmask64, __m512i); 
VPCOMPRESSB void _mm_mask_compressstoreu_epi8(void*, _ mmask16,___m128i); 
VPCOMPRESSB void _mm256_mask_compressstoreu_epi8(void*, _ mmask32, __m256i); 
VPCOMPRESSB void __mm512_mask_compressstoreu_epi8(void*, _ mmask64,___m512i); 
VPCOMPRESSW __m128i _mm_mask_compress_epi16(__m128i, __ mmask8, __m128i); 
VPCOMPRESSW __m128i _mm_maskz_compress_epi16(__mmask8, __m128i); 


VPCOMPRESSW __m256i _mm256_mask_compress_epi16(__m256i,__ mmask16, __ m256i); 
VPCOMPRESSW __m256i _mm256_maskz_compress_epi16(__mmask16, __m256i); 
VPCOMPRESSW __m512i _mm512_mask_compress_epi16(__m512i,__ mmask32,___m512i); 


VPCOMPRESSW __m512i _mm512_maskz_compress_epi16(__mmask32, __m512i); 
VPCOMPRESSW void _mm_mask_compressstoreu_epil6(void*, _ mmask8, _m128i); 
VPCOMPRESSW void _mm256_mask_compressstoreu_epi16(void*, _ mmask16, __m256i); 
VPCOMPRESSW void _mm512_mask_compressstoreu_epi16(void*, _ mmask32, __m512ii); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 


5-336 Vol. 2C VPCOMPRESSB/VCOMPRESSW —Store Sparse Packed Byte/Word Integer Values into Dense Memory/Register 


INSTRUCTION SET REFERENCE, V-Z 


VPCOMPRESSD-—Store Sparse Packed Doubleword Integer Values into Dense Memory/Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.WO 8B /r A VIV AVX512VL | Compress packed doubleword integer values from 
VPCOMPRESSD xmm1/m128 {k1}{z}, xmm2 AVX512F xmme2 to xmm1/m128 using controlmask k1. 
EVEX.256.66.0F38.WO 8B /r A VIV AVX512VL | Compress packed doubleword integer values from 
VPCOMPRESSD ymm1/m256 {k1}{z}, ymnm2 AVX512F ymme2 to ymm1/m256 using controlmask k1. 
EVEX.512.66.0F38.W0O 8B /r A VIV AVX512F Compress packed doubleword integer values from 
VPCOMPRESSD zmm1/m512 {k1}{z}, zmm2 zmme2 to zmm1/m512 using controlmask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Compress (store) up to 16/8/4 doubleword integer values from the source operand (second operand) to the desti- 
nation operand (first operand). The source operand is aZMM/YMM/XMM register, the destination operand can bea 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. 

The opmask register ki selects the active elements (partial vector or possibly non-contiguous if less than 16 active 
elements) from the source operand to compress into a contiguous vector. The contiguous vector is written to the 
destination starting from the low element of the destination operand. 

Memory destination version: Only the contiguous vector is written to the destination memory location. EVEX.z 
must be zero. 


Register destination version: If the vector length of the contiguous vector is less than that of the input vector in the 
source operand, the upper bits of the destination register are unmodified if EVEX.z is not set, otherwise the upper 
bits are zeroed. 

Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VPCOMPRESSD (EVEX encoded versions) store form 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
SIZE := 32 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no controlmask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+31:i] 
k:=k + SIZE 
Fl; 


ENDFOR; 
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INSTRUCTION SET REFERENCE, V-Z 


VPCOMPRESSD (EVEX encoded versions) reg-reg form 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
SIZE := 32 
k:=0 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no controlmask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+31:i] 
k:=k+ SIZE 
Fl; 
ENDFOR 
IF *merging-masking* 
THEN *DEST[VL-1:k] remains unchanged* 
ELSE DEST[VL-1:k] := 0 
Fl 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCOMPRESSD __m512i_mm512_mask_compress_epi32(__m512is,__ mmask16 c,__m512i a); 
VPCOMPRESSD __m512i_mm512_maskz_compress_epi32(__mmask16 c,__m512i a); 
VPCOMPRESSD void __mm512_mask_compressstoreu_epi32(void * a,__ mmask16c,__m512is); 
VPCOMPRESSD __m256i__mm256_mask_compress_epi32(__m256i s,__ mmask8 c,___ m256i a); 
VPCOMPRESSD __m256i __mm256_maskz_compress_epi32(__mmask8 c,___m256i a); 
VPCOMPRESSD void __mm256_mask_compressstoreu_epi32(void * a,__ mmask8 c,__ m256i s); 
VPCOMPRESSD __m128i__mm_mask_compress_epi32(__m128i s,__mmask8 c,__m128i a); 
VPCOMPRESSD __m128i _mm_maskz_compress_epi32(__mmask8 c, __m128i a); 
VPCOMPRESSD void _mm_mask_compressstoreu_epi32(void * a,__ mmask8 c,___m128i s); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 


5-338 Vol. 2C VPCOMPRESSD—Store Sparse Packed Doubleword Integer Values into Dense Memory/Register 


INSTRUCTION SET REFERENCE, V-Z 


VPCOMPRESSQ-—Store Sparse Packed Quadword Integer Values into Dense Memory/Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 8B /r A VIV AVX512VL | Compress packed quadword integer values from 
VPCOMPRESSQ xmm1/m1 28 {k1}{z}, xmm2 AVX512F xmm2 to xmm1/m128 using controlmask k1. 
EVEX.256.66.0F38.W1 8B /r A VIV AVX512VL | Compress packed quadword integer values from 
VPCOMPRESSQ ymm1/m256 {k1}{z}, ymm2 AVX512F ymme2 to ymm1/m256 using controlmask k1. 
EVEX.512.66.0F38.W1 8B /r A VV AVX512F Compress packed quadword integer values from 
VPCOMPRESSQ zmm1/m512 {k1}{z}, zmm2 zmm_2 to zmm1/m512 using controlmask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Compress (stores) up to 8/4/2 quadword integer values from the source operand (second operand) to the destina- 
tion operand (first operand). The source operand is a ZMM/YMM/XMM register, the destination operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. 

The opmask register ki selects the active elements (partial vector or possibly non-contiguous if less than 8 active 
elements) from the source operand to compress into a contiguous vector. The contiguous vector is written to the 
destination starting from the low element of the destination operand. 

Memory destination version: Only the contiguous vector is written to the destination memory location. EVEX.z 
must be zero. 

Register destination version: If the vector length of the contiguous vector is less than that of the input vector in the 
source operand, the upper bits of the destination register are unmodified if EVEX.z is not set, otherwise the upper 
bits are zeroed. 

Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VPCOMPRESSQ (EVEX encoded versions) store form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
SIZE := 64 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no controlmask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+63:i] 
k:=k + SIZE 
Fl; 


ENFOR 
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INSTRUCTION SET REFERENCE, V-Z 


VPCOMPRESSQ (EVEX encoded versions) reg-reg form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
SIZE := 64 
k:=0 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no controlmask* 
THEN 
DEST[k+SIZE-1:k] := SRC[i+63:i] 
k:=k+SIZE 
Fl; 
ENDFOR 
IF *merging-masking* 
THEN *DEST[VL-1:k] remains unchanged* 
ELSE DEST[VL-1:k] := 0 
Fl 
DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCOMPRESSQ __m512i__mm512_mask_compress_epi64(__m512i s,___mmask8 c,___m512i a); 
VPCOMPRESSQ __m512i_mm512_maskz_compress_epi64(__mmask8 c, __m512i a); 
VPCOMPRESSQ void _mm512_mask_compressstoreu_epi64(void * a, __mmask8 c,_m512i s); 
VPCOMPRESSQ __m256i __mm256_mask_compress_epi64(__m256i s,___mmask8 c, __m256i a); 
VPCOMPRESSQ __m256i __mm256_maskz_compress_epi64(__mmask8 c, __m256i a); 
VPCOMPRESSQ void _mm256_mask_compressstoreu_epi64(void * a, __mmask8 c, ___m256i s); 
VPCOMPRESSQ __m128i __mm_mask_compress_epi64(__m128i s,___mmask8 c, __m128i a); 
VPCOMPRESSQ __m128i __mm_maskz_compress_epi64(__mmask8 c, __m128i a); 
VPCOMPRESSQ void _mm_mask_compressstoreu_epi64(void * a,___ mmask8 c, __m128i s); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 


5-340 Vol. 2C VPCOMPRESSQ—Store Sparse Packed Quadword Integer Values into Dense Memory/Register 


INSTRUCTION SET REFERENCE, V-Z 


VPCONFLICTD/Q—Detect Conflicts Within a Vector of Packed Dword/Qword Values into Dense 
Memory/ Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.WO C4 /r A VIV AVX512VL Detect duplicate double-word values in 
VPCONFLICTD xmm1 {k1}{z}, AVX512CD xmm2/m128/m32bcst using writemask k1. 
xmm2/m128/m32bcst 
EVEX.256.66.0F38.WO C4 /r A VIV AVX512VL Detect duplicate double-word values in 
VPCONFLICTD ymm1 {k1}{Z}, AVX512CD ymm2/m256/m32bcst using writemask k1. 
ymm2/m256/m32bcst 
EVEX.512.66.0F38.W0O C4 /r A VIV AVX512CD Detect duplicate double-word values in 
VPCONFLICTD zmm1 {k1}{Z}, zmm2/m512/m32bcst using writemask k1. 
zmm2/m512/m32bcst 
EVEX.128.66.0F38.W1 C4 /r A VIV AVX512VL Detect duplicate quad-word values in 
VPCONFLICTQ xmm1 {k1}{2}, AVX512CD xmm2/m128/m64bcst using writemask k1. 
xmm2/m128/m64bcst 
EVEX.256.66.0F38.W1 C4 /r A VIV AVX512VL Detect duplicate quad-word values in 
VPCONFLICTQ ymm1 {k1}{Z}, AVX512CD ymm2/m256/m64bcst using writemask k1. 
ymm2/m256/m64bcst 
EVEX.512.66.0F38.W1 C4 /r A VIV AVX512CD Detect duplicate quad-word values in 
VPCONFLICTQ zmm1 {k1}{Z}, zmm2/m512/m64bcst using writemask k1. 
zmm2/m512/m64bcst 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Test each dword/qword element of the source operand (the second operand) for equality with all other elements in 
the source operand closer to the least significant element. Each element’s comparison results form a bit vector, 
which is then zero extended and written to the destination according to the writemask. 


EVEX.512 encoded version: The source operand is a ZMM register, a 512-bit memory location, or a 512-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a ZMM register, conditionally updated 
using writemask k1. 


EVEX.256 encoded version: The source operand is a YMM register, a 256-bit memory location, or a 256-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a YMM register, conditionally updated 
using writemask k1. 


EVEX.128 encoded version: The source operand is a XMM register, a 128-bit memory location, or a 128-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a XMM register, conditionally updated 
using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPCONFLICTD 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j*32 
IF MaskBit(j) OR *no writemask*THEN 
FOR k := 0 TOj-1 
m := k*32 
IF ((SRC[i+31:i] = SRC[m+31:m])) THEN 
DEST[i+k] := 1 
ELSE 
DEST[i+k] := 0 
Fl 
ENDFOR 
DEST[i+31:i+j] := 0 
ELSE 
IF *merging-masking* THEN 
*DEST[i+31:i] remains unchanged* 
ELSE 
DEST[i+31:i] := 0 
Fl 
Fl 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPCONFLICTQ 
(KL, VU) = (2, 128), (4, 256), (8, 512) 
FOR j= OTOKL-1 


i:= j*64 
IF MaskBit(j) OR *no writemask*THEN 
FOR k:= 0 TOj-1 
m := k*64 
IF ((SRC[i+63:i] = SRC[m+63:m])) THEN 
DEST[i+k] := 1 
ELSE 
DEST[i+k] := 0 
Fl 
ENDFOR 
DEST[i+63:i+j] := 0 
ELSE 


IF *merging-masking* THEN 
*DEST[i+63:i] remains unchanged* 
ELSE 
DEST[i+63:i] = 0 
Fl 
Fl 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


5-342 Vol. 2C VPCONFLICTD/Q—Detect Conflicts Within a Vector of Packed Dword/Qword Values into Dense Memory/ Register 


Intel C/C++ Compiler Intrinsic Equivalent 


VPCONFLICTD __m512i_mm512_conflict_epi32(__m512i a); 

VPCONFLICTD __m512i_mm512_mask_conflict_epi32(__m512is,__mmask16 m, 
VPCONFLICTD __m512i_mm512_maskz_conflict_epi32(__mmask16 m, ___m512i a); 
VPCONFLICTQ __m512i_mm512_conflict_epi64(__m512i a); 

VPCONFLICTQ __m512i_mm512_mask_conflict_epi64(__m512i s,__mmask8 m, __m512i a); 
VPCONFLICTQ __m512i_mm512_maskz_conflict_epi64(__mmask8 m, __m512i a); 
VPCONFLICTD __m256i_mm256_conflict_epi32(__m256i a); 

VPCONFLICTD __m256i_mm256_mask_conflict_epi32(__m256i s,__ mmask8 m, __m256i a); 
VPCONFLICTD __m256i_mm256_maskz_conflict_epi32(__mmask8 m, ___m256i a); 
VPCONFLICTQ __m256i__mm256_conflict_epi64(__m256i a); 

VPCONFLICTQ __m256i__mm256_mask_conflict_epi64(__m256i s,__ mmask8 m, __m256i a); 
VPCONFLICTQ __m256i __mm256_maskz_conflict_epi64(__mmask8 m, __m256i a); 
VPCONFLICTD __m128i_mm_conflict_epi32(__m128i a); 


m512i a); 


VPCONFLICTD __m128i__mm_mask_conflict_epi32(__m128i s,__ mmask8 m, __m128i a); 
VPCONFLICTD __m128i_mm_maskz_conflict_epi32(__mmask8 m, __m128i a); 
VPCONFLICTQ __m128i_mm_conflict_epi64(_m128i a); 

VPCONFLICTQ __m128i __mm_mask_conflict_epi64(__m128i s,___ mmask8 m, __m128i a); 


VPCONFLICTQ __m128i__mm_maskz_conflict_epi64(__mmask8 m, __m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 


VPCONFLICTD/Q—Detect Conflicts Within a Vector of Packed Dword/Qword Values into Dense Memory/ Register 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-343 


INSTRUCTION SET REFERENCE, V-Z 


VPDPBUSD — Multiply and Add Unsigned and Signed Bytes 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En | bitMode | Flag 

Support 
EVEX.128.66.0F38.W0 50 /r A VIV AVX512_VNNI Multiply groups of 4 pairs of signed bytes in 
VPDPBUSD xmm1{k1}{z}, xmm2, AVX512VL xmm3/m128/m32bcst with corresponding 
xmm3/m1 28/m32bcst unsigned bytes of xmm2, summing those products 


and adding them to doubleword result in xmm1 
under writemask k1. 


EVEX.256.66.0F38.W0 50 /r A VIV AVX512_VNNI Multiply groups of 4 pairs of signed bytes in 
VPDPBUSD ymm1{k1}{z}, ymm2, AVX512VL ymm3/m256/m32bcst with corresponding 
ymm3/m256/m32bcst unsigned bytes of ymm2, summing those products 


and adding them to doubleword result in ymm1 
under writemask k1. 


EVEX.512.66.0F38.W0 50 /r A VIV AVX512_VNNI Multiply groups of 4 pairs of signed bytes in 
VPDPBUSD zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst with corresponding 
zmm3/m512/m32bcst unsigned bytes of zmm2, summing those products 


and adding them to doubleword result in zmm1 
under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the individual unsigned bytes of the first source operand by the corresponding signed bytes of the second 
source operand, producing intermediate signed word results. The word results are then summed and accumulated 
in the destination dword element size operand. 


This instruction supports memory fault suppression. 


Operation 


VPDPBUSD dest, src1, src2 
(KL,VL)=(4,1 28), (8,256), (16,51 2) 
ORIGDEST := DEST 
FOR i := 0 TO KL-1: 
IF k1[i] or *no writemask*: 
// Byte elements of SRC1 are zero-extended to 16b and 
// byte elements of SRC2 are sign extended to 16b before multiplication. 
IF SRC2 is memory and EVEX.b == 1: 
t:= SRC2.dword[0] 
ELSE: 
t:= SRC2.dword{i] 
p1word := ZERO_EXTEND(SRC1.byte[4*i]) * SIGN_EXTEND(t.byte[0]) 
p2word := ZERO_EXTEND(SRC1 .byte[4*i+1]) * SIGN_EXTEND(t.byte[1 J) 
p3word := ZERO_EXTEND(SRC1.byte[4*i+2]) * SIGN_EXTEND(t.byte[2]) 
p4word := ZERO_EXTEND(SRC1.byte[4*i+3]) * SIGN_EXTEND(t.byte[3]) 
DEST.dword[i] := ORIGDEST.dword[i] + p1 word + p2word + p3word + p4word 
ELSE IF *zeroing*: 
DEST.dword[i] := 0 
ELSE:  // Merge masking, dest element unchanged 
DEST.dword[i] := ORIGDEST.dword[i] 
DEST[MAX_VL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPDPBUSD __m128i__mm_dpbusd_epi32(__m128i,___m128i,___m128i); 
VPDPBUSD __m128i __mm_mask_dpbusd_epi32(__m128i, __mmask8, 
VPDPBUSD __m128i__mm_maskz_dpbusd_epi32(__mmask8, __m128i, 


VPDPBUSD __m256i __mm256_dpbusd_epi32(__m256i, __m256i, 


VPDPBUSD __m256i __mm256_mask_dpbusd_epi32(__m256i, 


m256i, __m256i); 


VPDPBUSD __m256i__mm256_maskz_dpbusd_epi32(__mmask8, 
VPDPBUSD __m512i_mm512_dpbusd_epi32(__m512i,___m512i, 


VPDPBUSD __m512i_mm512_mask_dpbusd_epi32(__m512i, 


VPDPBUSD __m512i__mm512_maskz_dpbusd_epi32(__mmask16, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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VPDPBUSDS — Multiply and Add Unsigned and Signed Bytes with Saturation 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 

Support 
EVEX.128.66.0F38.W0 51 /r A VIV AVX512_VNNI Multiply groups of 4 pairs signed bytes in 
VPDPBUSDS xmm1{k1}{z}, xmm2, AVX512VL xmm3/m1 28/m32bcst with corresponding 
xmm3/m1 28/m32bcst unsigned bytes of xmm2, summing those 


products and adding them to doubleword 
result, with signed saturation in xmm1, under 
writemask k1. 


EVEX.256.66.0F38.W0 51 /r A VIV AVX512_VNNI Multiply groups of 4 pairs signed bytes in 
VPDPBUSDS ymm1{k1}{z}, ymm2, AVX512VL ymm3/m256/m32bcst with corresponding 
ymm3/m256/m32bcst unsigned bytes of ymm2, summing those 


products and adding them to doubleword 
result, with signed saturation in ymm1, under 
writemask k1. 


EVEX.512.66.0F38.W0 51 /r A VIV AVX512_VNNI Multiply groups of 4 pairs signed bytes in 
VPDPBUSDS zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst with corresponding 
zmm3/m512/m32bcst unsigned bytes of zmm2, summing those 


products and adding them to doubleword 
result, with signed saturation in zmm1, under 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the individual unsigned bytes of the first source operand by the corresponding signed bytes of the second 
source operand, producing intermediate signed word results. The word results are then summed and accumulated 
in the destination dword element size operand. If the intermediate sum overflows a 32b signed number the result 
is saturated to either Ox7FFF_FFFF for positive numbers of 0x8000_0000 for negative numbers. 


This instruction supports memory fault suppression. 


Operation 


VPDPBUSDS dest, src1, src2 
(KL,VL)=(4,1 28), (8,256), (16,512) 
ORIGDEST := DEST 
FOR i :=0 TO KL-1: 
IF k1[i] or *no writemask*: 
// Byte elements of SRC1 are zero-extended to 16b and 
// byte elements of SRC2 are sign extended to 16b before multiplication. 
IF SRC2 is memory and EVEX.b == 1: 
t:= SRC2.dword[0] 
ELSE: 
t:= SRC2.dword{i] 
p1word := ZERO_EXTEND(SRC1.byte[4*i]) * SIGN_EXTEND(t.byte[0]) 
p2word := ZERO_EXTEND(SRC1 .byte[4*i+1]) * SIGN_EXTEND(t.byte[1 J) 
p3word := ZERO_EXTEND(SRC1.byte[4*i+2]) * SIGN_EXTEND(t.byte[2]) 
p4word := ZERO_EXTEND(SRC1.byte[4*i+3]) *SIGN_EXTEND(t.byte[3]) 
DEST.dword{i] := SIGNED_DWORD_SATURATE(ORIGDEST.dword{[i] + p1 word + p2word + p3word + p4word) 
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ELSE IF *zeroing*: 
DEST.dword[i] := 0 
ELSE:  // Merge masking, dest element unchanged 
DEST.dword[i] := ORIGDEST.dword{i] 
DEST[MAX_VL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPDPBUSDS __m128i_mm_dpbusds_epi32(__m128i,___m128i, __m128i); 
VPDPBUSDS __m128i_mm_mask_dpbusds_epi32(__m128i, __ mmask8, 
VPDPBUSDS __m128i__mm_maskz_dpbusds_epi32(__mmask8, __m128i, 


m128i, __m128i); 


VPDPBUSDS __m256i __mm256_dpbusds_epi32(__m256i, __m256i, 


VPDPBUSDS __m256i __mm256_mask_dpbusds_epi32(__m256i, 
VPDPBUSDS __m256i__mm256_maskz_dpbusds_epi32(__mmask8, 


VPDPBUSDS __m512i_mm512_dpbusds_epi32(__m512i,___m512i, 


mmask8, __m256i,___m256i); 


VPDPBUSDS __m512i_mm512_mask_dpbusds_epi32(__m512i, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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mmask16, 
VPDPBUSDS __m512i_mm512_maskz_dpbusds_epi32(__mmask16, 
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VPDPWSSD — Multiply and Add Signed Word Integers 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.W0 82 /r A VIV AVX512_VNNI Multiply groups of 2 pairs signed words in 
VPDPWSSD xmm1{k1}{z}, xmm2, AVX512VL xmm3/m1 28/m32bcst with corresponding 
xmm3/m1 28/m32bcst signed words of xmm2, summing those 
products and adding them to doubleword result 
in xmm1, under writemask k1. 
EVEX.256.66.0F38.W0 82 /r A VIV AVX512_VNNI Multiply groups of 2 pairs signed words in 
VPDPWSSD ymm1{k1}{z}, ymm2, AVX512VL ymm3/m256/m32bcst with corresponding 
ymm3/m256/m32bcst signed words of ymm2, summing those 
products and adding them to doubleword result 
in ymm1, under writemask k1. 
EVEX.512.66.0F38.W0 82 /r A VIV AVX512_VNNI Multiply groups of 2 pairs signed words in 
VPDPWSSD zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst with corresponding 
zmm3/m512/m32bcst signed words of zmm2, summing those 
products and adding them to doubleword result 
in zmm1, under writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Multiplies the individual signed words of the first source operand by the corresponding signed words of the second 
source operand, producing intermediate signed, doubleword results. The adjacent doubleword results are then 


summed and accumulated in the destination operand. 
This instruction supports memory fault suppression. 


Operation 


VPDPWSSD dest, src1, src2 
(KL,VL)=(4,1 28), (8,256), (16,51 2) 
ORIGDEST := DEST 
FOR i :=0 TO KL-1: 

IF k1[i] or *no writemask*: 


IF SRC2 is memory and EVEX.b == 1: 


t:= SRC2.dword[0] 
ELSE: 
t:= SRC2.dword{i] 


p1dword := SIGN_EXTEND(SRC1.word[2*i]) * SIGN_EXTEND(t.word[0]) 


p2dword := SIGN_EXTEND(SRC1.word[2*i+1]) * SIGN_EXTEND(t.word[1]) 


DEST.dword[i] := ORIGDEST.dword[i] + p1dword + p2dword 


ELSE IF *zeroing*: 
DEST.dword[i] := 0 


ELSE: // Merge masking, dest element unchanged 
DEST.dword[i] := ORIGDEST.dword[i] 


DEST[MAX_VL-1:VL] := 0 
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VPDPWSSD — Multiply and Add Signed Word Integers 


Intel C/C++ Compiler Intrinsic Equivalent 
VPDPWSSD __m128i__mm_dpwssd_epi32(__m128i, __m128i, 


VPDPWSSD __m128i__mm_mask_dpwssd_epi32(__m128i, _ mmask8, ___m128i, __m128i); 
VPDPWSSD __m128i__mm_maskz_dpwssd_epi32(__mmask8, __m128i, 


VPDPWSSD __m256i__mm256_dpwssd_epi32(__m256i,__m256i, 
mmask8,___m256i,__ m256i); 


VPDPWSSD __m256i__mm256_mask_dpwssd_epi32(__m256i, 


VPDPWSSD __m256i __mm256_maskz_dpwssd_epi32(__mmask8, 
VPDPWSSD __m512i_mm512_dpwssd_epi32(__m512i,__m512i, 


VPDPWSSD __m512i_mm512_mask_dpwssd_epi32(__m512i, 


m512i,___m512i); 


VPDPWSSD __m512i_mm512_maskz_dpwssd_epi32(__mmask16, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 


VPDPWSSD — Multiply and Add Signed Word Integers 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-349 


INSTRUCTION SET REFERENCE, V-Z 


VPDPWSSDS — Multiply and Add Signed Word Integers with Saturation 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 

EVEX.128.66.0F38.W0 53 /r A VIV AVX512_VNNI Multiply groups of 2 pairs of signed words in 

VPDPWSSDS xmm1{k1}{z}, xmm2, AVX512VL xmm3/m1 28/m32bcst with corresponding 

xmm3/m1 28/m32bcst signed words of xmm2, summing those 
products and adding them to doubleword result 
in xmm1, with signed saturation, under 
writemask k1. 

EVEX.256.66.0F38.W0 53 /r A VIV AVX512_VNNI Multiply groups of 2 pairs of signed words in 

VPDPWSSDS ymm1{k1}{z}, ymm2, AVX512VL ymm3/m256/m32bcst with corresponding 

ymm3/m256/m32bcst signed words of ymm2, summing those 
products and adding them to doubleword result 
in ymm1, with signed saturation, under 
writemask k1. 

EVEX.512.66.0F38.W0 53 /r A VN AVX512_VNNI Multiply groups of 2 pairs of signed words in 

VPDPWSSDS zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst with corresponding 

zmm3/m512/m32bcst signed words of zmm2, summing those 
products and adding them to doubleword result 
in zmm1, with signed saturation, under 
writemask k1. 

Instruction Operand Encoding 
Op/En | Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 


Description 


Multiplies the individual signed words of the first source operand by the corresponding signed words of the second 
source operand, producing intermediate signed, doubleword results. The adjacent doubleword results are then 
summed and accumulated in the destination operand. If the intermediate sum overflows a 32b signed number, the 
result is saturated to either Ox7FFF_FFFF for positive numbers of 0x8000_0000 for negative numbers. 


This instruction supports memory fault suppression. 


Operation 


VPDPWSSDS dest, src1, src2 
(KL,VL)=(4,1 28), (8,256), (16,51 2) 
ORIGDEST := DEST 
FOR i :=0 TO KL-1: 
IF k1[i] or *no writemask*: 
IF SRC2 is memory and EVEX.b == 1: 
t:= SRC2.dword[0] 
ELSE: 
t:= SRC2.dword{i] 


p1dword := SIGN_EXTEND(SRC1.word[2*i]) * SIGN_EXTEND(t.word[0}) 


p2dword := SIGN_EXTEND(SRC1.word[2*i+ 1]) * SIGN_EXTEND(t.word[1 J) 


DEST.dword{[i] := SIGNED_DWORD_SATURATE(ORIGDEST.dword[i] + p1dword + p2dword) 


ELSE IF *zeroing*: 
DEST.dword[i] := 0 
ELSE: 
DEST.dword[i] := ORIGDEST.dword[i] 
DEST[MAX_VL-1:VL] := 0 
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// Merge masking, dest element unchanged 


VPDPWSSDS — Multiply and Add Signed Word Integers with Saturation 


Intel C/C++ Compiler Intrinsic Equivalent 
VPDPWSSDS __m128i __mm_dpwssds_epi32(__m128i, __m128i, 


VPDPWSSDS __m128i _mm_mask_dpwssd_epi32(__m128i,___mmask8, 


VPDPWSSDS __m128i _mm_maskz_dpwssd_epi32(__mmask8, 


VPDPWSSDS __m256i __mm256_dpwssd_epi32(__m256i, __m256i, 
mmask8, _m256i,___ m256i); 


VPDPWSSDS __m256i _mm256_mask_dpwssd_epi32(__m256i, 


VPDPWSSDS __m256i _mm256_maskz_dpwssd_epi32(__mmask8, 
VPDPWSSDS __m512i_mm512_dpwssd_epi32(__m512i,__m512i, 


VPDPWSSDS __m512i_mm512_mask_dpwssd_epi32(__m512i, 


m512i,___m512i); 


VPDPWSSDS __m512i_mm512_maskz_dpwssd_epi32(__mmask16, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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VPERM2F 128 — Permute Floating-Point Values 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 
Support | Flag 
VEX.256.66.0F3A.WO 06 /r ib RVMI | V/V AVX Permute 128-bit floating-point fields in ymm2 
VPERM2F128 ymm17, ymm2, ymm3/m256, imm8 and ymm3/mem using controls from imm8 and 
store result in ymm17. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


Permute 128 bit floating-point-containing fields from the first source operand (second operand) and second source 
operand (third operand) using bits in the 8-bit immediate and store results in the destination operand (first 
operand). The first source operand is a YMM register, the second source operand is a YMM register or a 256-bit 
memory location, and the destination operand is a YMM register. 


SRC2 Y1 Yo 
a 
DEST XO, X1, YO, or Y1 XO, X1, YO, or Y1 


Figure 5-21. VPERM2F128 Operation 
Imm8[1:0] select the source for the first destination 128-bit field, imm8[5:4] select the source for the second 


destination field. If imm8[3] is set, the low 128-bit field is zeroed. If imm8[7] is set, the high 128-bit field is zeroed. 
VEX.L must be 1, otherwise the instruction will #UD. 
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Operation 


VPERM2F128 
CASE IMM8[1:0] of 

0: DEST[127:0] := SRC1[127:0] 

1: DEST[127:0] := SRC1[255:128] 
2: DEST[127:0] = SRC2[127:0] 

3: DEST[127:0] = SRC2[255:128] 
ESAC 


CASE IMM8[5:4] of 

0: DEST[255:128] = SRC1[127:0] 

1: DEST[255:1 28] := SRC1[255:128] 
2: DEST[255:128] = SRC2[127:0] 

3; DEST[255:128] := SRC2[255:128] 
ESAC 

IF (imm8[3]) 

DEST[127:0] := 0 

FI 


IF (imm8[7]) 
DEST[MAXVL-1:128] := 0 
FI 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERM2F128: m256 __mm256_permute2f128_ps (__m256 a,__m256 b, int control) 
VPERM2F128: m256d _mm256_permute2f128_pd (__m256d a, _m256d b, int control) 
VPERM2F128: m256i__mm256_permute2f128_si256 (__m256i a,___m256i b, int control) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-23, “Type 6 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0 

If VEX.W = 1. 
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VPERM21128 — Permute Integer Values 


Opcode/ Op/ 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode _ | Flag 
VEX.256.66.0F3A.WO 46 /r ib RVMI | V/V AVX2 Permute 128-bit integer data in ymm2 and 
VPERM21128 ymm1, ymm2, ymm3/m256, imm8& ymm3/mem using controls from imm8 and 
store result in ymm/7. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) Imm8 
Description 


Permute 128 bit integer data from the first source operand (second operand) and second source operand (third 
operand) using bits in the 8-bit immediate and store results in the destination operand (first operand). The first 
source operand is a YMM register, the second source operand is a YMM register or a 256-bit memory location, and 
the destination operand is a YMM register. 


SRC2 Y1 YO 
DEST X0, X1, YO, or Y1 XO, X1, YO, or Y1 


Figure 5-22. VPERM2I128 Operation 
Imm8[1:0] select the source for the first destination 128-bit field, imm8[5:4] select the source for the second 


destination field. If imm8[3] is set, the low 128-bit field is zeroed. If imm8[7] is set, the high 128-bit field is zeroed. 
VEX.L must be 1, otherwise the instruction will #UD. 
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Operation 


VPERM21128 
CASE IMM8[1:0] of 

0: DEST[127:0] = SRC1[127:0] 

1: DEST[127:0] := SRC1[255:128] 

2: DEST[127:0] = SRC2[127:0] 

3: DEST[127:0] = SRC2[255:128] 
ESAC 

CASE IMM8[5:4] of 

0: DEST[255:128] = SRC1[127:0] 

1: DEST[255:1 28] := SRC1[255:128] 
2: DEST[255:128] = SRC2[127:0] 

3; DEST[255:128] = SRC2[255:128] 
ESAC 

IF (imm8[3]) 

DEST[127:0] := 0 

Fl 


IF (imm8[7]) 
DEST[255:128] := 0 
Fl 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERM21128:__m256i__mm256_permute2x128_si256 (__m256i a,__ m256i b, int control) 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-23, “Type 6 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0, 

If VEX.W = 1. 
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VPERMB—Permute Packed Bytes Elements 


Opcode/ Op/ | 64/32 CPUIDFeature | Description 
Instruction En | bitMode | Flag 
Support 
EVEX.128.66.0F38.W0 8D /r A VV AVX512VL Permute bytes in xmm3/m1 28 using byte indexes in 
VPERMB xmm1 {k1}{z}, xmm2, AVX512_VBMI | xmm2 and store the result in xmm1 using writemask 
xmm3/m128 k1, 
EVEX.256.66.0F38.W0 8D /r A VIV AVX512VL Permute bytes in ymm3/m256 using byte indexes in 
VPERMB ymm1 {k1}{z}, ymm2, AVX512_VBMI | ymm2 and store the result in ymm1 using writemask 
ymm3/m256 k1. 
EVEX.512.66.0F38.W0 8D /r A VV AVX512_VBMI | Permute bytes in zmm3/m512 using byte indexes in 
VPERMB zmm1 {k1}{z}, zmm2, zmmcz and store the result in zmm1 using writemask 
zmm3/m512 k1, 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Copies bytes from the second source operand (the third operand) to the destination operand (the first operand) 
according to the byte indices in the first source operand (the second operand). Note that this instruction permits a 
byte in the source operand to be copied to more than one location in the destination operand. 


Only the low 6(EVEX.512)/5(EVEX.256)/4(EVEX.128) bits of each byte index is used to select the location of the 
source byte from the second source operand. 


The first source operand is a ZMM/YMM/XMM register. The second source operand can be a ZMM/YMM/XMM reg- 
ister, a 512/256/128-bit memory location. The destination operand is a ZMM/YMM/XMM register updated at byte 
granularity by the writemask k1. 


Operation 


VPERMB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 


IF VL = 128: 
n:= 3; 

ELSE IF VL = 256: 
ni=4; 

ELSE IF VL = 512: 
n:=5; 

Fl; 

FOR j := 0 TO KL-1: 


id = SRC1[j*8 + n: j*8]; // location of the source byte 
IF k1[j] OR *no writemask* THEN 

DEST[j*8 + 7: j*8] = SRC2[id*8 +7: id*8]; 
ELSE IF zeroing-masking THEN 


DESTI[j*8 + 7: j*8] := 0; 
*ELSE 


DESTI[j*8 + 7: j*8] remains unchanged* 


Fl 
ENDFOR 
DEST[MAX_VL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMB __m512i_mm512_permutexvar_epi8(__m512i idx, 
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m512i a); 


\VPERMB—Permute Packed Bytes Elements 


VPERMB 


m512i 
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mm512_mask_permutexvar_epi8(__m512is,__ mmask64 k,___m512i idx, __m512i a); 


VPERMB 


m512i 


mm512_maskz_permutexvar_epi8(__mmask64 k,__m512i idx, ___m512i a); 


VPERMB 


m256i 


mm256_permutexvar_epi8(__m256i idx, __m256i a); 


VPERMB 


m256i 


mm256_mask_permutexvar_epi8(__m256i s,__ mmask32 k,___ m256i idx, __m256i a); 


VPERMB 


m256i 


mm256_maskz_permutexvar_epi8(__mmask32 k,___ m256i idx, __ m256i a); 


VPERMB __. 


VPERMB __m128i __mm_mask_permutexvar_epi8(__m128i s, 


m128i _1 


mm_permutexvar_epi8(__m128i idx, __m128i a); 


mmask16 k,__m128i idx, __m128i a); 


VPERMB __m128i __mm_maskz_permutexvar_epi8(__mmask16 k, 


m128i idx, __m128i a); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 


VPERMB—Permute Packed Bytes Elements Vol. 2C 5-357 


INSTRUCTION SET REFERENCE, V-Z 


VPERMD/VPERMW—Permute Packed Doublewords/Words Elements 


Opcode/ Op/ 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
VEX.256.66.0F38.W0 36 /r A VIV AVX2 Permute doublewords in ymm3/m256 using indices in 
VPERMD ymm1, ymm2, ymm3/m256 ymm_2 and store the result in ymm1. 
EVEX.256.66.0F38.W0 36 /r B VIN AVX512VL_ | Permute doublewords in ymm3/m256/m32bcst using 
VPERMD ymm1 {k1}{z}, ymm2, AVX512F indexes in ymme2 and store the result in ymm1 using 
ymm3/m256/m32bcst writemask k1. 
EVEX.512.66.0F38.W0 36 /r B VV AVX512F Permute doublewords in zmm3/m512/m32bcst using 
VPERMD zmm1 {k1}{z}, zmm2, indices in zmm2 and store the result in zmm1 using 
zmm3/m512/m32bcst writemask k1. 
EVEX.128.66.0F38.W1 8D /r C VIV AVX512VL_ | Permute word integers in xmm3/m128 using indexes 
VPERMW xmm1 {k1}{z}, xmm2, AVX512BW | inxmm2 and store the result in xmm1 using writemask 
xmm3/m128 k1, 
EVEX.256.66.0F38.W1 8D /r C VV AVX512VL_ | Permute word integers in ymm3/m256 using indexes 
VPERMW ymm1 {k1}{z}, ymm2, AVX512BW | inymm2 and store the result in ymm1 using writemask 
ymm3/m256 k1, 
EVEX.512.66.0F38.W1 8D /r C VV AVX512BW | Permute word integers in zmm3/m512 using indexes 
VPERMW zmm1 {k1}{z}, zmm2, in zmm2 and store the result in zmm1 using writemask 
zmm3/m512 k1, 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 

B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

C Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 

Description 


Copies doublewords (or words) from the second source operand (the third operand) to the destination operand (the 
first operand) according to the indices in the first source operand (the second operand). Note that this instruction 
permits a doubleword (word) in the source operand to be copied to more than one location in the destination 
operand. 


VEX.256 encoded VPERMD: The first and second operands are YMM registers, the third operand can be a YMM 
register or memory location. Bits (MAXVL-1:256) of the corresponding destination register are zeroed. 


EVEX encoded VPERMD: The first and second operands are ZMM/YMM registers, the third operand can be a 
ZMM/YMM register, a 512/256-bit memory location or a 512/256-bit vector broadcasted from a 32-bit memory 
location. The elements in the destination are updated using the writemask k1. 


VPERMW: first and second operands are ZMM/YMM/XMM registers, the third operand can be a ZMM/YMM/XMM 
register, or a 512/256/128-bit memory location. The destination is updated using the writemask k1. 


EVEX.128 encoded versions: Bits (MAXVL-1:128) of the corresponding ZMM register are zeroed. 
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Operation 


VPERMD (EVEX encoded versions) 
(KL, VL) = (8, 256), (16, 512) 
IF VL = 256 THEN n:= 2; Fl; 
IF VL = 512 THEN n:= 3; Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
id := 32*SRC1[i+n:i] 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] = SRC2[31:0]; 
ELSE DEST[i+31:i] := SRC2[id+31:id]; 


Fl; 
ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPERMD (VEX.256 encoded version) 

DEST[31:0] := (SRC2[255:0] >> (SRC1[2:0] * 32))[31:0]; 
DEST[63:32] := (SRC2[255:0] >> (SRC1[34:32] * 32))[31:0]; 
DEST[95:64] := (SRC2[255:0] >> (SRC1[66:64] * 32))[31:0]; 
DEST[127:96] := (SRC2[255:0] >> (SRC1[98:96] * 32))[31:0]; 
DEST[159:1 28] := (SRC2[255:0] >> (SRC1[130:128] * 32))[31:0]; 
DEST[191:160] := (SRC2[255:0] >> (SRC1[162:160] * 32))[31:0]; 
DEST[223:192] := (SRC2[255:0] >> (SRC1[194:192] * 32))[31:0]; 
DEST[255:224] := (SRC2[255:0] >> (SRC1[226:224] * 32))[31:0]; 
DEST[MAXVL-1:256] := 0 


~~ YS YH 


VPERMW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL = 128 THEN n:= 2; Fl; 
IF VL = 256 THEN n:= 3; Fl; 
IF VL = 512 THEN n:= 4; Fl; 
FOR j := 0 TO KL-1 

i:=j*16 

id := 16*SRC1[i+n:i] 

IF k1[j] OR *no writemask* 

THEN DEST[i+1 5:i] := SRC2[id+1 5:id] 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMD __m512i_mm512_permutexvar_epi32(__m512i idx, __m512i a); 

VPERMD __m512i_mm512_mask_permutexvar_epi32(__m512is,__mmask16 k,__m512i idx, __m512i a); 
VPERMD __m512i_mm512_maskz_permutexvar_epi32(__mmask16 k,__m512i idx, __m512i a); 
VPERMD __m256i__mm256_permutexvar_epi32(__m256i idx, __ m256i a); 

VPERMD __m256i__mm256_mask_permutexvar_epi32(__m256i s,__ mmask8 k, __m256i idx, __ m256i a); 
VPERMD __m256i_mm256_maskz_permutexvar_epi32(__mmask8 k, __m256i idx, __ m256i a); 

VPERMW __m512i_mm512_permutexvar_epi16(__m512i idx, __m512i a); 

VPERMW __m512i_mm512_mask_permutexvar_epi16(__m512i s,__ mmask32 k,__m512i idx, ___m512i a); 
VPERMW __m512i_mm512_maskz_permutexvar_epi16(__mmask32 k,__m512i idx, ___m512i a); 
VPERMW __m256i__mm256_permutexvar_epi16(__m256i idx, __m256i a); 

VPERMW __m256i__mm256_mask_permutexvar_epi16(__m256i s,__ mmask16 k, __ m256i idx, __m256i a); 
VPERMW __m256i__mm256_maskz_permutexvar_epi16(__mmask16 k,__m256i idx, _ m256i a); 
VPERMW __m128i 


_mm_permutexvar_epi16(__m128i idx, __m128i a); 
VPERMW __m128i __mm_mask_permutexvar_epi16(__m128i s,___mmask8 k, 


VPERMW __m128i__mm_maskz_permutexvar_epi16(__mmask8 k, 


m1 28i idx, __m128i a); 
m128i idx, __m128i a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPERMD, see Table 2-50, “Type E4NF Class Exception Conditions”. 
EVEX-encoded VPERMW, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 


Additionall 
#UD 
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y: 


If VEX.L = 0. 
If EVEX.L’L = 0 for VPERMD. 
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INSTRUCTION SET REFERENCE, V-Z 


VPERMI2B—Full Permute of Bytes from Two Tables Overwriting the Index 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En | bitMode | Flag 

Support 
EVEX.128.66.0F38.W0O 75 /r A VIV AVX512VL Permute bytes in xmm3/m128 and xmm_2 using 
VPERMIZB xmm1 {k1}{z}, xmm2, AVX512_VBMI byte indexes in xmm1 and store the byte results 
xmm3/m128 in xmm1 using writemask k1. 
EVEX.256.66.0F38.W0 75 /r A VIV AVX512VL Permute bytes in ymm3/m256 and ymme2 using 
VPERMI2B ymm1 {k1}{z}, ymm2, AVX512_VBMI byte indexes in ymm1 and store the byte results 
ymm3/m256 in ymm1 using writemask k1. 
EVEX.512.66.0F38.W0 75 /r A VIV AVX512_VBMI Permute bytes in zmm3/m512 and zmme2 using 
VPERMI2ZB zmm1 {k1}{z}, zmm2, byte indexes in zmm1 and store the byte results 
zmm3/m512 in zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En | Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Permutes byte values in the second operand (the first source operand) and the third operand (the second source 
operand) using the byte indices in the first operand (the destination operand) to select byte elements from the 
second or third source operands. The selected byte elements are written to the destination at byte granularity 
under the writemask k1. 

The first and second operands are ZMM/YMM/XMM registers. The first operand contains input indices to select 
elements from the two input tables in the 2nd and 3rd operands. The first operand is also the destination of the 
result. The third operand can be a ZMM/YMM/XMM register, or a 512/256/128-bit memory location. In each index 
byte, the id bit for table selection is bit 6/5/4, and bits [5:0]/[4:0]/[3:0] selects element within each input table. 


Note that these instructions permit a byte value in the source operands to be copied to more than one location in 
the destination operand. Also, the same tables can be reused in subsequent iterations, but the index elements are 
overwritten. 


Bits (MAX_VL-1:256/128) of the destination are zeroed for VL=256,128. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPERMIZ2B (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
IF VL = 128: 
id := 3; 
ELSE IF VL = 256: 
id:=4; 
ELSE IF VL = 512: 
id:=5; 
Fl; 
TMP_DEST[VL-1:0] := DEST[VL-1:0]; 
FOR j :=0 TO KL-1 
off := 8*SRC1[j*8 + id: j*8] ; 
IF k1[j] OR *no writemask*: 
DEST[j*8 + 7: j*8] = TMP_DEST[j*8+id+1 ]? SRC2[off+ 7:off] : SRC1[off+7:off]; 
ELSE IF *zeroing-masking* 
DEST[j*8 + 7: j*8] := 0; 
*ELSE 
DEST[j*8 + 7: j*8] remains unchanged* 
Fl; 
ENDFOR 
DEST[MAX_VL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMI2B____m512i_mm512_permutex2var_epi8(__m512i a,__m512i idx, __m512i b); 
VPERMI2B __m512i_mm512_mask2_permutex2var_epi8(__m512i a,__m512i idx, __ mmask64 k,__m512i b); 


VPERMI2B __m512i_mm512_maskz_permutex2var_epi8(__mmask64 k,___m512i a,__m512i idx, __m512i b); 
VPERMI2B __m256i__mm256_permutex2var_epi8(__m256i a, __ m256i idx, __m256i b); 

VPERMI2B __m256i_mm256_mask2_permutex2var_epi8(__m256i a,__ m256i idx, __ mmask32 k, __m256i b); 
VPERMI2B __ m256i__mm256_maskz_permutex2var_epi8(__mmask32 k,__ m256i a,__ m256Gi idx, __ m256i b); 


VPERMI2B __m128i__mm_permutex2var_epi8(__m128i a, __m128i idx, __m128i b); 
VPERMI2B __m128i__mm_mask2_permutex2var_epi8(__m128i a,__m128i idx, __ mmask16 k, __m128i b); 
VPERMI2B __m128i __mm_maskz_permutex2var_epi8(__mmask16 k,___m128i a, __m128i idx, __m128i b); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPERMI2W/D/Q/PS/PD—Full Permute From Two Tables Overwriting the Index 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

EVEX.128.66.0F38.W1 75 /r A VV AVX512VL_ | Permute word integers from two tables in 

VPERMI2W xmm1 {k1}{z}, xmm2, AVX512BW | xmm3/m128 and xmm_z using indexes in xmm1 and 

xmm3/m128 store the result in xmm1 using writemask k1. 

EVEX.256.66.0F38.W1 75 /r A VV AVX512VL_ | Permute word integers from two tables in 

VPERMI2W ymm1 {k1}{z}, ymm2, AVX512BW | ymm3/m256 and ymm_2 using indexes in ymm1 and 

ymm3/m256 store the result in ymm1 using writemask k1. 

EVEX.512.66.0F38.W1 75 /r A VV AVX512BW | Permute word integers from two tables in 

VPERMI2W zmm1 {k1}{z}, zmm2, zmm3/m512 and zmm2 using indexes in zmm1 and 

zmm3/m512 store the result in zmm1 using writemask k1. 

EVEX.128.66.0F38.W0O 76 /r B VV AVX512VL_ | Permute double-words from two tables in 

VPERMI2ZD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m1 28/m32bcst and xmm2 using indexes in 

xmm3/m128/m32bcst xmm_1 and store the result in xmm1 using writemask 
k1. 

EVEX.256.66.0F38.W0 76 /r B VIV AVX512VL_ | Permute double-words from two tables in 

VPERMI2ZD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and ymmz using indexes in 

ymm3/m256/m32bcst ymm1 and store the result in ymm1 using writemask 
k1. 

EVEX.512.66.0F38.W0 76 /r B VIN AVX512F Permute double-words from two tables in 

VPERMI2ZD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and zmmz using indices in 

zmm3/m512/m32bcst zmm1 and store the result in zmm1 using writemask 
k1. 

EVEX.128.66.0F38.W1 76 /r B VIV AVX512VL_ | Permute quad-words from two tables in 

VPERMI2Q xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst and xmm_z using indexes in 

xmm3/m128/m64bcst xmm_1 and store the result in xmm1 using writemask 
k1. 

EVEX.256.66.0F38.W1 76 /r B VIV AVX512VL_ | Permute quad-words from two tables in 

VPERMI2Q ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst and ymmz using indexes in 

ymm3/m256/m64bcst ymm1 and store the result in ymm1 using writemask 
k1. 

EVEX.512.66.0F38.W1 76 /r B VIV AVX512F Permute quad-words from two tables in 

VPERMI2Q zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and zmm2 using indices in 

zmm3/m512/m64bcst zmm1 and store the result in zmm1 using writemask 
k1. 

EVEX.128.66.0F38.WO 77 /r B VIV AVX512VL_ | Permute single-precision FP values from two tables in 

VPERMI2PS xmm1 {k1}{z}, xmm2, AVX512F xmm3/m1 28/m32bcst and xmm2 using indexes in 

xmm3/m128/m32bcst xmm_1 and store the result in xmm1 using writemask 
k1. 

EVEX.256.66.0F38.W0O 77 /r B VV AVX512VL_ | Permute single-precision FP values from two tables in 

VPERMI2ZPS ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and ymmz using indexes in 

ymm3/m256/m32bcst ymm1 and store the result in ymm1 using writemask 
k1. 

EVEX.512.66.0F38.W0O 77 /r B VIV AVX512F Permute single-precision FP values from two tables in 

VPERMI2PS zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and zmmz using indices in 

zmm3/m512/m32bcst zmm1 and store the result in zmm1 using writemask 


k1. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W1 77 /r B VIV AVX512VL_ | Permute double-precision FP values from two tables in 
VPERMI2PD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst and xmmz using indexes in 
xmm3/m1 28/m64bcst xmm1 and store the result in xmm1 using writemask 
k1. 
EVEX.256.66.0F38.W1 77 /r B VIV AVX512VL_ | Permute double-precision FP values from two tables in 
VPERMI2PD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst and ymm2z using indexes in 
ymm3/m256/m64bcst ymm1 and store the result in ymm1 using writemask 
k1, 
EVEX.512.66.0F38.W1 77 /r B VIV AVX512F Permute double-precision FP values from two tables in 
VPERMI2PD zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and zmm_2 using indices in 
zmm3/m512/m64bcst zmm1 and store the result in zmm1 using writemask 
k1, 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r,w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Permutes 16-bit/32-bit/64-bit values in the second operand (the first source operand) and the third operand (the 
second source operand) using indices in the first operand to select elements from the second and third operands. 
The selected elements are written to the destination operand (the first operand) according to the writemask k1. 
The first and second operands are ZMM/YMM/XMM registers. The first operand contains input indices to select 
elements from the two input tables in the 2nd and 3rd operands. The first operand is also the destination of the 
result. 

D/Q/PS/PD element versions: The second source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. Broadcast from the 
low 32/64-bit memory location is performed if EVEX.b and the id bit for table selection are set (selecting table_2). 
Dword/PS versions: The id bit for table selection is bit 4/3/2, depending on VL=512, 256, 128. Bits 
[3:0]/[2:0]/[1:0] of each element in the input index vector select an element within the two source operands, If 
the id bit is 0, table_1 (the first source) is selected; otherwise the second source operand is selected. 

Qword/PD versions: The id bit for table selection is bit 3/2/1, and bits [2:0]/[1:0] /bit 0 selects element within each 
input table. 

Word element versions: The second source operand can be a ZMM/YMM/XMM register, or a 512/256/128-bit 
memory location. The id bit for table selection is bit 5/4/3, and bits [4:0]/[3:0]/[2:0] selects element within each 
input table. 

Note that these instructions permit a 16-bit/32-bit/64-bit value in the source operands to be copied to more than 
one location in the destination operand. Note also that in this case, the same table can be reused for example for a 
second iteration, while the index elements are overwritten. 


Bits (MAXVL-1:256/128) of the destination are zeroed for VL=256,128. 
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Operation 


VPERMI2W (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 
id:=2 
Fl; 
IF VL = 256 
id:=3 
Fl; 
IF VL= 512 
id :=4 
Fl; 
TMP_DEST := DEST 
FOR j := 0 TO KL-1 
i:=j*16 
off := 16*TMP_DEST[i+id:i] 
IF k1[j] OR *no writemask* 


THEN 
DEST[i+1 5:i]=TMP_DEST[i+id+ 1] ? SRC2[off+1 S:off] 
: SRC1[off+1 5:off] 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPERMI2D/VPERMI2PS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF VL= 128 
id:=1 
Fl; 
IF VL = 256 
id:=2 
Fl; 
IF VL= 512 
id:=3 
Fl; 
TMP_DEST := DEST 
FOR j := 0 TO KL-1 
i:=j* 32 
off := 32*TMP_DEST[i+id:i] 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+31:i] = TMP_DEST[i+id+1] ? SRC2[31:0] 
: SRC1[off+31:off] 
ELSE 
DEST[i+31:i] = TMP_DEST[i+id+1] ? SRC2[off+31:off] 
: SRC1[off+31:off] 
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Fl 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPERMI2Q/VPERMIZPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8 512) 
IF VL= 128 
id:=0 
Fl; 
IF VL = 256 
id:=1 
Fl; 
IF VL=512 
id:=2 
Fl; 
TMP_DEST:= DEST 
FOR j := 0 TO KL-1 
i:=j* 64 
off := 64*TMP_DEST[i+id:i] 
IF k1[j] OR *no writemask* 


THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+63:i] = TMP_DEST[i+id+1] ? SRC2[63:0] 
: SRC1[off+63:off] 
ELSE 
DEST[i+63:i] := TMP_DEST[i+id+1] ? SRC2[off+63:off] 
: SRC1[off+63:off] 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPERMI2D __m512i_mm512_permutex2var_epi32(__m512i a,__m512i idx,__m512i b); 

VPERMI2D __m512i_mm512_mask_permutex2var_epi32(__m512i a,__ mmask16 k,__m512i idx, __m512i b); 
VPERMI2D __m512i_mm512_mask2_permutex2var_epi32(__m512i a,__m512i idx, ___ mmask16 k,___m512i b); 
VPERMI2D __m512i_mm512_maskz_permutex2var_epi32(__mmask16 k,__m512ia,__m512i idx, __m512i b); 
VPERMI __m256i__mm256_permutex2var_epi32(__m256i a,__ m256i idx, __m256i b); 

VPERMI2D __m256i__mm256_mask_permutex2var_epi32(__m256i a,__ mmask8 k,__ m256i idx, __m256i b); 
VPERMI2D __ m256i_mm256_mask2_permutex2var_epi32(__m256i a, ___ m256i idx, __ mmask8 k, __m256i b); 
VPERMI2D __m256i__mm256_maskz_permutex2var_epi32(__mmask8 k,__ m256i a,___ mM256i idx, __m256i b); 


VPERMI2D __m128i_mm_permutex2var_epi32(__m128i a, ___m128i idx, __m128i b); 

VPERMI2D __m128i__mm_mask_permutex2var_epi32(__m128i a,__mmask8 k,___m128i idx, __m128i b); 
VPERMI2D __m128i__mm_mask2_permutex2var_epi32(__m128i a, __m128i idx, __ mmask8 k, __m128i b); 
VPERMI2D __m128i__mm_maskz_permutex2var_epi32(__mmask8 k,___m128i a,__m128i idx, __m128i b); 
VPERMI2PD __m512d_mm512_permutex2var_pd(__m512d a,__m512i idx,__m512d b); 

VPERMI2PD __m512d_mm512_mask_permutex2var_pd(__m512d a,__ mmask8 k,___m512i idx,__m512d b); 
VPERMI2PD __m512d_mm512_mask2_permutex2var_pd(__m512da,__m512i idx, ___mmask8 k,__m512d b); 
VPERMI2PD __m512d_mm512_maskz_permutex2var_pd(__mmask8 k,__m512d a,__m512i idx, __m512d b); 
VPERMI2PD __m256d_mm256_permutex2var_pd(__m256d a, ___ m256i idx, __ m256d b); 

VPERMI2PD __m256d __mm256_mask_permutex2var_pd(__m256d a, ___ mmask8 k, __ m256i idx, ___ m256d b); 
VPERMI2PD __m256d __mm256_mask2_permutex2var_pd(__m256d a, ___ m256i idx, __ mmask8 k, __ m256d b); 
VPERMI2PD __m256d __mm256_maskz_permutex2var_pd(__mmask8 k,___ m256d a, __m256i idx, __m256d b); 
VPERMI2PD __m128d_mm_permutex2var_pd(__m128d a, __m128i idx, __m128d b); 

VPERMI2PD __m128d _mm_mask_permutex2var_pd(__m128d a,__ mmask8 k,___m128i idx, __m128d b); 
VPERMI2PD __m128d_mm_mask2_permutex2var_pd(__m128d a, __m128i idx, __ mmask8 k,__m128d b); 
VPERMI2PD __m128d __mm_maskz_permutex2var_pd(__mmask8 k,___m128d a,__m128i idx, __m128d b); 
VPERMI2PS __m512_mm512_permutex2var_ps(__m512 a,__m512i idx,__m512 b); 

VPERMI2PS __m512_mm512_mask_permutex2var_ps(__m512 a,__mmask16 k,___m512i idx, __m512 b); 
VPERMI2PS __m512_mm512_mask2_permutex2var_ps(__m512 a,__m512i idx, __ mmask16 k,__m512 b); 
VPERMI2PS ___m512_mm512_maskz_permutex2var_ps(__mmask16 k,__m512 a,__m512i idx,__m512 b); 
VPERMI2PS ___m256 __mm256_permutex2var_ps(__m256 a, ___ m256i idx,___m256 b); 

VPERMI2PS __m256 _mm256_mask_permutex2var_ps(__m256 a,__ mmask8 k, __m256i idx, __ m256 b); 
VPERMI2PS __m256 __mm256_mask2_permutex2var_ps(__m256 a,__ m256i idx, _ mmask8 k,___m256 b); 
VPERMI2PS __m256 __mm256_maskz_permutex2var_ps(__mmask8 k,__m256 a,__ m256i idx, __m256 b); 


VPERMI2PS ___m128 __mm_permutex2var_ps(__m128 a, 
VPERMI2PS __m128 __mm_mask_permutex2var_ps(__m128 a,__ mmask8 k,___m128i idx, ___m128 b); 

VPERMI2PS __m128 _mm_mask2_permutex2var_ps(__m128 a,__m128i idx, _ mmask8 k,__m128 b); 
VPERMI2PS __m128 _mm_maskz_permutex2var_ps(__mmask8 k,__m128 a,__m128i idx, __m128 b); 
VPERMI2Q___m512i__mm512_permutex2var_epi64(__m512i a,__m512i idx, __m512i b); 


m1 28i idx, __m128 b); 


VPERMI2Q___m512i__mm512_mask_permutex2var_epi64(__m512i a, __mmask8 k, __m512i idx, __m512i b); 
VPERMI2Q___m512i _mm512_mask2_permutex2var_epi64(__m512i a, __m512i idx, __mmask8 k, __m512i b); 
VPERMI2Q___m512i__mm512_maskz_permutex2var_epi64(__mmask8 k, __m512i a,__m512i idx, __m512i b); 
VPERMI2Q_ __m256i _mm256_permutex2var_epi64(__m256i a, __m256i idx, __m256i b); 

VPERMI2Q __m256i _mm256_mask_permutex2var_epi64(__m256i a, __mmask8 k, __m256i idx, __m256i b); 
VPERMI2Q __m256i _mm256_mask2_permutex2var_epi64(__m256i a, __m256i idx, __mmask8 k, __m256i b); 
VPERMI2Q __m256i __mm256_maskz_permutex2var_epi64(__mmask8 k, __m256i a, __m256i idx, __m256i b); 
VPERMI2Q __m128i _mm_permutex2var_epi64(__m128i a, __m128i idx, __m128i b); 

VPERMI2Q __m128i _mm_mask_permutex2var_epi64(__m128i a, ___mmask8 k, __m128i idx, __m128i b); 
VPERMI2Q __m128i __mm_mask2_permutex2var_epi64(__m128i a, __m128i idx, __ mmask8 k, __m128i b); 


VPERMI2Q __m128i _mm_maskz_permutex2var_epi64(__mmask8 k, __m128i a, __m128i idx, __m128i b); 
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VPERMI2W __m512i 


mm512_permutex2var_epil16(__m512i a,___m512i idx, ___m512ib); 


VPERMI2W __m512i 


mm512_mask_permutex2var_epi16(__m512i a,__ mmask32 k,__m512i idx, ___m512ib); 


VPERMI2W __m512i 


mm512_mask2_permutex2var_epi16(__m512i a,__m512i idx, __ mmask32 k,___m512ib); 


VPERMI2W __m512i 


VPERMI2W __m256i 


mm512_maskz_permutex2var_epi16(__mmask32 k,__m512i a,__m512i idx, __m512i b); 
mm256_permutex2var_epi16(__m256i a,__ m256i idx, __ m256i b); 


VPERMI2W __m256i 


mm256_mask_permutex2var_epi16(__m256i a,__ mmask16 k,__ m256i idx, __ m256i b); 


VPERMI2W __m256i 


mm256_mask2_permutex2var_epi16(__m256i a,__ m256i idx,__ mmask16 k, __m256i b); 


VPERMI2W __m256i 


mm256_maskz_permutex2var_epi16(__mmask16 k,__ m256i a,__ m256i idx, __m256i b); 


VPERMI2W __m128i _| 


VPERMI2W __m128i 


mm_permutex2var_epi16(__m128i a, ___m128i idx, __m128i b); 
mm_mask_permutex2var_epi16(__m128i a, ___mmask8 k, __m128i idx, 


m128i b); 


VPERMI2W __m128i 


mm_mask2_permutex2var_epi16(__m128i a,__m128i idx, ___ mmask8 k, __m128i b); 


VPERMI2W __m128i 


mm_maskz_permutex2var_epi16(__mmask8 k, __m128i a,__m128i idx, __m128i b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


VPERMI2D/Q/PS/PD: See Table 2-50, “Type E4NF Class Exception Conditions”. 
VPERMI2W: See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPERMILPD—Permute In-Lane of Pairs of Double-Precision Floating-Point Values 


Description 


Permute double-precision floating-point values in 
xmmz using controls from xmm3/m1 28 and store 
result in xmm1. 


Permute double-precision floating-point values in 
ymmcz using controls from ymm3/m256 and store 
result in ymm1. 


Permute double-precision floating-point values in 
xmmz using control from xmm3/m128/m64bcst 
and store the result in xmm1 using writemask k1. 


Permute double-precision floating-point values in 
ymmcz using control from ymm3/m256/m64bcst 
and store the result in ymm1 using writemask k1. 


Permute double-precision floating-point values in 
zmm_z using control from zmm3/m512/m64bcst 
and store the result in zmm1 using writemask k1. 
Permute double-precision floating-point values in 
xmm2/m128 using controls from immés. 

Permute double-precision floating-point values in 
ymm2/m256 using controls from immés. 

Permute double-precision floating-point values in 
xmm2/m128/m64bcst using controls from imm8 
and store the result in xmm1 using writemask k1. 


Permute double-precision floating-point values in 
ymm2/m256/m64bcst using controls from imm8 
and store the result in ymm1 using writemask k1. 


Opcode/ Op/En | 64/32 CPUID 

Instruction bit Mode | Feature 
Support Flag 

VEX.128.66.0F38.WO OD /r A VIV AVX 

VPERMILPD xmm1, xmm2, xmm3/m128 

VEX.256.66.0F38.WO OD /r A VIV AVX 

VPERMILPD ymm1, ymm2, ymm3/m256 

EVEX.128.66.0F38.W1 OD /r C VIV AVX512VL 

VPERMILPD xmm1 {k1}{z}, xmm_2, AVX512F 

xmm3/m128/m64bcst 

EVEX.256.66.0F38.W1 OD /r C VIV AVX512VL 

VPERMILPD ymm1 {k1}{z}, ymm2, AVX512F 

ymm3/m256/m64bcst 

EVEX.512.66.0F38.W1 OD /r C VIV AVX512F 

VPERMILPD zmm1 {k1}{z}, zmm2, 

zmm3/m512/m64bcst 

VEX.128.66.0F3A.WO 05 /r ib B VIV AVX 

VPERMILPD xmm1, xmm2/m1 28, imm8 

VEX.256.66.0F3A.WO 05 /r ib B VIV AVX 

VPERMILPD ymm1, ymm2/m256, imm8 

EVEX.128.66.0F3A.W1 05 /r ib D VIV AVX512VL 

VPERMILPD xmm1 {k1}{z}, AVX512F 

xmm2/m128/m64bcst, imm8 

EVEX.256.66.0F3A.W1 05 /r ib D VIV AVX512VL 

VPERMILPD ymm1 {k1}{z}, AVX512F 

ymm2/m256/m64bcst, imm8 

EVEX.512.66.0F3A.W1 05 /r ib D VIV AVX512F 

VPERMILPD zmm1 {k1}{Z}, 

zmm2/m512/m64bcst, imm8 


Permute double-precision floating-point values in 
zmm2/m512/m64bcst using controls from imm8 
and store the result in zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B NA ModRM:reg (w) ModRM:r/m (r) NA NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) ModRM:r/m (r) NA NA 
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INSTRUCTION SET REFERENCE, V-Z 


Description 
(variable control version) 


Permute pairs of double-precision floating-point values in the first source operand (second operand), each using a 
1-bit control field residing in the corresponding quadword element of the second source operand (third operand). 
Permuted results are stored in the destination operand (first operand). 


The control bits are located at bit 0 of each quadword element (see Figure 5-24). Each control determines which of 
the source element in an input pair is selected for the destination element. Each pair of source elements must lie in 
the same 128-bit region as the destination. 


EVEX version: The second source operand (third operand) is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 64-bit memory location. Permuted results are 
written to the destination under the writemask. 


SRC1 X3 X2 x1 x0 


DEST| X2..X3 X2..X3 X0..X1 X0..X1 


Figure 5-23. VPERMILPD Operation 


VEX.256 encoded version: Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 


Bit 
255 194 193 127 66 65 63 2 1 
3 3 
2 2 
ignored sel ef ee et 
Control Field 4 Control Field 2 Control Field1 


Figure 5-24. VPERMILPD Shuffle Control 


(immediate control version) 

Permute pairs of double-precision floating-point values in the first source operand (second operand), each pair 
using a 1-bit control field in the imm8 byte. Each element in the destination operand (first operand) use a separate 
control bit of the imm8 byte. 

VEX version: The source operand is a YMM/XMM register or a 256/128-bit memory location and the destination 
operand is a YMM/XMM register. Imm8 byte provides the lower 4/2 bit as permute control fields. 


EVEX version: The source operand (second operand) is a ZMM/YMM/XMM register, a 512/256/128-bit memory 
location or a 512/256/128-bit vector broadcasted from a 64-bit memory location. Permuted results are written to 
the destination under the writemask. Imm8 byte provides the lower 8/4/2 bit as permute control fields. 


Note: For the imm8 versions, VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will 
#UD. 
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Operation 


VPERMILPD (EVEX immediate versions) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN TMP_SRC1[i+63:i] = SRC1[63:0]; 
ELSE TMP_SRC1[i+63:i] := SRC1[i+63:i]; 
Fl; 
ENDFOR; 
IF (imm8[O] = 0 
IF (imm8[O] = 1 
IF (imm8[1] = 0 
IF (imm8[1] = 1 
IF VL >= 256 
IF (imm8[2] = 0 
IF (imm8[2] = 1 
IF (imm8[3] = 0 
IF (imm8[3] = 1 


THEN TMP_DEST[63:0] := SRC1[63:0]; Fl; 

THEN TMP_DEST[63:0] := TMP_SRC1[127:64]; FI; 
THEN TMP_DEST[127:64] := TMP_SRC1[63:0]; Fl; 
THEN TMP_DEST[127:64] := TMP_SRC1[1 27:64]; Fl; 


~~ Pro = 


THEN TMP_DEST[191:128] := TMP_SRC1[191:128]; Fl; 
THEN TMP_DEST[191:128] := TMP_SRC1[255:192]; Fl; 
THEN TMP_DEST[255:192] := TMP_SRC1[191:128]; Fl; 
THEN TMP_DEST[255:192] := TMP_SRC1[255:192]; Fl; 


~~ Fa ws a 


Fl; 
IFVL>=512 

IF (imm8[4] = 0 
IF (imm8[4] = 1 
IF (imm8[5] = 0 
IF (imm8[5] = 1 
IF (imm8[6] = 0 
IF ( 
IF ( 
IF ( 


THEN TMP_DEST[319:256] := TMP_SRC1[319:256]; Fl; 
THEN TMP_DEST[319:256] := TMP_SRC1[383:320]; Fl; 
THEN TMP_DEST[383:320] := TMP_SRC1[319:256]; Fl; 
THEN TMP_DEST[383:320] := TMP_SRC1[383:320]; Fl; 
THEN TMP_DEST[447:384] := TMP_SRC1[447:384]; Fl; 
THEN TMP_DEST[447:384] := TMP_SRC1[511:448]; Fl; 
THEN TMP_DEST[51 1:448] := TMP_SRC1[447:384]; Fl; 
THEN TMP_DEST[51 1:448] := TMP_SRC1[511:448]; Fl; 


imm8[6] = 1 
imm8[7] = 0 
imm8[7] = 1 


Ne 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMILPD (256-bit immediate version) 

IF (imm8[O] = 0) THEN DEST[63:0] := SRC1[63:0] 

IF (imm8[O] = 1) THEN DEST[63:0] := SRC1[127:64] 

IF (imm8[1] = 0) THEN DEST[1 27:64] := SRC1[63:0] 

IF (imm8[1] = 1) THEN DEST[1 27:64] := SRC1[127:64] 

IF (imm8[2] = 0) THEN DEST[191:128] := SRC1[191:128] 

IF (imm8[2] = 1) THEN DEST[191:128] := SRC1[255:192] 
) 
) 


Solin fin, Gi ilimins igi’ gis 


IF (imm8[3] = 0) THEN DEST[255:192] := SRC1[191:128] 
IF (imm8[3] = 1) THEN DEST[255:192] := SRC1[255:192] 
DEST[MAXVL-1:256] := 0 
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VPERMILPD (128-bit immediate version) 

IF (imm8[0] = 0) THEN DEST[63:0] := SRC1[63:0] 

IF (imm8[0] = 1) THEN DEST[63:0] := SRC1[127:64] 

IF (imm8[1] = 0) THEN DEST[127:64] := SRC1[63:0] 

IF (imm8[1] = 1) THEN DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


VPERMILPD (EVEX variable versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory”) 
THEN TMP_SRC2{[i+63:i] := SRC2[63:0]; 
ELSE TMP_SRC2[i+63:i] = SRC2[i+63:i]; 
Fl; 
ENDFOR; 


IF (TMP_SRC2[1] = 0) THEN TMP_DEST[63:0] := SRC1[63:0]; Fl; 

IF (TMP_SRC2[1] = 1) THEN TMP_DEST[63:0] := SRC1[127:64]; Fl; 

IF (TMP_SRC2[65] = 0) THEN TMP_DEST[127:64] := SRC1[63:0]; Fl; 

IF (TMP_SRC2[65] = 1) THEN TMP_DEST[127:64] := SRC1[127:64]; FI; 

IF VL >= 256 
IF (TMP_SRC2[129] = 0 
IF (TMP_SRC2[129] = 1 
IF (TMP_SRC2[193] = 0 
IF (TMP_SRC2[193] = 1 


THEN TMP_DEST[191:128] := SRC1[191:128]; Fl; 
THEN TMP_DEST[191:128] := SRC1[255:192]; Fl; 
THEN TMP_DEST[255:1 92] := SRC1[191:128]; Fl; 
THEN TMP_DEST[255:192] := SRC1[255:192]; Fl; 


YS Hw => 


Fl; 
IF VL >=512 
IF (TMP_SRC2[257] = 0 
IF (TMP_SRC2[257] = 1 
IF (TMP_SRC2[321] = 0 
IF (TMP_SRC2[321] = 1 
IF (TMP_SRC2[385] = 0 
IF ( 
IF ( 
IF ( 


THEN TMP_DEST[319:256] := SRC1[319:256]; Fl; 
THEN TMP_DEST[319:256] := SRC1[383:320]; Fl; 
THEN TMP_DEST[383:320] := SRC1[319:256]; Fl; 
THEN TMP_DEST[383:320] := SRC1[383:320]; Fl; 
THEN TMP_DEST[447:384] := SRC1[447:384]; Fl; 
THEN TMP_DEST[447:384] := SRC1[511:448]; Fl; 
THEN TMP_DEST[51 1:448] := SRC1[447:384]; Fl; 
THEN TMP_DEST[51 1:448] := SRC1[511:448]; Fl; 


TMP_SRC2[385] = 1 
TMP_SRC2[449] = 0 
TMP_SRC2[449] = 1 


YS Ds DS DS 


Fl; 


FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPERMILPD (256-bit variable version) 
IF (SRC2[1] = 0) THEN DEST[63:0] := SRC1[63:0] 


IF 
IF 
IF 
IF 
IF 
IF 


fan a, on igeamns. spmns poo 


SRC2[1] = 1) THEN DEST[63:0] := SRC1[127:64] 
SRC2[65] = 0) THEN DEST[127:64] := SRC1[63:0] 
SRC2[65] = 1) THEN DEST[127:64] = SRC1[127:64] 
SRC2[129] = 0) THEN DEST[191:128] := SRC1[191:128] 
SRC2[129] = 1) THEN DEST[191:128] := SRC1[255:192] 
SRC2[193] = 0) THEN DEST[255:192] := SRC1[191:128] 


IF (SRC2[193] = 1) THEN DEST[255:192] := SRC1[255:192] 
DEST[MAXVL-1:256] := 0 


VPERMILPD (128-bit variable version) 

IF (SRC2[1] = 0) THEN DEST[63:0] := SRC1[63:0] 

IF (SRC2[1] = 1) THEN DEST[63:0] := SRC1[127:64] 

IF (SRC2[65] = 0) THEN DEST[127:64] := SRC1[63:0] 

IF (SRC2[65] = 1) THEN DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 
VPERMILPD 


m512d 


mm512_permute_pd(__m512d a, int imm); 


m512d 


mm512_mask_permute_pd(__m512ds,__mmask8 k,__m512d a, int imm); 


m512d 


mm512_maskz_permute_pd(__mmask8 k, __m512d a, int imm); 


m256d 


mm256_mask_permute_pd(__m256d s,__ mmask8 k,___m256d a, int imm); 


m256d 


mm256_maskz_permute_pd(__mmask8 k, __m256d a, int imm); 
mmask8 k,___m128d a, int imm); 


mm_maskz_permute_pd(__mmask8 k, __m128d a, int imm); 


m512d a); 


m128d_mm_mask_permute_pd(__m128d s, 
m128d 
m512d_mm512_permutevar_pd(__m512ii, 
m512d 


mm512_mask_permutevar_pd(__m512ds,__mmask8 k,__m512ii,__m512d a); 


m512d 


mm512_maskz_permutevar_pd(__mmask8 k,___m512ii,__m512d a); 


m256d 


mm256_mask_permutevar_pd(__m256d s,__ mmask8 k,__ m256d i,__ m256d a); 


m256d 


m128d 


mm256_maskz_permutevar_pd(__mmask8 k,___ m256d i,__ m256d a); 
mm_mask_permutevar_pd(__m128ds,__mmask8 k,__m128di,__m128d a); 


m128d 


mm_maskz_permutevar_pd(__ mmask8 k,___m128di,___m128d a); 


m128d 


mm_permute_pd (__m128d a, int control) 


m256d 


mm256_permute_pd (__m256d a, int control) 


__mi128d 


_mm_permutevar_pd (__m128d a, 
VPERMILPD __m256d_mm256_permutevar_pd (__m256d a, 


m1 28i control); 
m256i control); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD 


If VEX.W = 1. 


EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”; additionally: 


#UD 


If either (E)VEX.vvvv != 1111B and with imm8. 
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VPERMILPS—Permute In-Lane of Quadruples of Single-Precision Floating-Point Values 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support | Flag 
VEX.128.66.0F38.W0O OC /r A VIV AVX Permute single-precision floating-point values in 
VPERMILPS xmm1, xmm2, xmm3/m128 xmmcz using controls from xmm3/m128 and 
store result in xmm1. 
VEX.128.66.0F3A.WO 04 /r ib B VIV AVX Permute single-precision floating-point values in 
VPERMILPS xmm1, xmm2/m1 28, imm8 xmm2/m1 28 using controls from imm8 and store 
result in xmm1. 
VEX.256.66.0F38.WO OC /r A VIV AVX Permute single-precision floating-point values in 
VPERMILPS ymm1, ymm2, ymm3/m256 ymmcz using controls from ymm3/m256 and 
store result in ymm1. 
VEX.256.66.0F3A.WO 04 /r ib B VIV AVX Permute single-precision floating-point values in 
VPERMILPS ymm1, ymm2/m256, imm8 ymm2/m256 using controls from imm8 and store 
result in ymm1. 
EVEX.128.66.0F38.WO OC /r C VIV AVX512VL | Permute single-precision floating-point values 
VPERMILPS xmm1 {k1}{z}, xmm2, AVX512F xmmz using control from xmm3/m128/m32bcst 
xmm3/m1 28/m32bcst and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W0O OC /r C VIV AVX512VL | Permute single-precision floating-point values 
VPERMILPS ymm1 {k1}{z}, ymm2, AVX512F ymmcz using control from ymm3/m256/m32bcst 
ymm3/m256/m32bcst and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F38.W0O OC /r C VIV AVX512F Permute single-precision floating-point values 
VPERMILPS zmm1 {k1}{z}, zmm2, zmmce using control from zmm3/m512/m32bcst 
zmm3/m512/m32bcst and store the result in zmm1 using writemask k1. 
EVEX.128.66.0F3A.WO 04 /r ib D VIV AVX512VL | Permute single-precision floating-point values 
VPERMILPS xmm1 {k1}{Z}, AVX512F xmm2/m128/m32bcst using controls from imm8 
xmm2/m1 28/m3 2bcst, imm8 and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F3A.WO 04 /r ib D VIV AVX512VL | Permute single-precision floating-point values 
VPERMILPS ymm1 {k1}{Z}, AVX512F ymm2/m256/m32bcst using controls from imm8 
ymm2/m256/m32bcst, imm8 and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F3A.WO 04 /r D VIV AVX512F Permute single-precision floating-point values 
ibVPERMILPS zmm1 {k1}{Z}, zmm2/m512/m32bcst using controls from imm8 
zmm2/m512/m32bcst, imm8 and store the result in zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B NA ModRM:reg (w) ModRM:r/m (r) NA NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
D Full ModRM:reg (w) ModRM:r/m (r) NA NA 
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Description 
(variable control version) 


Permute quadruples of single-precision floating-point values in the first source operand (second operand), each 
quadruplet using a 2-bit control field in the corresponding dword element of the second source operand. Permuted 
results are stored in the destination operand (first operand). 


The 2-bit control fields are located at the low two bits of each dword element (see Figure 5-26). Each control deter- 
mines which of the source element in an input quadruple is selected for the destination element. Each quadruple of 
source elements must lie in the same 128-bit region as the destination. 


EVEX version: The second source operand (third operand) is a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 32-bit memory location. Permuted results are 
written to the destination under the writemask. 


SRC1 


DEST] X7.. X4 | X7..X4 | X7..X4] X7..X4]X3..X0 | X3..X0 | x3..x0 | X3.. X0 


Figure 5-25. VPERMILPS Operation 


Bit 
255 226 225224 63 34.3332 3 1 0 
ignored sel atte ignored sel ignored sel 
Control Field 7 Control Field 2 Control Field 1 


Figure 5-26. VPERMILPS Shuffle Control 


(immediate control version) 


Permute quadruples of single-precision floating-point values in the first source operand (second operand), each 
quadruplet using a 2-bit control field in the imm8 byte. Each 128-bit lane in the destination operand (first operand) 
use the four control fields of the same imm8 byte. 


VEX version: The source operand is a YMM/XMM register or a 256/128-bit memory location and the destination 
operand is a YMM/XMM register. 


EVEX version: The source operand (second operand) is a ZMM/YMM/XMM register, a 512/256/128-bit memory 
location or a 512/256/128-bit vector broadcasted from a 32-bit memory location. Permuted results are written to 
the destination under the writemask. 


Note: For the imm§8 version, VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instruction will 
#UD. 
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Operation 


Select4(SRC, control) { 
CASE (control[1:0]) OF 

O: TMP := SRC[31:0]; 

1: TMP := SRC[63:32]; 

2: TMP :=SRC[95:64]; 
3: TMP := SRC[127:96]; 
ESAC; 
RETURN TMP 
! 


VPERMILPS (EVEX immediate versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN TMP_SRC1[i+31:i] := SRC1[31:0]; 
ELSE TMP_SRC1[i+31:i] = SRC1[i+31:i]; 
Fl; 
ENDFOR; 


TMP_DEST[31:0] := Select4(TMP_SRC1[127:0], imm8[1:0)); 
TMP_DEST[63:32] := Select4(TMP_SRC1[127:0], imm8[3:2]); 
TMP_DEST[95:64] := Select4(TMP_SRC1[127:0], imm8[5:4]); 
TMP_DEST[127:96] := Select4(TMP_SRC1[127:0], imm8[7:6)); Fl; 


IF VL >= 256 


TMP_DEST[159:1 28] := Select4(TMP_SRC1[255:1 28], imm8[1:0] 
TMP_DEST[191:160] := Select4(TMP_SRC1[255:1 28], imm8[3:2] 
TMP_DEST[223:192] := Select4(TMP_SRC1[255:1 28], imm8[5:4] 
TMP_DEST[255:224] := Select4(TMP_SRC1[255:1 28], imm8[7:6] 


Fl; 
IF VL >=512 
TMP_DEST[287:256] := Select4 
TMP_DEST[319:288] := Select4 
TMP_DEST[351:320] := Select4 
TMP_DEST[383:352] := Select4 
TMP_DEST[415:384] := Select4 
TMP_DEST[447:416] := Select4 
TMP_DEST[479:448] := Select4 
TMP_DEST[51 1:480] := Select4 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* 


a ee a 


TMP_SRC1[383:256], imm8[1:0] 
TMP_SRC1[383:256], imm8[3:2] 
TMP_SRC1[383:256], imm8[5:4] 
TMP_SRC1[383:256], imm8[7:6] 
TMP_SRC1[511:384], imm8[1:0] 
TMP_SRC1[511:384], imm8[3:2] 
TMP_SRC1[511:384], imm8[5:4] 
TMP_SRC1[511:384], imm8[7:6] 


; Fl; 
; Fl; 
; Fl; 
; Fl; 


a) 


; Fl; 
; Fl; 
; Fl; 
; Fl; 
; Fl; 
; Fl; 
; Fl; 
; Fl 


a ) 


THEN *DEST[i+31:i] remains unchanged* 


ELSE DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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;zeroing-masking 
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VPERMILPS (256-bit immediate version) 
DEST[31:0] := Select4(SRC1[1 27:0], imm8[1:0]); 
DEST[63:32] := Select4(SRC1[127:0], imm8[3:2)); 
DEST[95:64] := Select4(SRC1[127:0], imm8[5:4]); 
DEST[127:96] := Select4(SRC1[127:0], imm8[7:6]); 
DEST[159:128] := Select4(SRC1[255:128], imm8[1:0]), 
DEST[191:160] := Select4(SRC1[255:1 28], imm8[3:2]); 
DEST[223:192] := Select4(SRC1[255:128], imm8[5:4]), 
DEST[255:224] := Select4(SRC1[255:1 28], imm8[7:6]), 


VPERMILPS (128-bit immediate version) 
DEST[31:0] := Select4(SRC1[127:0], imm8[1:0)); 
DEST[63:32] := Select4(SRC1[127:0], imm8[3:2)); 
DEST[95:64] := Select4(SRC1[127:0], imm8[5:4)); 
DEST[127:96] := Select4(SRC1[127:0], imm8[7:6]); 
DEST[MAXVL-1:128] := 0 


VPERMILPS (EVEX variable versions) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN TMP_SRC2[i+31:i] = SRC2[3 1:0]; 
ELSE TMP_SRC2[i+31:i] := SRC2[i+31:i]; 
Fl; 
ENDFOR; 
TMP_DEST[31:0] := Select4(SRC1[127:0], TMP_SRC2[1:0)); 
TMP_DEST[63:32] := Select4(SRC1[127:0], TMP_SRC2[33:32]); 
TMP_DEST[95:64] := Select4(SRC1[127:0], TMP_SRC2[65:64)); 
TMP_DEST[127:96] := Select4(SRC1[127:0], TMP_SRC2[97:96]); 
IF VL >= 256 
TMP_DEST[159:1 28] := Select4(SRC1[255:128], TMP_SRC2[1 29:1 28)); 
TMP_DEST[191:160] := Select4(SRC1[255:128], TMP_SRC2[161:160)); 
) 
) 


o 


TMP_DEST[223:192] := Select4(SRC1[255:128], TMP_SRC2[193:192] 
TMP_DEST[255:224] := Select4(SRC1[255:128], TMP_SRC2[225:224] 
Fl; 
IFVL>=512 
TMP_DEST[287:256] := Select4(SRC1[383:256], TMP_SRC2[257:256]) 
TMP_DEST[319:288] := Select4(SRC1[383:256], TMP_SRC2[289:288]) 
TMP_DEST[351:320] := Select4(SRC1[383:256], TMP_SRC2[321:320)); 
TMP_DEST[383:352] := Select4(SRC1[383:256], TMP_SRC2[353:352]); 
) 
) 
) 
) 


oi 


o 


o 


TMP_DEST[415:384] := Select4(SRC1[511:384], TMP_SRC2[385:384] 
TMP_DEST[447:416] := Select4(SRC1[511:384], TMP_SRC2[41 7:416] 
TMP_DEST[479:448] := Select4(SRC1[511:384], TMP_SRC2[449:448] 
TMP_DEST[51 1:480] := Select4(SRC1[511:384], TMP_SRC2[481:480] 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 ;zeroing-masking 


o 


o 


o 


oi 
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Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMILPS (256-bit variable version) 

DEST[31:0] := Select4(SRC1[127:0], SRC2[1:0)); 
DEST[63:32] := Select4(SRC1[127:0], SRC2[33:32]); 
DEST[95:64] := Select4(SRC1[127:0], SRC2[65:64)); 
DEST[127:96] := Select4(SRC1[127:0], SRC2[97:96)); 
DEST[159:128] := Select4(SRC1[255:1 28], SRC2[129:128] 
DEST[191:160] := Select4(SRC1[255:1 28], SRC2[161:160] 
DEST[223:192] := Select4(SRC1[255:1 28], SRC2[193:192] 
DEST[255:224] := Select4(SRC1[255:1 28], SRC2[225:224] 
DEST[MAXVL-1:256] := 0 


i" 


In 


in 


a) 


VPERMILPS (128-bit variable version) 

DEST[31:0] := Select4(SRC1[127:0], SRC2[1:0)); 
DEST[63:32] := Select4(SRC1[127:0], SRC2[33:32]); 
DEST[95:64] :=Select4(SRC1[127:0], SRC2[65:64)); 
DEST[127:96] := Select4(SRC1[127:0], SRC2[97:96)); 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMILPS __m512_mm512_permute_ps(__m512 a, int imm); 

VPERMILPS __m512_mm512_mask_permute_ps(__m512 s,__ mmask16 k,___m512 a, int imm); 
VPERMILPS __m512_mm512_maskz_permute_ps(__mmask16 k,__m512 a, int imm); 
VPERMILPS __m256 _mm256_mask_permute_ps(__m256 s,__ mmask8 k, __m256 a, int imm); 
VPERMILPS __m256 _mm256_maskz_permute_ps(__mmask8 k,___m256 a, int imm); 
VPERMILPS __m128_mm_mask_permute_ps(__m128 s,__ mmask8 k, __m128 a, int imm); 
VPERMILPS __m128_mm_maskz_permute_ps(___mmask8 k,__m128 a, int imm); 
VPERMILPS __m512_mm512_permutevar_ps(__m512ii,__m512 a); 

VPERMILPS __m512_mm512_mask_permutevar_ps(__m512s,__ mmask16 k,_m512ii, 
VPERMILPS __m512_mm512_maskz_permutevar_ps(__ mmask16 k,__m512ii,__m512 a); 
VPERMILPS __m256_mm256_mask_permutevar_ps(__m256 s,__ mmask8 k,___m256 i,__ m256 a); 
VPERMILPS __m256_mm256_maskz_permutevar_ps(__ mmask8 k,__ m256 i, ___m256 a); 
VPERMILPS __m128_mm_mask_permutevar_ps(__m128s,__ mmask8 k,__m128i,__m128 a); 
VPERMILPS __m128_mm_maskz_permutevar_ps(__ mmask8 k,__m128i,__m128 a); 

VPERMILPS __m128_mm_permute_ps (__m128 a, int control); 

VPERMILPS __m256_mm256_permute_ps (__m256 a, int control); 

VPERMILPS __m128_mm_permutevar_ps (__m128 a, __m128i control); 

VPERMILPS __m256 __mm256_permutevar_ps (__m256 a, __m256i control); 


m512 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.W = 1. 

EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”; additionally: 
#UD If either (E)VEX.vvvv != 1111B and with imm8. 
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Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
VEX.256.66.0F3A.W1 01 /r ib A VIV AVX2 Permute double-precision floating-point elements in 
VPERMPD ymm1, ymm2/m256, imm8 ymm2/m256 using indices in imm8 and store the 

result in ymm1. 

EVEX.256.66.0F3A.W1 01 /r ib B VIV AVX512VL | Permute double-precision floating-point elements in 
VPERMPD ymm1 {k1}{z}, AVX512F ymm2/m256/m64bcst using indexes in imm8 and 
ymm2/m256/m64bcst, imm8 store the result in ymm1 subject to writemask k1. 
EVEX.512.66.0F3A.W1 01 /r ib B VIV AVX512F Permute double-precision floating-point elements in 
VPERMPD zmm1 {k1}{Z}, zmm2/m512/m64bcst using indices in imm8 and 
zmm2/m512/m64bcst, imm8 store the result in zmm1 subject to writemask k1. 
EVEX.256.66.0F38.W1 16 /r C VIV AVX512VL | Permute double-precision floating-point elements in 
VPERMPD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst using indexes in ymm2 and 
ymm3/m256/m64bcst store the result in ymm1 subject to writemask k1. 
EVEX.512.66.0F38.W1 16 /r C VIV AVX512F Permute double-precision floating-point elements in 
VPERMPD zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst using indices in zmm2 and 
zmm3/m512/m64bcst store the result in zmm1 subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
B Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


The imm§8 version: Copies quadword elements of double-precision floating-point values from the source operand 
(the second operand) to the destination operand (the first operand) according to the indices specified by the imme- 
diate operand (the third operand). Each two-bit value in the immediate byte selects a qword element in the source 
operand. 


VEX version: The source operand can be a YMM register or a memory location. Bits (MAXVL-1:256) of the corre- 
sponding destination register are zeroed. 


In EVEX.512 encoded version, The elements in the destination are updated using the writemask k1 and the imm8& 
bits are reused as control bits for the upper 256-bit half when the control bits are coming from immediate. The 
source operand can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit 
memory location. 


The imm§8 versions: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD. 


The vector control version: Copies quadword elements of double-precision floating-point values from the second 
source operand (the third operand) to the destination operand (the first operand) according to the indices in the 
first source operand (the second operand). The first 3 bits of each 64 bit element in the index operand selects which 
quadword in the second source operand to copy. The first and second operands are ZMM registers, the third 
operand can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit memory 
location. The elements in the destination are updated using the writemask k1. 


Note that this instruction permits a qword in the source operand to be copied to multiple locations in the destination 
operand. 

If VPERMPD is encoded with VEX.L= 0, an attempt to execute the instruction encoded with VEX.L= 0 will cause an 
#UD exception. 
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Operation 


VPERMPD (EVEX - imm8 control forms) 
(KL, VL) = (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN TMP_SRC[i+63:i] := SRC[63:0); 
ELSE TMP_SRC[i+63:i] := SRC[i+63:i]; 
Fl; 
ENDFOR; 


TMP_DEST[63:0] := (TMP_SRC[256:0] >> (IMM8[1:0] * 64))[63:0); 
TMP_DEST[1 27:64] := (TMP_SRC[256:0] >> (IMM8[3:2] * 64))[63:0]; 
TMP_DEST[191:1 28] := (TMP_SRC[256:0] >> (IMM8[5:4] * 64))[63:0]; 
TMP_DEST[255:1 92] := (TMP_SRC[256:0] >> (IMM8[7:6] * 64))[63:0]; 
IF VL >= 512 
TMP_DEST[319:256] := 
TMP_DEST[383:320] := 
TMP_DEST[447:384] := 
TMP_DEST[51 1:448] := 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 ;zeroing-masking 


TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 


IMM8[1:0] * 64 
IMM8[3:2] * 64 


))[63:0]; 

) 
IMM8[5:4] * 64) 

) 


[63:0]; 
[63:0]; 


IMM8[7:6] * 64))[63:0]; 


EX ~~ 
~~ pa gam 
TS Teh UM 


Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMPD (EVEX - vector control forms) 
(KL, VL) = (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2{[i+63:i] := SRC2[63:0]; 
ELSE TMP_SRC2[i+63:i] = SRC2[i+63:i]; 
Fl; 
ENDFOR; 


IF VL = 256 
TMP_DEST[63:0] := (TMP_SRC2[255:0] >> (SRC1[1:0] * 64))[63:0]; 
TMP_DEST[127:64] := (TMP_SRC2[255:0] >> (SRC1[65:64] * 64))[63:0]; 
TMP_DEST[191:128] := (TMP_SRC2[255:0] >> (SRC1[129:128] * 64))[63:0]; 
TMP_DEST[255:192] := (TMP_SRC2[255:0] >> (SRC1[193:192] * 64))[63:0]; 
Fl; 
IF VL=512 
TMP_DEST[63:0] := (TMP_SRC2[511:0] >> (SRC1[2:0] * 64))[63:0]; 


5-380 Vol. 2C VPERMPD—Permute Double-Precision Floating-Point Elements 


INSTRUCTION SET REFERENCE, V-Z 


TMP_DEST[127:64] = (TMP_SRC2[511:0] >> (SRC1[66:64] * 64))[63:0]; 
TMP_DEST[191:128] := (TMP_SRC2[51 1:0] >> (SRC1[130:128] * 64))[63:0]; 
TMP_DEST[255:192] := (TMP_SRC2[511:0] >> (SRC1[194:192] * 64))[63:0]; 
TMP_DEST[319:256] := (TMP_SRC2[51 1:0] >> (SRC1[258:256] * 64))[63:0]; 
TMP_DEST[383:320] := (TMP_SRC2[511:0] >> (SRC1[322:320] * 64))[63:0]; 
TMP_DEST[447:384] := (TMP_SRC2[511:0] >> (SRC1[386:384] * 64))[63:0]; 
TMP_DEST[511:448] := (TMP_SRC2[511:0] >> (SRC1[450:448] * 64))[63:0]; 


(pm py pm, gta 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 :zeroing-masking 
Fl; 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPERMPD (VEX.256 encoded version) 

DEST[63:0] := (SRC[255:0] >> (IMM8[1:0] * 64))[63:0); 
DEST[127:64] := (SRC[255:0] >> (IMM8[3:2] * 64))[63:0]; 
DEST[191:128] := (SRC[255:0] >> (IMM8[5:4] * 64))[63:0); 
DEST[255:192] := (SRC[255:0] >> (IMM8[7:6] * 64))[63:0); 
DEST[MAXVL-1:256] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMPD __m512d_mm512_permutex_pd(__m512d a, int imm); 
VPERMPD __m512d _mm512_mask_permutex_pd(__m512ds,__mmask16 k,__m512d a, int imm); 
VPERMPD __m512d_mm512_maskz_permutex_pd(__mmask16 k,__m512d a, int imm); 
VPERMPD __m512d_mm512_permutexvar_pd(__m512ii,__m512d a); 

VPERMPD __m512d_mm512_mask_permutexvar_pd(__m512ds,__ mmask16k,__m512ii, 
VPERMPD __m512d_mm512_maskz_permutexvar_pd(___mmask16 k,___m512ii,__m512d a); 
VPERMPD __m256d _mm256_permutex_epi64(__m256d a, int imm); 

VPERMPD __m256d _mm256_mask_permutex_epi64(__m256i s,___ mmask8 k,__ m256d a, int imm); 
VPERMPD __m256d _mm256_maskz_permutex_epi64(__ mmask8 k, __ m256d a, int imm); 
VPERMPD __m256d _mm256_permutexvar_epi64(__m256i i,__ m256d a); 
VPERMPD __m256d __mm256_mask_permutexvar_epi64(__m256i s,___mmask8 k, 
VPERMPD __m256d _mm256_maskz_permutexvar_epi64(__ mmask8 k, __ m256i i, 


m512d a); 


m256i i, 
m256d a); 


m256d a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0. 

If VEX.vvvv != 1111B. 
EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”; additionally: 
#UD If encoded with EVEX.128. 

If EVEX.vvvv != 1111B and with imm8s. 
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VPERMPS—Permute Single-Precision Floating-Point Elements 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.256.66.0F38.W0O 16 /r A VIV AVX2 Permute single-precision floating-point elements in 
VPERMPS ymm1, ymm2, ymm3/m256 using indices in ymm2 and store the result in 
ymm3/m256 ymm1. 
EVEX.256.66.0F38.W0 16 /r B VIV AVX512VL | Permute single-precision floating-point elements in 
VPERMPS ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst using indexes in ymm2 and store 
ymm3/m256/m32bcst the result in ymm1 subject to write mask k1. 
EVEX.512.66.0F38.W0 16 /r B VIV AVX512F Permute single-precision floating-point values in 
VPERMPS zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst using indices in zmm2 and store the 
zmm3/m512/m32bcst result in zmm1 subject to write mask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Copies doubleword elements of single-precision floating-point values from the second source operand (the third 
operand) to the destination operand (the first operand) according to the indices in the first source operand (the 
second operand). Note that this instruction permits a doubleword in the source operand to be copied to more than 
one location in the destination operand. 


VEX.256 versions: The first and second operands are YMM registers, the third operand can be a YMM register or 
memory location. Bits (MAXVL-1:256) of the corresponding destination register are zeroed. 
EVEX encoded version: The first and second operands are ZMM registers, the third operand can be a ZMM register, 


a 512-bit memory location or a 512-bit vector broadcasted from a 32-bit memory location. The elements in the 
destination are updated using the writemask k1. 


If VPERMPS is encoded with VEX.L= 0, an attempt to execute the instruction encoded with VEX.L= 0 will cause an 
#UD exception. 


Operation 


VPERMPS (EVEX forms) 
(KL, VL) (8, 256),= (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2{[i+31:i] := SRC2[31:0]; 
ELSE TMP_SRC2[i+31:i] = SRC2[i+3 1:1]; 
Fl; 
ENDFOR; 


IF VL = 256 
TMP_DEST[31:0] := (TMP_SRC2[255:0] >> (SRC1[2:0] * 32))[31:0]; 
TMP_DEST[63:32] := (TMP_SRC2[255:0] >> (SRC1[34:32] * 32))[31:0]; 
TMP_DEST[95:64] := (TMP_SRC2[255:0] >> (SRC1[66:64] * 32))[31:0]; 
TMP_DEST[127:96] = (TMP_SRC2[255:0] >> (SRC1[98:96] * 32))[31:0]; 
TMP_DEST[159:128] := (TMP_SRC2[255:0] >> (SRC1[130:128] * 32))[31:0]; 
TMP_DEST[191:160] := (TMP_SRC2[255:0] >> (SRC1[162:160] * 32))[31:0]; 
TMP_DEST[223:192] := (TMP_SRC2[255:0] >> (SRC1[193:192] * 32))[31:0]; 

( ( 


~~ YS YH 
STS lCU SU 


TMP_DEST[255:224] := (TMP_SRC2[255:0] >> (SRC1[226:224] * 32))[31:0]; 
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Fl; 
IF VL=512 
TMP_DEST[31:0] := (TMP_SRC2[51 1:0] >> (SRC1[3:0] * 32))[31:0]; 
TMP_DEST[63:32] := (TMP_SRC2[51 1:0] >> (SRC1[35:32] * 32))[31:0]; 
TMP_DEST[95:64] := (TMP_SRC2[51 1:0] >> (SRC1[67:64] * 32))[31:0]; 
TMP_DEST[127:96] := (TMP_SRC2[51 1:0] >> (SRC1[99:96] * 32))[31:0]; 
TMP_DEST[159:1 28] := (TMP_SRC2[51 1:0] >> (SRC1[131:128] * 32 
TMP_DEST[191:160] := (TMP_SRC2[51 1:0] >> (SRC1[163:160] * 32 
TMP_DEST[223:192] := (TMP_SRC2[51 1:0] >> (SRC1[195:192] * 32 
TMP_DEST[255:224] := (TMP_SRC2[51 1:0] >> (SRC1[227:224] * 32 
TMP_DEST[287:256] := (TMP_SRC2[51 1:0] >> (SRC1[259:256] * 32 
TMP_DEST[319:288] := (TMP_SRC2[51 1:0] >> (SRC1[291:288] * 32 
TMP_DEST[351:320] := (TMP_SRC2[51 1:0] >> (SRC1[323:320] * 32 
TMP_DEST[383:352] := (TMP_SRC2[51 1:0] >> (SRC1[355:352] * 32 
TMP_DEST[415:384] := (TMP_SRC2[51 1:0] >> (SRC1[387:384] * 32 
TMP_DEST[447:416] := (TMP_SRC2[51 1:0] >> (SRC1[419:416] * 32 
TMP_DEST[479:448] :=(TMP_SRC2[51 1:0] >> (SRC1[451:448] * 32) 
TMP_DEST[51 1:480] := (TMP_SRC2[51 1:0] >> (SRC1[483:480] * 32 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 :zeroing-masking 


[31:0]; 


YS a OWS SS WS NS SS NS YS YS YS aS 


Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMPS (VEX.256 encoded version) 

DEST[31:0] := (SRC2[255:0] >> (SRC1[2:0] * 32))[31:0]; 
DEST[63:32] := (SRC2[255:0] >> (SRC1[34:32] * 32))[31:0]; 
DEST[95:64] := (SRC2[255:0] >> (SRC1[66:64] * 32))[31:0]; 
DEST[127:96] := (SRC2[255:0] >> (SRC1[98:96] * 32))[31:0]; 
DEST[159:128] := (SRC2[255:0] >> (SRC1[130:128] * 32))[31:0]; 
DEST[191:160] := (SRC2[255:0] >> (SRC1[162:160] * 32))[31:0]; 
DEST[223:192] := (SRC2[255:0] >> (SRC1[194:192] * 32))[31:0]; 
DEST[255:224] := (SRC2[255:0] >> (SRC1[226:224] * 32))[31:0]; 
DEST[MAXVL-1:256] := 0 


Y~—~ YS YH 
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)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 
)[3 1:0]; 


)[3 1:0]; 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPERMPS __m512 _mm512_permutexvar_ps(__m512ii,___m512 a); 

VPERMPS __m512_mm512_mask_permutexvar_ps(__m512s,__ mmask16 k,___m512ii, 
VPERMPS __m512_mm512_maskz_permutexvar_ps(__ mmask16 k,__m512ii,__m512 a); 
VPERMPS __m256 _mm256_permutexvar_ps(__m256 i,__ m256 a); 

VPERMPS __m256 __mm256_mask_permutexvar_ps(__m256 s,__ mmask8 k,__m256i,__m256 a); 
VPERMPS __m256 _mm256_maskz_permutexvar_ps(_mmask8 k,__m256 i, __m256 a); 


m512 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.L = 0. 

EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”. 
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VPERMQ—Qwords Element Permutation 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
VEX.256.66.0F3A.W1 00 /r ib A VIV AVX2 Permute qwords in ymm2/m256 using indices in 
VPERMQ ymm1, ymm2/m256, imm8 immé8 and store the result in ymm1. 
EVEX.256.66.0F3A.W1 O00 /r ib B VIV AVX512VL | Permute qwords in ymm2/m256/m64bcst using 
VPERMQ ymm1 {k1}{z}, AVX512F indexes in imm8 and store the result in ymm1. 
ymm2/m256/m64bcst, imm8 
EVEX.512.66.0F3A.W1 O00 /r ib B VIV AVX512F Permute qwords in zmm2/m51 2/m64bcst using 
VPERMQ zmm1 {k1}{Z}, indices in imm8 and store the result in zmm1. 
zmm2/m512/m64best, imm8 
EVEX.256.66.0F38.W1 36 /r C VIV AVX512VL_ | Permute qwords in ymm3/m256/m64bcst using 
VPERMQ ymm1 {k1}{z}, ymm2, AVX512F indexes in ymm2 and store the result in ymm1. 
ymm3/m256/m64bcst 
EVEX.512.66.0F38.W1 36 /r C VIV AVX512F Permute qwords in zmm3/m51 2/m64bcst using 
VPERMQ zmm1 {k1}{z}, zmm2, indices in zmm2 and store the result in zmm1. 
zmm3/m512/m64bcst 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
B Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


The imm8 version: Copies quadwords from the source operand (the second operand) to the destination operand 
(the first operand) according to the indices specified by the immediate operand (the third operand). Each two-bit 
value in the immediate byte selects a qword element in the source operand. 


VEX version: The source operand can be a YMM register or a memory location. Bits (MAXVL-1:256) of the corre- 
sponding destination register are zeroed. 


In EVEX.512 encoded version, The elements in the destination are updated using the writemask k1 and the imms 
bits are reused as control bits for the upper 256-bit half when the control bits are coming from immediate. The 
source operand can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit 
memory location. 


Immediate control versions: VEX.vvvv and EVEX.vvvwv are reserved and must be 1111b otherwise instructions will 
#UD. 


The vector control version: Copies quadwords from the second source operand (the third operand) to the destina- 
tion operand (the first operand) according to the indices in the first source operand (the second operand). The first 
3 bits of each 64 bit element in the index operand selects which quadword in the second source operand to copy. 
The first and second operands are ZMM registers, the third operand can be a ZMM register, a 512-bit memory loca- 
tion or a 512-bit vector broadcasted from a 64-bit memory location. The elements in the destination are updated 
using the writemask k1. 


Note that this instruction permits a qword in the source operand to be copied to multiple locations in the destination 
operand. 


If VPERMPQ is encoded with VEX.L= 0 or EVEX.128, an attempt to execute the instruction will cause an #UD excep- 
tion. 
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Operation 


VPERMQ (EVEX - imm8 control forms) 
(KL, VL) = (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN TMP_SRC[i+63:i] := SRC[63:0); 
ELSE TMP_SRC[i+63:i] := SRC[i+63:i]; 
Fl; 
ENDFOR; 
TMP_DEST[63:0] := (TMP_SRC[255:0] >> (IMM8[1:0] * 64))[63:0); 
TMP_DEST[127:64] := (TMP_SRC[255:0] >> (IMM8[3:2] * 64))[63:0]; 
TMP_DEST[191:128] := (TMP_SRC[255:0] >> (IMM8[5:4] * 64))[63:0]; 
TMP_DEST[255:192] := (TMP_SRC[255:0] >> (IMM8[7:6] * 64))[63:0]; 
IF VL >=512 
TMP_DEST[319:256] := 
TMP_DEST[383:320] := 
TMP_DEST[447:384] := 
TMP_DEST[51 1:448] := 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 ;zeroing-masking 


TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 
TMP_SRC[511:256] >> 


IMM8[1:0] * 64) 
IMM8[3:2] * 64) 
IMM8[5:4] * 64) 
IMM8[7:6] * 64) 


[63:0]; 
[63:0]; 
[63:0]; 
[63:0]; 
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Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMQ (EVEX - vector control forms) 
(KL, VL) = (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2[i+63:i] = SRC2[63:0); 
ELSE TMP_SRC2[i+63:i] = SRC2[i+63:i); 
Fl; 
ENDFOR; 
IF VL = 256 
TMP_DEST[63:0] := (TMP_SRC2[255:0] >> (SRC1[1:0] * 64))[63:0]; 
TMP_DEST[127:64] := (TMP_SRC2[255:0] >> (SRC1[65:64] * 64))[63:0); 
TMP_DEST[191:1 28] := (TMP_SRC2[255:0] >> (SRC1[129:128] * 64))[63:0]; 
TMP_DEST[255:192] := (TMP_SRC2[255:0] >> (SRC1[193:192] * 64))[63:0]; 
Fl; 
IF VL=512 
TMP_DEST[63:0] := (TMP_SRC2[51 1:0] >> (SRC1[2:0] * 64))[63:0]; 
TMP_DEST[127:64] := (TMP_SRC2[51 1:0] >> (SRC1[66:64] * 64))[63:0); 
TMP_DEST[191:1 28] := (TMP_SRC2[51 1:0] >> (SRC1[130:128] * 64))[63:0]; 
TMP_DEST[255:192] := (TMP_SRC2[51 1:0] >> (SRC1[194:192] * 64))[63:0]; 
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TMP_DEST[319:256] := 
TMP_DEST[383:320] := 
TMP_DEST[447:384] := 
TMP_DEST[51 1:448] := 


Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 


Fl; 
ENDFOR 


TMP_SRC2[51 1:0] >> (SRC1[258:256] * 64 
TMP_SRC2[51 1:0] >> (SRC1[322:320] * 64 
TMP_SRC2[51 1:0] >> (SRC1[386:384] * 64 
TMP_SRC2[51 1:0] >> (SRC1[450:448] * 64 


my, pom pm 
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)[63:0]; 
)[63:0]; 
)[63:0]; 
)[63:0]; 
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IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE 


Fl; 


; zeroing-masking 


DEST[i+63:i] := 0 :zeroing-masking 


DEST[MAXVL-1:VL] := 0 


VPERMQ (VEX.256 encoded version) 

DEST[63:0] := (SRC[255:0] >> (IMM8[1:0] * 64))[63:0); 
DEST[127:64] := (SRC[255:0] >> (IMM8[3:2] * 64))[63:0]; 
DEST[191:128] := (SRC[255:0] >> (IMM8[5:4] * 64))[63:0); 
DEST[255:192] := (SRC[255:0] >> (IMM8[7:6] * 64))[63:0); 
DEST[MAXVL-1:256] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 
VPERMQ 


m512i 


mm512 


permutex_epi64(__m512i a, int imm); 


m512i 


mm512 


mask_permutex_epi64(__m512is,__ mmask8 k,___m512i a, int imm); 


m512i 


mm512 


maskz_permutex_epi64(__ mmask8 k,__m512i a, int imm); 


m512i 


mm512 


permutexvar_epi64(__m512i a,__m512ib); 


m512i 


mm512 


mask_permutexvar_epi64(__m512is,__ mmask8 k,__m512i a,__m512i b); 


m512i 


mm512 


maskz_permutexvar_epi64(__ mmask8 k,__m512i a,__m512i b); 


m256i 


mm256 


permutex_epi64(__m256i a, int imm); 


m256i 


mm256 


mask_permutex_epi64(__m256i s,__ mmask8 k, __ m256i a, int imm); 


m256i 


mm256 


maskz_permutex_epi64(__ mmask8 k, __ m256i a, int imm); 


m256i 


mm256 


permutexvar_epi64(__ m256i a, ___m256i b); 


m256i 


mm256 


m256i 


mm256 


mask_permutexvar_epi64(__m256is,__ mmask8 k,___ m256i a, __ m256i b); 
maskz_permutexvar_epi64(__ mmask8 k, __ m256i a, ___m256i b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”; additionally: 


#UD 


#UD 


If VEX.L = 0. 

If VEX.vvvv != 1111B. 

EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions”; additionally: 
If encoded with EVEX.128. 

If EVEX.vvvv != 1111B and with imm8s. 
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VPERMT2B—Full Permute of Bytes from Two Tables Overwriting a Table 


Opcode/ Op | 64/32 CPUID Feature | Description 
Instruction / bit Mode | Flag 

En | Support 
EVEX.128.66.0F38.W0 7D /r A VIN AVX512VL Permute bytes in xmm3/m128 and xmm1 using byte 
VPERMT2B xmm1 {k1}{z}, xmm2, AVX512_VBMI_ | indexes in xmm2 and store the byte results in xmm1 
xmm3/m128 using writemask k1. 
EVEX.256.66.0F38.W0 7D /r A VIV AVX512VL Permute bytes in ymm3/m256 and ymm1 using byte 
VPERMT2B ymm1 {k1}{z}, ymm2, AVX512_VBMI | indexes in ymm2 and store the byte results in ymm1 
ymm3/m256 using writemask k1. 
EVEX.512.66.0F38.W0 7D /r A VV AVX512_VBMI_ | Permute bytes in zmm3/m512 and zmm1 using byte 
VPERMT2B zmm1 {k1}{z}, zmm2, indexes in zmm_2 and store the byte results in zmm1 
zmm3/m512 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Permutes byte values from two tables, comprising of the first operand (also the destination operand) and the third 
operand (the second source operand). The second operand (the first source operand) provides byte indices to 
select byte results from the two tables. The selected byte elements are written to the destination at byte granu- 
larity under the writemask k1. 


The first and second operands are ZMM/YMM/XMM registers. The second operand contains input indices to select 
elements from the two input tables in the 1st and 3rd operands. The first operand is also the destination of the 
result. The second source operand can be a ZMM/YMM/XMM register, or a 512/256/128-bit memory location. In 
each index byte, the id bit for table selection is bit 6/5/4, and bits [5:0]/[4:0]/[3:0] selects element within each 
input table. 


Note that these instructions permit a byte value in the source operands to be copied to more than one location in 
the destination operand. Also, the second table and the indices can be reused in subsequent iterations, but the first 
table is overwritten. 


Bits (MAX_VL-1:256/128) of the destination are zeroed for VL=256,128. 
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Operation 


VPERMTZ2B (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
IF VL = 128: 
id := 3; 
ELSE IF VL = 256: 
id := 4; 
ELSE IF VL = 512: 
id := 5; 
Fl; 
TMP_DEST[VL-1:0] := DEST[VL-1:0]; 
FOR j := 0 TO KL-1 
off := 8*SRC1[j*8 + id: j*8] ; 
IF k1[j] OR *no writemask*: 
DEST[j*8 + 7: j*8] = SRC1[j*8+id+1]? SRC2[off+7:off] : TMP_DEST[off+7:off]; 
ELSE IF *zeroing-masking* 
DEST[j*8 + 7: j*8] := 0; 
*ELSE 
DEST[j*8 + 7: j*8] remains unchanged* 
Fl; 
ENDFOR 
DEST[MAX_VL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMT2B __m512i_mm512_permutex2var_epi8(__m512i a,__m512i idx, __m512i b); 

VPERMT2B __m512i_mm512_mask_permutex2var_epi8(__m512i a,__mmask64 k,__m512i idx, __m512i b); 
VPERMT2B __m512i_mm512_maskz_permutex2var_epi8(__mmask64 k,__m512i a,__m512i idx,___m512ib); 
VPERMT2B __m256i_mm256_permutex2var_epi8(__m256i a,_ m256i idx, __m256i b); 

VPERMT2B __m256i__mm256_mask_permutex2var_epi8(__m256i a,__mmask32 k,___ m256i idx, __m256i b); 
VPERMT2B __m256i__mm256_maskz_permutex2var_epi8(__mmask32 k,__ m25Gi a, __m256i idx, __m256i b); 
VPERMT2B __m128i_mm_permutex2var_epi8(__m128i a,__m128i idx, __m128i b); 

VPERMT2B __m128i__mm_mask_permutex2var_epi8(__m128i a,__ mmask16 k,___m128i idx, __m128i b); 
VPERMT2B __m128i __mm_maskz_permutex2var_epi8(__mmask16 k,___m128i a,__m128i idx, __m128i b); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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VPERMT2W/D/Q/PS/PD—Full Permute from Two Tables Overwriting one Table 


VPERMT2PD zmm1 {k1}{z}, 
zmm2, zmm3/m512/m64bcst 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 7D /r A VIV AVX512VL_ | Permute word integers from two tables in xmm3/m128 
VPERMT2W xmm1 {k1}{z}, xmm_2, AVX512BW | and xmm1 using indexes in xmm2 and store the result in 
xmm3/m128 xmm_1 using writemask k1. 
EVEX.256.66.0F38.W1 7D /r A VIV AVX512VL_ | Permute word integers from two tables in ymm3/m256 
VPERMT2W ymm1 {k1}{z}, ymm2, AVX512BW | and ymm!1 using indexes in ymm2 and store the result in 
ymm3/m256 ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 7D /r A VIV AVX512BW | Permute word integers from two tables in zmm3/m512 
VPERMT2W zmm1 {k1}{z}, zmm2, and zmm1 using indexes in zmm2 and store the result in 
zmm3/m512 zmm1 using writemask k1. 
EVEX.128.66.0F38.WO 7E /r B VV AVX512VL_ | Permute double-words from two tables in 
VPERMT2D xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m32bcst and xmm1 using indexes in xmm2 
xmm3/m1 28/m32bcst and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W0 7E /r B VIN AVX512VL_ | Permute double-words from two tables in 
VPERMT2D ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst and ymm1 using indexes in ymm2 
ymm3/m256/m32bcst and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F38.WO 7E /r B VIN AVX512F Permute double-words from two tables in 
VPERMT2D zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst and zmm1 using indices in zmm2 
zmm3/m512/m32bcst and store the result in zmm1 using writemask k1. 
EVEX.128.66.0F38.W1 7E /r B VIV AVX512VL_ | Permute quad-words from two tables in 
VPERMT2Q xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m64bcst and xmm1 using indexes in xmm2 
xmm3/m1 28/m64bcst and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 7E /r B VIV AVX512VL_ | Permute quad-words from two tables in 
VPERMT2Q ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst and ymm1 using indexes in ymm2 
ymm3/m256/m64bcst and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 7E /r B VIV AVX512F Permute quad-words from two tables in 
VPERMT2Q zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst and zmm1 using indices in zmm2 
zmm3/m512/m64bcst and store the result in zmm1 using writemask k1. 
EVEX.128.66.0F38.WO 7F /r B VIV AVX512VL_ | Permute single-precision FP values from two tables in 
VPERMT2PS xmm1 {k1}{Z}, AVX512F xmm3/m128/m32bcst and xmm1 using indexes in xmm2 
xmm2, xmm3/m128/m32bcst and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W0O 7F /r B VIV AVX512VL_ | Permute single-precision FP values from two tables in 
VPERMT2PS ymm1 {k1}{Z}, AVX512F ymm3/m256/m32bcst and ymm1 using indexes in ymm2 
ymme2, ymm3/m256/m32bcst and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F38.W0O 7F /r B VIV AVX512F Permute single-precision FP values from two tables in 
VPERMT2PS zmm1 {k1}{Z}, zmm3/m512/m32bcst and zmm1 using indices in zmm2 
zmm2, zmm3/m512/m32bcst and store the result in zmm1 using writemask k1. 
EVEX.128.66.0F38.W1 7F /r B VIV AVX512VL_ | Permute double-precision FP values from two tables in 
VPERMT2PD xmm1 {k1}{z}, AVX512F xmm3/m128/m64bcst and xmm1 using indexes in xmm2 
xmm2, xmm3/m128/m64bcst and store the result in xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 7F /r B VIV AVX512VL_ | Permute double-precision FP values from two tables in 
VPERMT2PD ymm1 {k1}{z}, AVX512F ymm3/m256/m64bcst and ymm1 using indexes in ymm2 
ymm2, ymm3/m256/m64bcst and store the result in ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 7F /r B VIV AVX512F Permute double-precision FP values from two tables in 


zmm3/m512/m64bcst and zmm1 using indices in zmm2 
and store the result in zmm1 using writemask k1. 
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Instruction Operand Encoding 


Op/En | Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r,w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Permutes 16-bit/32-bit/64-bit values in the first operand and the third operand (the second source operand) using 
indices in the second operand (the first source operand) to select elements from the first and third operands. The 
selected elements are written to the destination operand (the first operand) according to the writemask k1. 


The first and second operands are ZMM/YMM/XMM registers. The second operand contains input indices to select 
elements from the two input tables in the 1st and 3rd operands. The first operand is also the destination of the 
result. 

D/Q/PS/PD element versions: The second source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location. Broadcast from the 
low 32/64-bit memory location is performed if EVEX.b and the id bit for table selection are set (selecting table_2). 
Dword/PS versions: The id bit for table selection is bit 4/3/2, depending on VL=512, 256, 128. Bits 
[3:0]/[2:0]/[1:0] of each element in the input index vector select an element within the two source operands, If 
the id bit is 0, table_1 (the first source) is selected; otherwise the second source operand is selected. 

Qword/PD versions: The id bit for table selection is bit 3/2/1, and bits [2:0]/[1:0] /bit 0 selects element within each 
input table. 

Word element versions: The second source operand can be a ZMM/YMM/XMM register, or a 512/256/128-bit 
memory location. The id bit for table selection is bit 5/4/3, and bits [4:0]/[3:0]/[2:0] selects element within each 
input table. 

Note that these instructions permit a 16-bit/32-bit/64-bit value in the source operands to be copied to more than 
one location in the destination operand. Note also that in this case, the same index can be reused for example for 
a second iteration, while the table elements being permuted are overwritten. 


Bits (MAXVL-1:256/128) of the destination are zeroed for VL=256,128. 


Operation 


VPERMT2W (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
IF VL= 128 

id:=2 
Fl; 
IF VL = 256 

id:=3 
Fl; 
IF VL= 512 

id:=4 
Fl; 
TMP_DEST := DEST 
FOR j := 0 TO KL-1 

i:=j*16 

off = 16*SRC1[itid:i] 

IF k1[j] OR *no writemask* 

THEN 
DEST[i+1 5:i]=SRC1[i+id+1] ? SRC2[off+1 5:off] 
: TMP_DEST[off+1 5S:off] 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 
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DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPERMT2D/VPERMTZ2PS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF VL= 128 
id:=1 
Fl; 
IF VL = 256 
id:=2 
Fl; 
IF VL=512 
id:=3 
Fl; 
TMP_DEST := DEST 
FOR j := 0 TO KL-1 
i:=j* 32 
off := 32*SRC1[itid:i] 
IF k1[j] OR *no writemask* 


THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
DEST[i+31:i] = SRC1[i+id+1] ? SRC2[31:0] 
: TMP_DEST[off+31:off] 
ELSE 
DEST[i+31:i] = SRC1[i+id+1] ? SRC2[off+3 1:off] 
: TMP_DEST[off+31:off] 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPERMT2Q/VPERMT2PD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8 512) 
IF VL= 128 
id:=0 
Fl; 
IF VL = 256 
id:=1 
Fl; 
IF VL=512 
id:=2 
Fl; 
TMP_DEST:= DEST 
FOR j :=0 TO KL-1 
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i:=j*64 


off := 64*SRC1[itid:i] 
IF k1[j] OR *no writemask* 
THEN 


ELSE 


Fl; 
ENDFOR 


IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN 
DEST[i+63:i] = SRC1[i+id+1] ? SRC2[63:0] 
: TMP_DEST[off+63:0ff] 
ELSE 
DEST[i+63:i] = SRC1[i+id+1] ? SRC2[off+63:off] 
: TMP_DEST[off+63:0ff] 
Fl 


IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPERMT2D 


m512i_mm512_permutex2var_epi32(__m512i a, 


VPERMT2D 


m512i_mm512_mask_permutex2var_epi32(__m512ia, 


VPERMT2D 


m512i_mm512_mask2_permutex2var_epi32(__m512i a, 


VPERMT2D 


m512i_mm512_maskz_permutex2var_epi32(__mmask16 k,__m512ia, 


VPERMT2D 


m256i__mm256_permutex2var_epi32(__m256i a, 


VPERMT2D 


VPERMT2D 


VPERMT2D 


VPERMT2D __m128i __mm_permutex2var_epi32(__m128i a, 


VPERMT2D 


m128i __mm_mask_permutex2var_epi32(__m128i a, 


VPERMT2D 


m128i __mm_mask2_permutex2var_epi32(__m128i a, 


VPERMT2D __m128i __mm_maskz_permutex2var_epi32(__mmask8 k, 


VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PD 
VPERMT2PS 
VPERMT2PS 
VPERMT2PS 
VPERMT2PS 
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m512d_mm512_permutex2var_pd(__m512da,__m512i idx, 
m512d_mm512_mask_permutex2var_pd(__m512da,__ mmask8 k, 
m512d_mm512_mask2_permutex2var_pd(__m512d a, 
m512d_mm512_maskz_permutex2var_pd(__mmask8 k, 
m256d _mm256_permutex2var_pd(__m256d a, ___ m256i idx, 
m256d __mm256_mask_permutex2var_pd(__m256d a, ___ mmask8 k, 
m256d __mm256_mask2_permutex2var_pd(__m256d a, 
m256d __mm256_maskz_permutex2var_pd(__mmask8 k, 
m1 28i idx, 
m128d _mm_mask_permutex2var_pd(__m128d a,__ mmask8 k,__m128i idx, 


__m128d _mm_permutex2var_pd(__m128d a, 


m128d_mm_mask2_permutex2var_pd(__m128d a, 
m128d __mm_maskz_permutex2var_pd(__mmask8 k, 
m512_mm512_permutex2var_ps(__m512 a, 


m512i idx, 
mmask16 k,___m512i idx, 
mmask16 k,___m512i b); 
m512i idx, 


m256i idx, 
m256i_mm256_mask_permutex2var_epi32(__m256i a, 
m256i_mm256_mask2_permutex2var_epi32(__m256i a, 
m256i __mm256_maskz_permutex2var_epi32(__mmask8 k, 
m1 28i idx, 


m512i idx, 
m512_mm512_mask_permutex2var_ps(__m512 a,__mmask16 k,___m512i idx, 
m512_mm512_mask2_permutex2var_ps(__m512 a, 
m512_mm512_maskz_permutex2var_ps(__mmask16 k,__m512 a, 
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m512i b); 


m512i b); 


m256i idx, __m256i b); 
mmask8 k, __m256i b); 


m256i b); 


m128i b); 
m128i b); 
m128i a, __m128i idx, __m128ib); 


m512i idx, __m512d b); 
m512i idx, __mmask8 k,___m512d b); 
m512da,__m512i idx, 


m512d b); 


m256i idx, __m256d b); 
m256i idx, ___ mmask8 k, __m256d b); 
m256d a,__ m256i idx, 


m256d b); 


m1 28d b); 
mmask8 k, __m128d b); 
m128d b); 


m512 b); 


m512 b); 
m512 b); 
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VPERMT2PS __m256 _mm256_permutex2var_ps(__m256 a, ___ m256i idx, __m256 b); 

VPERMT2PS __m256_mm256_mask_permutex2var_ps(__m256 a,___ mmask8 k, __ m256i idx, __m256 b); 
VPERMT2PS __m256_mm256_mask2_permutex2var_ps(__m256 a,__ m256i idx, __ mmask8 k,__ M256 b); 
VPERMT2PS __m256_mm256_maskz_permutex2var_ps(__mmask8 k,__m256 a, ___m256i idx, __m256 b); 
VPERMT2PS __m128_mm_permutex2var_ps(__m128 a,__m128i idx, __m128 b); 

VPERMT2PS __m128_mm_mask_permutex2var_ps(__m128 a,___ mmask8 k,__m128i idx, __m128 b); 
VPERMT2PS __m128_mm_mask2_permutex2var_ps(__m128 a, __m128i idx, __ mmask8 k,___m128 b); 
VPERMT2PS __m128_mm_maskz_permutex2var_ps(__mmask8 k,__m128 a,_m128i idx,__m128 b); 
VPERMT2Q __m512i_mm512_permutex2var_epi64(__m512i a, ___m512i idx, __m512i b); 

VPERMT2Q __m512i_mm512_mask_permutex2var_epi64(__m512i a, ___ mmask8 k, __m512i idx, __m512i b); 
VPERMT2Q __m512i_mm512_mask2_permutex2var_epi64(__m512i a, ___m512i idx, __ mmask8 k, __m512i b); 
VPERMT2Q __m512i_mm512_maskz_permutex2var_epi64(__mmask8 k, __m512i a,__m512i idx, __m512i b); 
VPERMT2Q __m256i__mm256_permutex2var_epi64(__m256i a, __m256i idx, __m256i b); 

VPERMT2Q __m256i __mm256_mask_permutex2var_epi64(__m256i a, __ mmask8 k, __m256i idx, __m256i b); 
VPERMT2Q __m256i __mm256_mask2_permutex2var_epi64(__m256i a, __m256i idx, __ mmask8 k, __m256i b); 
VPERMT2Q __m256i __mm256_maskz_permutex2var_epi64(__mmask8 k, __m256i a, ___m256i idx, __m256i b); 
VPERMT2Q __m128i __mm_permutex2var_epi64(__m128i a, ___m128i idx, __m128i b); 

VPERMT2Q __m128i __mm_mask_permutex2var_epi64(__m128i a, __mmask8 k, __m128i idx, __m128i b); 
VPERMT2Q __m128i __mm_mask2_permutex2var_epi64(__m128i a, ___m128i idx, __mmask8 k, __m128i b); 
VPERMT2Q __m128i __mm_maskz_permutex2var_epi64(__mmask8 k, __m128i a, ___m128i idx, __m128i b); 
VPERMT2W __m512i_mm512_permutex2var_epi16(__m512i a,__m512i idx, ___m512i b); 

VPERMT2W __m512i_mm512_mask_permutex2var_epi16(__m512i a,__ mmask32 k,___m512i idx, ___m512i b); 
VPERMT2W __m512i_mm512_mask2_permutex2var_epi16(__m512i a,__m512i idx, _ mmask32 k,__m512i b); 
VPERMT2W __m512i_mm512_maskz_permutex2var_epi16(__mmask32 k,__m512ia,__m512i idx, __m512ib); 
VPERMT2W __m256i_mm256_permutex2var_epi16(__m256i a,___ m256i idx, __m256i b); 

VPERMT2W __m256i__mm256_mask_permutex2var_epi16(__m256i a,__ mmask16 k, __m256i idx, __m256i b); 
VPERMT2W __m256i_mm256_mask2_permutex2var_epi16(__m256i a,___ m256i idx, _ mmask16 k, __m256i b); 
VPERMT2W __m256i_mm256_maskz_permutex2var_epi16(__mmask16 k,__ m256i a, __ m256i idx, __m256i b); 
VPERMT2W __m128i_mm_permutex2var_epi16(__m128i a, ___m128i idx, __m128i b); 


VPERMT2W __m128i__mm_mask_permutex2var_epi16(__m128i a, 
VPERMT2W __m128i__mm_mask2_permutex2var_epi16(__m128i a, 


mmask8 k, __m128i idx, __m128i b); 
m128i idx, ___ mmask8 k, __m128i b); 


VPERMT2W __m128i__mm_maskz_permutex2var_epi16(__mmask8 k, __m128i a, 


m128i idx, __m128i b); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 
VPERMT2D/Q/PS/PD: See Table 2-50, “Type E4NF Class Exception Conditions”. 
VPERMT2W: See Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Conditions”. 
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Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.W0 62 /r A VIV AVX512_VBMI2 Expands up to 128 bits of packed byte values 
VPEXPANDB xmm1{k1}{z}, m128 AVX512VL from m128 to xmm1 with writemask k1. 
EVEX.128.66.0F38.W0 62 /r B VIV AVX512_VBMI2 Expands up to 128 bits of packed byte values 
VPEXPANDB xmm1{k1}{z}, xmm2 AVX512VL from xmm_2 to xmm1 with writemask k1. 
EVEX.256.66.0F38.W0 62 /r A VIV AVX512_VBMI2 Expands up to 256 bits of packed byte values 
VPEXPANDB ymm1{k1}{z}, m256 AVX512VL from m256 to ymm1 with writemask k1. 
EVEX.256.66.0F38.W0 62 /r B VIV AVX512_VBMI2 Expands up to 256 bits of packed byte values 
VPEXPANDB ymm1{k1}{z}, ymm2 AVX512VL from ymm_2 to ymm1 with writemask k1. 
EVEX.512.66.0F38.W0 62 /r A VIV AVX512_VBMI2 Expands up to 512 bits of packed byte values 
VPEXPANDB zmm1{k1}{z}, m512 from m512 to zmm1 with writemask k1. 
EVEX.512.66.0F38.W0 62 /r B VIV AVX512_VBMI2 Expands up to 512 bits of packed byte values 
VPEXPANDB zmm1{k1}{z}, zmm2 from zmm2 to zmm1 with writemask k1. 
EVEX.128.66.0F38.W1 62 /r A VIV AVX512_VBMI2 Expands up to 128 bits of packed word values 
VPEXPANDW xmm1{k1}{z}, m128 AVX512VL from m128 to xmm1 with writemask k1. 
EVEX.128.66.0F38.W1 62 /r B VIV AVX512_VBMI2 Expands up to 128 bits of packed word values 
VPEXPANDW xmm1{k1}{z}, xmm2 AVX512VL from xmm_2 to xmm1 with writemask k1. 
EVEX.256.66.0F38.W1 62 /r A VIV AVX512_VBMI2 Expands up to 256 bits of packed word values 
VPEXPANDW ymm1{k1}{z}, m256 AVX512VL from m256 to ymm1 with writemask k1. 
EVEX.256.66.0F38.W1 62 /r B VIV AVX512_VBMI2 Expands up to 256 bits of packed word values 
VPEXPANDW ymm1{k1}{z}, ymm2 AVX512VL from ymm_2 to ymm1 with writemask k1. 
EVEX.512.66.0F38.W1 62 /r A VIV AVX512_VBMIl2 Expands up to 512 bits of packed word values 
VPEXPANDW zmm1{k1}{z}, m512 from m512 to zmm1 with writemask k1. 
EVEX.512.66.0F38.W1 62 /r B VIV AVX512_VBMI2 Expands up to 512 bits of packed byte integer 
VPEXPANDW zmm1{k1}{z}, zmm2 values from zmm2 to zmm1 with writemask 
k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Expands (loads) up to 64 byte integer values or 32 word integer values from the source operand (memory 
operand) to the destination operand (register operand), based on the active elements determined by the 


writemask operand. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


VPEXPANDB/VPEXPANDW — Expand Byte/Word Values 
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Moves 128, 256 or 512 bits of packed byte integer values from the source operand (memory operand) to the desti- 
nation operand (register operand). This instruction is used to load from an int8 vector register or memory location 
while inserting the data into sparse elements of destination vector register using the active elements pointed out 


by the operand writemask. 
This instruction supports memory fault suppression. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 


instead of the size of the full vector. 


Operation 


VPEXPANDB 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
k:=0 
FOR j := 0 TOKL-1: 
IF k1[j] OR *no writemask*: 
DEST.byte[j] := SRC.byte[k]; 
k:=k+1 
ELSE: 
IF *merging-masking*: 
*DEST.byte[j] remains unchanged* 
ELSE: ; zeroing-masking 
DEST.byte[j] := 0 
DEST[MAX_VL-1:VL] := 0 


VPEXPANDW 
(KL, VL) = (8,128), (16,256), (32, 512) 
k:=0 
FOR j :=0 TO KL-1: 
IF k1[j] OR *no writemask*: 
DEST.word[j] := SRC.word[k]; 
k:=k+1 
ELSE: 
IF *merging-masking*: 
*DEST.word[j] remains unchanged* 
ELSE: ; zeroing-masking 
DEST.word[j] := 0 
DEST[MAX_VL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPEXPAND 


m128i 


mm_mask_expand_epi8(__m128i,___ mmask16, __m128i); 


VPEXPAND 


m128i 


mm_maskz_expand_epi8(__mmask16, __m128i); 


VPEXPAND 


m128i 


mm_mask_expandloadu_epi8(__m128i,__ mmask16, const void"); 


VPEXPAND 


m128i 


mm_maskz_expandloadu_epi8(__mmask16, const void"); 


VPEXPAND 


m256i 


mm256_mask_expand_epi8(__m256i,__ mmask32, __ m256i); 


VPEXPAND 


m256i 


mm256_maskz_expand_epi8(__mmask32, __m256i); 


VPEXPAND 


m256i 


mm256_mask_expandloadu_epi8(__m256i, __ mmask32, const void"); 


VPEXPAND 


m256i 


mm256_maskz_expandloadu_epi8(__mmask32, const void*); 


VPEXPAND 


m512i 


mm512_mask_expand_epi8(__m512i,__ mmask64, __m512i); 


VPEXPAND 


m512i 


mm512_maskz_expand_epi8(__mmask64, __m512i); 


VPEXPAND 


m512i 


mm512_mask_expandloadu_epi8(__m512i, __ mmask64, const void"); 


VPEXPAND 


m512i 


mm512_maskz_expandloadu_epi8(__mmask64, const void*); 


VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 
VPEXPANDW 


m1 28i 


mm_mask_expand_epi16(__m128i,__ mmask8,__m128i); 


m1 28i 


mm_maskz_expand_epi16(__mmask8, __m128i); 


m128i 


mm_mask_expandloadu_epi16(__m128i, __ mmask8, const void’); 


m1 28i 


mm_maskz_expandloadu_epi16(__mmask8, const void *); 


m256i 


mm256_mask_expand_epil16(__m256i,__ mmask16, __m256i); 


m256i 


mm256_maskz_expand_epi16(__mmask16, __m256i); 


m256i 


mm256_mask_expandloadu_epi16(__m256i, __ mmask16, const void"); 


m256i 


mm256_maskz_expandloadu_epi16(__mmask16, const void’); 


m512i 


mm512_mask_expand_epi16(__m512i,___ mmask32, __m512i); 


m512i 


mm512_maskz_expand_epi16(__mmask32, __m512i); 


m512i 


mm512_mask_expandloadu_epi16(__m512i, __ mmask32, const void"); 


m512i 


mm512_maskz_expandloadu_epi16(__mmask32, const void’); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


See Table 2-49, “Type E4 Class Exception Conditions”. 
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VPEXPANDD—Load Sparse Packed Doubleword Integer Values from Dense Memory / Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support Flag 
EVEX.128.66.0F38.W0 89 /r A VIV AVX512VL_ | Expand packed double-word integer values from 
VPEXPANDD xmm1 {k1}{z}, AVX512F xmm2/m128 to xmm1 using writemask k1. 
xmm2/m128 
EVEX.256.66.0F38.W0 89 /r A VIV AVX512VL | Expand packed double-word integer values from 
VPEXPANDD ymm1 {k1}{Z}, AVX512F ymm2/m256 to ymm1 using writemask k1. 
ymm2/m256 
EVEX.512.66.0F38.W0 89 /r A VIV AVX512F Expand packed double-word integer values from 
VPEXPANDD zmm1 {k1}{Z}, zmm2/m512 to zmm1 using writemask k1. 
zmm2/m512 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Expand (load) up to 16 contiguous doubleword integer values of the input vector in the source operand (the second 
operand) to sparse elements in the destination operand (the first operand), selected by the writemask ki. The 
destination operand is a ZMM register, the source operand can be a ZMM register or memory location. 

The input vector starts from the lowest element in the source operand. The opmask register k1 selects the destina- 
tion elements (a partial vector or sparse elements if less than 8 elements) to be replaced by the ascending 
elements in the input vector. Destination elements not selected by the writemask k1 are either unmodified or 
zeroed, depending on EVEX.z. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VPEXPANDD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 


k:=0 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+31:i] = SRC[k+3 1:k]; 
k:=k+32 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 
VPEXPANDD 


m512i 


mm512_mask_expandloadu_epi32(__m512is,__mmask16 k, void * a); 


m512i 


mm512_maskz_expandloadu_epi32(__mmask16 k, void * a); 


m512i 


mm512_mask_expand_epi32(__m512is, __mmask16 k,__m512i a); 


m512i 


mm512 


m256i 


maskz_expand_epi32(__mmask16 k,__m512i a); 


mm256_mask_expandloadu_epi32(__m256i s, __ mmask8 k, void * a); 


m256i 


mm256_maskz_expandloadu_epi32(__mmask8 kK, void * a); 


m256i 


mm256_mask_expand_epi32(__m256i s,___mmask8 k, __m256i a); 


m256i 


mm256_maskz_expand_epi32(__mmask8 k, __m256i a); 


m1 28i 


mm_mask_expandloadu_epi32(__m128is,__ mmask8 kK, void * a); 


m1 28i 


mm_maskz_expandloadu_epi32(__mmask8 kK, void * a); 


m128i 


m1 28i 


mm_mask_expand_epi32(__m128i s,__ mmask8 k, __m128i a); 
mm_maskz_expand_epi32(__mmask8 k, __m128i a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”; 


additionally: 


#UD 


VPEXPANDD—Load Sparse Packed Doubleword Integer Values from Dense Memory / Register 


If EVEX.vvvv != 1111B. 
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VPEXPANDQ—Load Sparse Packed Quadword Integer Values from Dense Memory / Register 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 89 /r A VIV AVX512VL | Expand packed quad-word integer values from 
VPEXPANDQ xmm1 {k1}{z}, xmm2/m128 AVX512F xmm2/m128 to xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 89 /r A VIV AVX512VL | Expand packed quad-word integer values from 
VPEXPANDQ ymm1 {k1}{z}, ymm2/m256 AVX512F ymm2/m256 to ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 89 /r A VIV AVX512F Expand packed quad-word integer values from 
VPEXPANDQ zmm1 {k1}{z}, zmm2/m512 zmm2/m512 to zmm1 using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Expand (load) up to 8 quadword integer values from the source operand (the second operand) to sparse elements 
in the destination operand (the first operand), selected by the writemask k1. The destination operand is a ZMM 
register, the source operand can be a ZMM register or memory location. 

The input vector starts from the lowest element in the source operand. The opmask register k1 selects the destina- 
tion elements (a partial vector or sparse elements if less than 8 elements) to be replaced by the ascending 
elements in the input vector. Destination elements not selected by the writemask k1 are either unmodified or 
zeroed, depending on EVEX.z. 

Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


Note that the compressed displacement assumes a pre-scaling (N) corresponding to the size of one single element 
instead of the size of the full vector. 


Operation 


VPEXPANDQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
k:=0 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
DEST[i+63:i] = SRC[k+63:k]; 
k:=k+64 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 
VPEXPANDQ 


m512i 


mm512_mask_expandloadu_epi64(__m512is,__ mmask8 k, void * a); 


m512i 


mm512_maskz_expandloadu_epi64(__ mmask8 k, void * a); 


m512i 


mm512_mask_expand_epi64(__m512is,___mmask8 k,__m512i a); 


m512i 


mm512 


m256i 


maskz_expand_epi64(__mmask8 k,___m512i a); 


mm256_mask_expandloadu_epi64(__m256is,__ mmask8 k, void * a); 


m256i 


mm256_maskz_expandloadu_epi64(__ mmask8 k, void * a); 


m256i 


mm256_mask_expand_epi64(__m256i s,___ mmask8 k,___m256i a); 


m256i 


mm256_maskz_expand_epi64(__mmask8 k, __m256i a); 


m128i 


mm_mask_expandloadu_epi64(__m128i s,__ mmask8 kK, void * a); 


m128i 


mm_maskz_expandloadu_epi64(__ mmask8 k, void * a); 


m128i 


m128i 


mm_mask_expand_epi64(__m128i s,__ mmask8 k, __m128i a); 
mm_maskz_expand_epi64(__ mmask8 k, __m128i a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


EVEX-encoded instruction, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”; 


additionally: 


#UD 


VPEXPANDQ—Load Sparse Packed Quadword Integer Values from Dense Memory / Register 


If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VPGATHERDD/VPGATHERQD — Gather Packed Dword Values Using Signed Dword/Qword 
Indices 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode Flag 

VEX.128.66.0F38.W0 90 /r RMV | V/V AVX2 Using dword indices specified in vm32x, gather dword val- 

VPGATHERDD xmm1, vm32x, xmm2 ues from memory conditioned on mask specified by 
xmmez. Conditionally gathered elements are merged into 
xmm1. 

VEX.128.66.0F38.W0O 91 /r RMV | V/V AVX2 Using qword indices specified in vm64x, gather dword val- 

VPGATHERQD xmm17, vm64x, xmm2 ues from memory conditioned on mask specified by 
xmmez. Conditionally gathered elements are merged into 
xmm1. 

VEX.256.66.0F38.W0 90 /r RMV | V/V AVX2 Using dword indices specified in vm32y, gather dword 

VPGATHERDD ymm1, vm32y, ymm2 from memory conditioned on mask specified by ymm2. 
Conditionally gathered elements are merged into ymm1. 

VEX.256.66.0F38.W0 91 /r RMV | V/V AVX2 Using qword indices specified in vm64y, gather dword val- 

VPGATHERQD xmm1, vm64y, xmm2 ues from memory conditioned on mask specified by 
xmmez. Conditionally gathered elements are merged into 
xmm1. 


Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 


RMV ModRM:reg (r,w) BaseReg (R): VSIB:base, VEX.vvvv (r, w) NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally loads up to 4 or 8 dword values from memory addresses specified by the memory 
operand (the second operand) and using dword indices. The memory operand uses the VSIB form of the SIB byte 
to specify a general purpose register operand as the common base, a vector register for an array of indices relative 
to the base and a constant scale factor. 


The mask operand (the third operand) specifies the conditional load operation from each memory address and the 
corresponding update of each data element of the destination operand (the first operand). Conditionality is speci- 
fied by the most significant bit of each data element of the mask register. If an element’s mask bit is not set, the 

corresponding element of the destination register is left unchanged. The width of data element in the destination 

register and mask register are identical. The entire mask register will be set to zero by this instruction unless the 
instruction causes an exception. 


Using qword indices, the instruction conditionally loads up to 2 or 4 qword values from the VSIB addressing 
memory operand, and updates the lower half of the destination register. The upper 128 or 256 bits of the destina- 
tion register are zero’ed with qword indices. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask operand are partially updated; those elements that have been gathered are placed into the 
destination register and have their mask bits set to zero. If any traps or interrupts are pending from already gath- 
ered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


If the data size and index size are different, part of the destination register and part of the mask register do not 
correspond to any elements being gathered. This instruction sets those parts to zero. It may do this to one or both 
of those registers even if the instruction triggers an exception, and even if the instruction triggers the exception 
before gathering any elements. 


VEX.128 version: For dword indices, the instruction will gather four dword values. For qword indices, the instruction 
will gather two values and zero the upper 64 bits of the destination. 
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VEX.256 version: For dword indices, the instruction will gather eight dword values. For qword indices, the instruc- 
tion will gather four values and zero the upper 128 bits of the destination. 


Note that: 


If any pair of the index, mask, or destination registers are the same, this instruction results a UD fault. 


The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination will be completed (and non-faulting). Individual elements closer 
to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered in the 
conventional order. 


Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 


This instruction does not perform AC checks, and so will never deliver an AC fault. 
This instruction will cause a #UD if the address size attribute is 16-bit. 
This instruction will cause a #UD if the memory operand is encoded without the SIB byte. 


This instruction should not be used to access memory mapped I/O as the ordering of the individual loads it does 
is implementation specific, and some implementations may use loads larger than the data element size or load 
elements an indeterminate number of times. 


The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32- 
bit mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address 
bits are ignored. 


Operation 


DEST := SRC1; 

BASE_ADDR: base register encoded in VSIB addressing; 
VINDEX: the vector index register encoded by VSIB addressing; 
SCALE: scale factor encoded by SIB:[7:6]; 

DISP: optional 1, 4 byte displacement; 

MASK := SRC3; 


VPGATHERDD (VEX.128 version) 
MASK[MAXVL-1:128] := 0; 
FOR j= 0 to 3 


i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] := 0; 
Fl; 
ENDFOR 
FOR j := 0 to3 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX[i+31:i])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:1 28] := 0; 
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VPGATHERQD (VEX.128 version) 
MASK[MAXVL-1:64] := 0; 


FOR j =O to3 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{[i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] = 0; 
Fl; 
ENDFOR 
FOR j :=O to 1 
k:=j* 64; 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1[k+63:k])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 


DEST[MAXVL-1:64] := 0; 


VPGATHERDD (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 
FOR j :=Oto7 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{[i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] = 0; 
Fl; 
ENDFOR 
FOR j :=Oto7 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1[i+31:i])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST[i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 
DEST[MAXVL-1:256] := 0; 
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VPGATHERQD (VEX.256 version) 
MASK[MAXVL-1:128] := 0; 


FOR j :=Oto7 
i:=j* 32; 
IF MASK[31 +i] THEN 
MASK{i +31:i] := FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +31:i] := 0; 
Fl; 
ENDFOR 
FOR j :=0 to3 
k:=j* 64; 
i:=j* 32; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [k+63:k])*SCALE + DISP; 
IF MASK[31 +i] THEN 
DEST{i +31:i] = FETCH_32BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +31:i] = 0; 
ENDFOR 


DEST[MAXVL-1:128] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 

VPGATHERDD: __m128i__mm_i32gather_epi32 (int const * base, __m128i index, const int scale); 

VPGATHERDD: __m128i __mm_mask_i32gather_epi32 (__m128i src, int const * base, __m128i index, __m128i mask, const int scale); 
VPGATHERDD: __ m256i_mm256_i32gather_epi32 ( int const * base, __m256i index, const int scale); 


VPGATHERDD: __ m256i_mm256_mask_i32gather_epi32 (__m256i src, int const * base, __m256i index, 
scale); 


VPGATHERQD: __m128i __mm_i64gather_epi32 (int const * base, __m128i index, const int scale); 
VPGATHERQD: __m128i __mm_mask_i64gather_epi32 (__m128i src, int const * base, 
VPGATHERQD: __m128i __mm256_i64gather_epi32 (int const * base, __m256i index, const int scale); 


VPGATHERQD: __m128i__mm256_mask_i64gather_epi32 (__m128i src, int const * base, __m256i index, 
scale); 


m256i mask, const int 


m128i index, __m128i mask, const int scale); 


m128i mask, const int 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-27, “Type 12 Class Exception Conditions”. 
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VPGATHERDD/VPGATHERDQ—Gather Packed Dword, Packed Qword with Signed Dword Indices 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 90 /vsib A VV AVX512VL | Using signed dword indices, gather dword values from 
VPGATHERDD xmm1 {k1}, vm32x AVX512F memory using writemask k1 for merging-masking. 
EVEX.256.66.0F38.W0 90 /vsib A VV AVX512VL | Using signed dword indices, gather dword values from 
VPGATHERDD ymm1 {k1}, vm32y AVX512F memory using writemask k1 for merging-masking. 
EVEX.512.66.0F38.W0 90 /vsib A VIV AVX512F Using signed dword indices, gather dword values from 
VPGATHERDD zmm1 {k1}, vm32z memory using writemask k1 for merging-masking. 
EVEX.128.66.0F38.W1 90 /vsib A VV AVX512VL | Using signed dword indices, gather quadword values from 
VPGATHERDQ xmm1 {k1}, vm32x AVX512F memory using writemask k1 for merging-masking. 
EVEX.256.66.0F38.W1 90 /vsib A VV AVX512VL | Using signed dword indices, gather quadword values from 
VPGATHERDQ ymm1 {k1}, vm32x AVX512F memory using writemask k1 for merging-masking. 
EVEX.512.66.0F38.W1 90 /vsib A VIV AVX512F Using signed dword indices, gather quadword values from 
VPGATHERDQ zmm1 {k1}, vm32y memory using writemask k1 for merging-masking. 


Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


BaseReg (R): VSIB:base, 
VectorReg(R): VSIB:index 


A Tuple1 Scalar ModRM:reg (w) NA NA 


Description 


A set of 16 or 8 doubleword/quadword memory locations pointed to by base address BASE_ADDR and index vector 
VINDEX with scale SCALE are gathered. The result is written into vector zmm1. The elements are specified via the 
VSIB (i.e., the index register is a zmm, holding packed indices). Elements will only be loaded if their corresponding 
mask bit is one. If an element’s mask bit is not set, the corresponding element of the destination register (zmm1) 
is left unchanged. The entire mask register will be set to zero by this instruction unless it triggers an exception. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask register (k1) are partially updated; those elements that have been gathered are placed into 
the destination register and have their mask bits set to zero. If any traps or interrupts are pending from already 
gathered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruc- 
tion breakpoint is not re-triggered when the instruction is continued. 

If the data element size is less than the index element size, the higher part of the destination register and the mask 
register do not correspond to any elements being gathered. This instruction sets those higher parts to zero. It may 
update these unused elements to one or both of those registers even if the instruction triggers an exception, and 
even if the instruction triggers the exception before gathering any elements. 

Note that: 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination zmm will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 

¢ Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 


¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 
* Not valid with 16-bit effective addresses. Will deliver a #UD fault. 
¢ These instructions do not accept zeroing-masking since the 0 values in k1 are used to determine completion. 
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Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 
ModRM.rm is different than 100b. 


This instruction has the same disp8*N and alignment rules as for scalar instructions (Tuple 1). 


The instruction will #UD fault if the destination vector zmm1 is the same as index vector VINDEX. The instruction 
will #UD fault if the kO mask register is specified. 

The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 
ignored. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 
VINDEX stands for the memory operand vector of indices (a ZMM register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1 or 4 byte displacement 


VPGATHERDD (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
THEN DEST[i+31:i] := MEM[BASE_ADDR + 
SignExtend(VINDEX[i+31:i]) * SCALE + DISP]), 1) 
k1{j] := 0 
ELSE *DEST[i+31:i] := remains unchanged* ; Only merging masking is allowed 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 


VPGATHERDQ (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1{j] 
THEN DEST[i+63:i] := 
MEM[BASE_ADDR + SignExtend(VINDEX[k+31:k]) * SCALE + DISP]) 
k1{j] := 0 
ELSE *DEST[i+63:i] := remains unchanged* ; Only merging masking is allowed 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPGATHERDD __m512i_mm512_i32gather_epi32(__m512i vdx, void * base, int scale); 

VPGATHERDD __m512i_mm512_mask_i32gather_epi32(__m512is,__mmask16 k,__m512i vdx, void * base, int scale); 
VPGATHERDD __m256i__mm256_mmask_i32gather_epi32(__m256i s,___ mmask8 k, __ m256i vdx, void * base, int scale); 
VPGATHERDD __m128i __mm_mmask_i32gather_epi32(__m128is,___mmask8 k, __m128i vdx, void * base, int scale); 
VPGATHERDQ __m512i__mm512_i32logather_epi64(__m256i vdx, void * base, int scale); 

VPGATHERDQ __m512i__mm512_mask_i32logather_epi64(__m512is, __mmask8 k, __m256i vdx, void * base, int scale); 
VPGATHERDQ __m256i __mm256_mmask_i32logather_epi64(__m256i s,___mmask8 k, __m128i vdx, void * base, int scale); 
VPGATHERDQ __m128i __mm_mmask_i32gather_epi64(__m128i s,___mmask8 k, __m128i vdx, void * base, int scale); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 
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VPGATHERDQ/VPGATHERQQ — Gather Packed Qword Values Using Signed Dword/Qword 
Indices 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode | Flag 

VEX.128.66.0F38.W1 90 /r A VIV AVX2 Using dword indices specified in vm32x, gather qword val- 

VPGATHERDQ xmm17, vm32x, xmm2 ues from memory conditioned on mask specified by 
xmme. Conditionally gathered elements are merged into 
xmm1. 

VEX.128.66.0F38.W1 91 /r A VIV AVX2 Using qword indices specified in vm64x, gather qword val- 

VPGATHERQQ xmm1, vm64x, xmm2 ues from memory conditioned on mask specified by 
xmmez. Conditionally gathered elements are merged into 
xmm1. 

VEX.256.66.0F38.W1 90 /r A VIV AVX2 Using dword indices specified in vm32x, gather qword val- 

VPGATHERDQ ymm1, vm32x, ymnm2 ues from memory conditioned on mask specified by 
ymm_z. Conditionally gathered elements are merged into 
ymm1. 

VEX.256.66.0F38.W1 91 /r A VIV AVX2 Using qword indices specified in vm64y, gather qword val- 

VPGATHERQQ ymm17, vm64y, ymm2 ues from memory conditioned on mask specified by 
ymme. Conditionally gathered elements are merged into 
ymm1. 


Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 


A ModRM:reg (r,w) BaseReg (R): VSIB:base, VEX.vvvv (r, w) NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally loads up to 2 or 4 qword values from memory addresses specified by the memory 
operand (the second operand) and using qword indices. The memory operand uses the VSIB form of the SIB byte 
to specify a general purpose register operand as the common base, a vector register for an array of indices relative 
to the base and a constant scale factor. 


The mask operand (the third operand) specifies the conditional load operation from each memory address and the 
corresponding update of each data element of the destination operand (the first operand). Conditionality is speci- 
fied by the most significant bit of each data element of the mask register. If an element’s mask bit is not set, the 

corresponding element of the destination register is left unchanged. The width of data element in the destination 

register and mask register are identical. The entire mask register will be set to zero by this instruction unless the 
instruction causes an exception. 


Using dword indices in the lower half of the mask register, the instruction conditionally loads up to 2 or 4 qword 
values from the VSIB addressing memory operand, and updates the destination register. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask operand are partially updated; those elements that have been gathered are placed into the 
destination register and have their mask bits set to zero. If any traps or interrupts are pending from already gath- 
ered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


If the data size and index size are different, part of the destination register and part of the mask register do not 
correspond to any elements being gathered. This instruction sets those parts to zero. It may do this to one or both 
of those registers even if the instruction triggers an exception, and even if the instruction triggers the exception 
before gathering any elements. 


VEX.128 version: The instruction will gather two qword values. For dword indices, only the lower two indices in the 
vector index register are used. 
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VEX.256 version: The instruction will gather four qword values. For dword indices, only the lower four indices in the 
vector index register are used. 


Note that: 
e If any pair of the index, mask, or destination registers are the same, this instruction results a UD fault. 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 

¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination will be completed (and non-faulting). Individual elements closer 
to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered in the 
conventional order. 

¢ Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 

¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 

¢ This instruction will cause a #UD if the address size attribute is 16-bit. 

¢ This instruction will cause a #UD if the memory operand is encoded without the SIB byte. 

¢ This instruction should not be used to access memory mapped I/O as the ordering of the individual loads it does 
is implementation specific, and some implementations may use loads larger than the data element size or load 
elements an indeterminate number of times. 

¢ The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32- 


bit mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address 
bits are ignored. 


Operation 


DEST := SRC1; 

BASE_ADDR: base register encoded in VSIB addressing; 
VINDEX: the vector index register encoded by VSIB addressing; 
SCALE: scale factor encoded by SIB:[7:6]; 

DISP: optional 1, 4 byte displacement; 

MASK := SRC3; 


VPGATHERDQ (VEX.128 version) 
MASK[MAXVL-1:128] := 0; 


FOR j :=O to 1 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{[i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=O to 1 
k:=j * 32; 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX[k+31 :k])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST{[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{[i +63:i] := 0; 
ENDFOR 


DEST[MAXVL-1:128] := 0; 
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VPGATHERQQ (VEX.128 version) 
MASK[MAXVL-1:1 28] := 0; 
FOR j :=Oto1 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{[i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=Oto1 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [i+63:i])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{i +63:i] := 0; 
ENDFOR 
DEST[MAXVL-1:1 28] := 0; 


VPGATHERQQ (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 
FOR j :=0 to3 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{[i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=0 to3 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [i+63:i])*SCALE + DISP; 
IF MASK[63+i] THEN 
DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 
Fl; 
MASK{[i +63:i] := 0; 
ENDFOR 
DEST[MAXVL-1:256] := 0; 


VPGATHERDQ (VEX.256 version) 
MASK[MAXVL-1:256] := 0; 
FOR j :=0 to3 
i:=j* 64; 
IF MASK[63+i] THEN 
MASK{i +63:i] := FFFFFFFF_FFFFFFFFH; // extend from most significant bit 
ELSE 
MASK{i +63:i] := 0; 
Fl; 
ENDFOR 
FOR j :=0 to3 
k:=j * 32; 
i:=j* 64; 
DATA_ADDR := BASE_ADDR + (SignExtend(VINDEX1 [k+31:k])*SCALE + DISP; 
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IF MASK[63+i] THEN 


DEST[i +63:i] = FETCH_64BITS(DATA_ADDR); // a fault exits the instruction 


Fl; 


MASK[i +63:i] := O; 


ENDFOR 


DEST[MAXVL-1:256] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 
VPGATHERDQ: __m128i __mm_i32gather_epi64 (__int64 const * base, 


VPGATHERDQ: __m128i __mm_mask_i32gather_epi64 (__m128i src, 


scale); 
VPGATHERDQ: 


int scale); 
VPGATHERQQ: __| 
VPGATHERQQ: 


m128i __mm_i64gather_epi64 (__int64 const * base, 
m128i __mm_mask_i64gather_epi64 (__m128i src, __int64 const * base, 


scale); 
VPGATHERQQ: 


VPGATHERQQ: 


int scale); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


m1 28i index, const int scale); 


int64 const * base, __m128i index, __m128i mask, const int 


m256i__mm256_i32gather_epi64 (__int64 const * base, _m128i index, const int scale); 
VPGATHERDQ: __m256i __mm256_mask_i32gather_epi64 (__m256i src, 


int64 const * base, __m128i index, __ m256i mask, const 


m1 28i index, const int scale); 


m1 28i index, __m128i mask, const int 


m256i_mm256_i64gather_epi64 __(int64 const * base, _ m256i index, const int scale); 
m256i __mm256_mask_i64gather_epi64 (__m256i src, 


int64 const * base, __m256i index, __m256i mask, const 


See Table 2-27, “Type 12 Class Exception Conditions”. 
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VPGATHERQD/VPGATHERQQ—Gather Packed Dword, Packed Qword with Signed Qword Indices 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 91 /vsib A VIV AVX512VL | Using signed qword indices, gather dword values from 
VPGATHERQD xmm1 {k1}, vm64x AVX512F memory using writemask k1 for merging-masking. 
EVEX.256.66.0F38.W0 91 /vsib A VIV AVX512VL | Using signed qword indices, gather dword values from 
VPGATHERQD xmm1 {k1}, vm64y AVX512F memory using writemask k1 for merging-masking. 
EVEX.512.66.0F38.W0 91 /vsib A VIV AVX512F Using signed qword indices, gather dword values from 
VPGATHERQD ymm1 {k1}, vm64z memory using writemask k1 for merging-masking. 
EVEX.128.66.0F38.W1 91 /vsib A VIV AVX512VL | Using signed qword indices, gather quadword values from 
VPGATHERQQ xmm1 {k1}, vm64x AVX512F memory using writemask k1 for merging-masking. 
EVEX.256.66.0F38.W1 91 /vsib A VIV AVX512VL | Using signed qword indices, gather quadword values from 
VPGATHERQQ ymm1 {k1}, vm64y AVX512F memory using writemask k1 for merging-masking. 
EVEX.512.66.0F38.W1 91 /vsib A VIV AVX512F Using signed qword indices, gather quadword values from 
VPGATHERQQ zmm1 {k1}, vm64z memory using writemask k1 for merging-masking. 


Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


BaseReg (R): VSIB:base, 
VectorReg(R): VSIB:index 


A Tuple1 Scalar ModRM:reg (w) NA NA 


Description 


A set of 8 doubleword/quadword memory locations pointed to by base address BASE_ADDR and index vector 
VINDEX with scale SCALE are gathered. The result is written into a vector register. The elements are specified via 
the VSIB (i.e., the index register is a vector register, holding packed indices). Elements will only be loaded if their 
corresponding mask bit is one. If an element’s mask bit is not set, the corresponding element of the destination 
register is left unchanged. The entire mask register will be set to zero by this instruction unless it triggers an excep- 
tion. 


This instruction can be suspended by an exception if at least one element is already gathered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask register (k1) are partially updated; those elements that have been gathered are placed into 
the destination register and have their mask bits set to zero. If any traps or interrupts are pending from already 
gathered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruc- 
tion breakpoint is not re-triggered when the instruction is continued. 


If the data element size is less than the index element size, the higher part of the destination register and the mask 
register do not correspond to any elements being gathered. This instruction sets those higher parts to zero. It may 
update these unused elements to one or both of those registers even if the instruction triggers an exception, and 
even if the instruction triggers the exception before gathering any elements. 


Note that: 


¢ The values may be read from memory in any order. Memory ordering with other instructions follows the Intel- 
64 memory-ordering model. 


¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination zmm will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 


¢ Elements may be gathered in any order, but faults must be delivered in a right-to-left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 
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°® This instruction does not perform AC checks, and so will never deliver an AC fault. 
* Not valid with 16-bit effective addresses. Will deliver a #UD fault. 
¢ These instructions do not accept zeroing-masking since the 0 values in k1 are used to determine completion. 


Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 
ModRM.rm is different than 100b. 


This instruction has the same disp8*N and alignment rules as for scalar instructions (Tuple 1). 


The instruction will #UD fault if the destination vector zmm1 is the same as index vector VINDEX. The instruction 
will #UD fault if the kO mask register is specified. 

The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 
ignored. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 
VINDEX stands for the memory operand vector of indices (a ZMM register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1 or 4 byte displacement 


VPGATHERQD (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
k:=j* 64 
IF k1{j] 

THEN DEST[i+31:i] := MEM[BASE_ADDR + (VINDEX[k+63:k]) * SCALE + DISP}), 1) 

k1[j] := 0 

ELSE *DEST[i+31:i] = remains unchanged* ; Only merging masking is allowed 

Fl; 
ENDFOR 


k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL/2] := 0 


VPGATHERQQ (EVEX encoded version) 
(KL, VL) = (2, 64), (4, 128), (8, 256) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1{j] 
THEN DEST[i+63:i] := 
MEM[BASE_ADDR + (VINDEX[i+63:i]) * SCALE + DISP]) 
k1{j] := 0 
ELSE *DEST[i+63:i] := remains unchanged* ; Only merging masking is allowed 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPGATHERQD 
VPGATHERQD 
VPGATHERQD 
VPGATHERQD 
VPGATHERQQ 
VPGATHERQQ 
VPGATHERQQ 
VPGATHERQQ 


m256i 


mm512_i64gather_epi32(__m512i vdx, void * base, int scale); 


m256i 


m1 28i 


mm512_mask_i64gather_epi32lo(__m256is,___ mmask8 k,___m512i vdx, void * base, int scale); 
mm256_mask_i64gather_epi32lo(__m128is,___ mmask8 k, __ m256i vdx, void * base, int scale); 


m128i 


mm_mask_i64gather_epi32(__m128is,__mmask8 k, __m128i vdx, void * base, int scale); 


m512i 


mm512_i64gather_epi64(__m512i vdx, void * base, int scale); 


m512i 


mm512_mask_i64gather_epi64(__m512is,__ mmask8 k,___m512i vdx, void * base, int scale); 


m256i 


mm256_mask_i64gather_epi64(__m256i s,___ mmask8 k, __ m256i vdx, void * base, int scale); 


m128i 


mm_mask_i64gather_epi64(__m128i s,__ mmask8 k,___m128i vdx, void * base, int scale); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 


VPGATHERQD/VPGATHERQQ—Gather Packed Dword, Packed Qword with Signed Qword Indices Vol.2C 5-415 


INSTRUCTION SET REFERENCE, V-Z 


VPLZCNTD/Q—Count the Number of Leading Zero Bits for Packed Dword, Packed Qword Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 44 /r A VIV AVX512VL_ | Count the number of leading zero bits in each dword 
VPLZCNTD xmm1 {k1}{z}, AVX512CD | element of xmm2/m128/m32bcst using writemask k1. 
xmm2/m128/m32bcst 
EVEX.256.66.0F38.W0 44 /r A VIV AVX512VL_ | Count the number of leading zero bits in each dword 
VPLZCNTD ymm1 {k1}{Z}, AVX512CD | element of ymm2/m256/m32bcst using writemask k1. 
ymm2/m256/m32bcst 
EVEX.512.66.0F38.W0 44 /r A VIV AVX512CD_ | Count the number of leading zero bits in each dword 
VPLZCNTD zmm1 {k1}{z}, element of zmm2/m512/m32bcst using writemask k1. 
zmm2/m512/m32bcst 
EVEX.128.66.0F38.W1 44 /r A VIV AVX512VL_ | Count the number of leading zero bits in each qword 
VPLZCNTQ xmm1 {k1}{Z}, AVX512CD | element of xmm2/m128/m64bcst using writemask k1. 
xmm2/m128/m64bcst 
EVEX.256.66.0F38.W1 44 /r A VIV AVX512VL_ | Count the number of leading zero bits in each qword 
VPLZCNTQ ymm1 {k1}{2}, AVX512CD | element of ynm2/m256/m64bcst using writemask k1. 
ymm2/m256/m64bcst 
EVEX.512.66.0F38.W1 44 /r A VIV AVX512CD_ | Count the number of leading zero bits in each qword 
VPLZCNTQ zmm1 {k1}{Z}, element of zmm2/m512/m64bcst using writemask k1. 
zmm2/m512/m64bcst 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Counts the number of leading most significant zero bits in each dword or qword element of the source operand (the 
second operand) and stores the results in the destination register (the first operand) according to the writemask. 
If an element is zero, the result for that element is the operand size of the element. 


EVEX.512 encoded version: The source operand is a ZMM register, a 512-bit memory location, or a 512-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a ZMM register, conditionally updated 
using writemask k1. 


EVEX.256 encoded version: The source operand is a YMM register, a 256-bit memory location, or a 256-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a YMM register, conditionally updated 
using writemask k1. 


EVEX.128 encoded version: The source operand is a XMM register, a 128-bit memory location, or a 128-bit vector 
broadcasted from a 32/64-bit memory location. The destination operand is a XMM register, conditionally updated 
using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VPLZCNTD 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*32 
IF MaskBit(j) OR *no writemask* 
THEN 
temp := 32 
DEST[i+31:i] := 0 
WHILE (temp > 0) AND (SRC[i+temp-1] = 0) 
DO 
temp := temp - 1 
DEST[i+31:i] = DEST[i+31:i] + 1 
OD 
ELSE 
IF *merging-masking* 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE DEST[i+31:i] := 0 
Fl 
Fl 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPLZCNTQ 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:= j*64 
IF MaskBit(j) OR *no writemask* 
THEN 
temp := 64 
DEST[i+63:i] := 0 
WHILE (temp > 0) AND (SRC[i+temp-1] = 0) 
DO 
temp := temp - 1 
DEST[i+63:i] := DEST[i+63:i] + 1 
OD 
ELSE 
IF *merging-masking* 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE DEST[i+63:i] := 0 
Fl 
Fl 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPLZCNTD/Q—Count the Number of Leading Zero Bits for Packed Dword, Packed Qword Values 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-417 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPLZCNTD __m512i_mm512_lzcnt_epi32(__m512i a); 


VPLZCNTD __m512i_mm512_mask_Izcnt_epi32(__m512is,__mmask16 m, ___m512i a); 
VPLZCNTD __m512i_mm512_maskz_lzcnt_epi32(__ mmask16 m, __m512i a); 
VPLZCNTQ __m512i_mm512_lzcnt_epi64(__m512i a); 

VPLZCNTQ __m512i__mm512_mask_Izcnt_epi64(__m512i s,___ mmask8 m, __m512i a); 
VPLZCNTQ __m512i__mm512_maskz_Izcnt_epi64(__mmask8 m, __m512i a); 
VPLZCNTD __m256i __mm256_Izcnt_epi32(__m256i a); 

VPLZCNTD __m256i __mm256_mask_Izcnt_epi32(__m256i s,___ mmask8 m, __m256i a); 
VPLZCNTD __m256i__mm256_maskz_lzcnt_epi32(__mmask8 m, __m256i a); 
VPLZCNTQ __m256i __mm256_lIzcnt_epi64(__m256i a); 

VPLZCNTQ __m256i _mm256_mask_Izcnt_epi64(__m256i s, __mmask8 m, __m256i a); 
VPLZCNTQ __m256i__mm256_maskz_Izcnt_epi64(__mmask8 m, __m256i a); 
VPLZCNTD __m128i __mm_lIzcnt_epi32(__m128i a); 

VPLZCNTD __m128i __mm_mask_Izcnt_epi32(__m128is,___ mmask8 m, __m128i a); 
VPLZCNTD __m128i __mm_maskz_lzcnt_epi32(__mmask8 m, __m128i a); 

VPLZCNTQ __m128i __mm_Izcnt_epi64(__m128i a); 

VPLZCNTQ __m128i __mm_mask_Izcnt_epi64(__m128i s, __ mmask8 m, __m128i a); 


VPLZCNTQ __m128i __mm_maskz_lzcnt_epi64(__mmask8 m, __m128i a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMADD52HUQ—Packed Multiply of Unsigned 52-bit Unsigned Integers and Add High 52-bit 
Products to 64-bit Accumulators 


Opcode/ Op/ | 32/64 CPUID Description 
Instruction En | bit Mode 
Support 
EVEX.128.66.0F38.W1 BS /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in xmm2 and 
VPMADD52HUQ xmm1 {k1}{z}, xmm2, AVX512VL xmm3/m128 and add the high 52 bits of the 104- 
xmm3/m128/m64bcst bit product to the qword unsigned integers in 
xmm1 using writemask k1. 
EVEX.256.66.0F38.W1 BS /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in ymm2 and 
VPMADD52HUQ ymm1 {k1}{z}, ymm2, AVX512VL ymm3/m256 and add the high 52 bits of the 104- 
ymm3/m256/m64bcst bit product to the qword unsigned integers in 
ymm1 using writemask k1. 
EVEX.512.66.0F38.W1 BS /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in zmm2 and 
VPMADD52HUQ zmm1 {k1}{z}, zmm2, zmm3/m512 and add the high 52 bits of the 104- 
zmm3/m512/m64bcst bit product to the qword unsigned integers in 
zmm1 using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m(r) NA 
Description 


Multiplies packed unsigned 52-bit integers in each qword element of the first source operand (the second oper- 
and) with the packed unsigned 52-bit integers in the corresponding elements of the second source operand (the 
third operand) to form packed 104-bit intermediate results. The high 52-bit, unsigned integer of each 104-bit 
product is added to the corresponding qword unsigned integer of the destination operand (the first operand) 


under the writemask k1. 


The first source operand is a ZMM/YMM/XMM register. The second source operand can be a ZMM/YMM/XMM reg- 
ister, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64-bit memory loca- 
tion. The destination operand is a ZMM/YMM/XMM register conditionally updated with writemask k1 at 64-bit 


granularity. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPMADDS52HUQ (EVEX encoded) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j = 0 TOKL-1 
i:=j* 64; 
IF k1[j] OR *no writemask* THEN 
IF src2 is Memory AND EVEX.b=1 THEN 
tsrc2[63:0] := ZeroExtend64(src2[51:0]); 
ELSE 
tsrc2[63:0] := ZeroExtend64(src2[i+5 1:i]; 
Fl; 
Temp128[127:0] := ZeroExtend64(src1 [i+51:i]) * tsrc2[63:0]; 
Temp2[63:0] := DEST[i+63:i] + ZeroExtend64(temp128[103:52)) ; 
DEST[i+63:i] = Temp2[63:0]; 
ELSE 
IF *zeroing-masking* THEN 
DEST[i+63:i] := 0; 
ELSE *merge-masking* 
DEST[i+63:i] is unchanged; 
Fl; 
Fl; 
ENDFOR 
DEST[MAX_VL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VPMADDS2HUQ __m512i __mm512_madd52hi_epu64(__m512i a,__m512i b, __m512i c); 
VPMADDS2HUQ __m512i __mm512_mask_madd52hi_epu64(__m512is, __mmask8 k,___m512ia,__m512i b, ___m512i c); 


VPMADD52HUQ __m512i_mm512_maskz_madd52hi_epu64(__mmask8 k,___m512i a,__m512i b, ___m512i c); 
VPMADDS52HUQ __m256i _mm256_madd52hi_epu64(__m256i a, __ m256i b, __m256i c); 

VPMADD52HUQ __m256i _mm256_mask_madd52hi_epu64(__m256i s,___ mmask8 k, __m256i a, __m256i b, __m256i c); 
VPMADD52HUQ __m256i__mm256_maskz_madd52hi_epu64(__mmask8 k, __m256i a, __m256i b, __m256i c); 


VPMADD52HUQ __m128i__mm_madd52hi_epu64(__m128i a,__m128i b, __m128i c); 
VPMADD52HUQ __m128i __mm_mask_madd52hi_epu64(__m128i s,___mmask8 k, __m128i a, __m128i b,__m128i c); 
VPMADD52HUQ __m128i __mm_maskz_madd52hi_epu64(__mmask8 k, __m128i a,__m128i b, __m128i c); 


Flags Affected 


None. 


SIMD Floating-Point Exceptions 


None 
Other Exceptions 


See Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMADD52LUQ—Packed Multiply of Unsigned 52-bit Integers and Add the Low 52-bit Products 
to Qword Accumulators 


Opcode/ Op/En | 32/64 CPUID Description 
Instruction bit Mode 
Support 
EVEX.128.66.0F38.W1 B4 /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in xmme2 and 
VPMADD52LUQ xmm1 {k1}{Z}, AVX512VL xmm3/m1 28 and add the low 52 bits of the 104-bit 
xmm2,xmm3/m128/m64bcst product to the qword unsigned integers in xmm1 
using writemask k1. 
EVEX.256.66.0F38.W1 B4 /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in ymm2 and 
VPMADD52LUQ ymm1 {k1}{z}, AVX512VL ymm3/m256 and add the low 52 bits of the 104-bit 
ymm_2, ymm3/m256/m64bcst product to the qword unsigned integers in ymm1 
using writemask k1. 
EVEX.512.66.0F38.W1 B4 /r A VIV AVX512_IFMA Multiply unsigned 52-bit integers in zmm2 and 
VPMADD52LUQ zmm1 {k1}{Z}, zmm3/m512 and add the low 52 bits of the 104-bit 
zmm2,zmm3/m512/m64bcst product to the qword unsigned integers in zmm1 
using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m(r) NA 
Description 


Multiplies packed unsigned 52-bit integers in each qword element of the first source operand (the second oper- 
and) with the packed unsigned 52-bit integers in the corresponding elements of the second source operand (the 
third operand) to form packed 104-bit intermediate results. The low 52-bit, unsigned integer of each 104-bit 
product is added to the corresponding qword unsigned integer of the destination operand (the first operand) 


under the writemask k1. 


The first source operand is a ZMM/YMM/XMM register. The second source operand can be a ZMM/YMM/XMM reg- 
ister, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64-bit memory loca- 
tion. The destination operand is a ZMM/YMM/XMM register conditionally updated with writemask k1 at 64-bit 


granularity. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPMADD52LUQ (EVEX encoded) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j* 64; 
IF k1[j] OR *no writemask* THEN 
IF src2 is Memory AND EVEX.b=1 THEN 
tsrc2[63:0] := ZeroExtend64(src2[51:0]); 
ELSE 
tsrc2[63:0] := ZeroExtend64(src2[i+5 1:1]; 
Fl; 
Temp128[127:0] := ZeroExtend64(src1 [i+51:i]) * tsrc2[63:0); 
Temp2[63:0] := DEST[i+63:i] + ZeroExtend64(temp1 28[51:0)) ; 
DEST[i+63:i] = Temp2[63:0]; 
ELSE 
IF *zeroing-masking* THEN 
DEST[i+63:i] := 0; 
ELSE *merge-masking* 
DEST[i+63:i] is unchanged; 
Fl; 
Fl; 
ENDFOR 


DEST[MAX_VL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 

VPMADDS52LUQ __m512i_mm512_madd52lo_epu64(__m512ia,__m512ib,_m512i c); 

VPMADD52LUQ __m512i__mm512_mask_madd52lo_epu64(__m512is, __mmask8 k,__m512ia,__m512i b,__m512i c); 
VPMADD52LUQ __m512i__mm512_maskz_madd52lo_epu64(__mmask8 k, __m512i a,__m512ib,___m512i c); 
VPMADD52LUQ __m256i__mm256_madd52lo_epu64(__m256i a,___m256i b, __m256i c); 

VPMADD52LUQ __m256i __mm256_mask_madd52lo_epu64(__m256i s, __ mmask8 k,___m256i a, ___m256i b, __m256i c); 


VPMADD52LUQ __m256i __mm256_maskz_madd52lo_epu64(__mmask8 k, __m256i a, __m256i b, __m256i c); 
VPMADD52LUQ __m128i __mm_madd52lo_epu64(__m128i a,__m128i b, __m128i c); 

VPMADD52LUQ __m128i __mm_mask_madd52lo_epu64(__m128i s,___mmask8 k, __m128i a,__m128i b, __m128i c); 
VPMADD52LUQ __m128i__mm_maskz_madd52lo_epu64(__mmask8 k, __m128i a,__m128i b, __m128i c); 

Flags Affected 

None. 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


See Table 2-49, “Type E4 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMASKMOV — Conditional SIMD Integer Packed Loads and Stores 


Opcode/ Op/ | 64/32 | CPUID Description 
Instruction En -bit Feature 

Mode | Flag 
VEX.128.66.0F38.W0 8C /r RVM | V/V AVX2 Conditionally load dword values from m728 using mask 
VPMASKMOVD xmm1, xmm2, m128 in xmm2 and store in xmm1. 
VEX.256.66.0F38.W0 8C /r RVM | V/V AVX2 Conditionally load dword values from m256 using mask 
VPMASKMOVD ymm17, ymm2, m256 in ymm2 and store in ymm1. 
VEX.128.66.0F38.W1 8C /r RVM | V/V AVX2 Conditionally load qword values from m728 using mask 
VPMASKMOVQ xmm1, xmm2, m128 in xmm2 and store in xmm1. 
VEX.256.66.0F38.W1 8C /r RVM | V/V AVX2 Conditionally load qword values from m256 using mask 
VPMASKMOVQ ymm7, ymm2, m256 in ymm2 and store in ymm1. 
VEX.128.66.0F38.W0 8E /r MVR | V/V AVX2 Conditionally store dword values from xmm2 using 
VPMASKMOVD m128, xmm1, xmm2 mask in xmm1. 
VEX.256.66.0F38.W0 8E /r MVR | V/V AVX2 Conditionally store dword values from ymm2 using 
VPMASKMOVD m256, ymm1, ynm2 mask in ymm17. 
VEX.128.66.0F38.W1 8E /r MVR | V/V AVX2 Conditionally store qword values from xmm2 using 
VPMASKMOVQ m128, xmm1, xmm2 mask in xmm7. 
VEX.256.66.0F38.W1 8E /r MVR | V/V AVX2 Conditionally store qword values from ymm2 using 
VPMASKMOVQ m256, ymm1, ymm2 mask in ymm17. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVM ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
MVR ModRM:r/m (w) VEX.vvvv (r) ModRM:reg (r) NA 

Description 


Conditionally moves packed data elements from the second source operand into the corresponding data element 
of the destination operand, depending on the mask bits associated with each data element. The mask bits are 
specified in the first source operand. 


The mask bit for each data element is the most significant bit of that element in the first source operand. If a mask 
is 1, the corresponding data element is copied from the second source operand to the destination operand. If the 
mask is 0, the corresponding data element is set to zero in the load form of these instructions, and unmodified in 
the store form. 


The second source operand is a memory address for the load form of these instructions. The destination operand 
is a memory address for the store form of these instructions. The other operands are either XMM registers (for 
VEX.128 version) or YMM registers (for VEX.256 version). 


Faults occur only due to mask-bit required memory accesses that caused the faults. Faults will not occur due to 
referencing any memory location if the corresponding mask bit for that memory location is 0. For example, no 
faults will be detected if the mask bits are all zero. 


Unlike previous MASKMOV instructions (MASKMOVQ and MASKMOVDQU), a nontemporal hint is not applied to 
these instructions. 


Instruction behavior on alignment check reporting with mask bits of less than all 1s are the same as with mask bits 
of all 1s. 
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INSTRUCTION SET REFERENCE, V-Z 


VMASKMOV should not be used to access memory mapped I/O as the ordering of the individual loads or stores it 
does is implementation specific. 

In cases where mask bits indicate data should not be loaded or stored paging A and D bits will be set in an imple- 
mentation dependent way. However, A and D bits are always set for pages where data is actually loaded/stored. 
Note: for load forms, the first source (the mask) is encoded in VEX.vvvv; the second source is encoded in rm_field, 
and the destination register is encoded in reg_field. 


Note: for store forms, the first source (the mask) is encoded in VEX.vvvv; the second source register is encoded in 
reg_field, and the destination memory location is encoded in rm_field. 


Operation 


VPMASKMOVD - 256-bit load 

DEST[31:0] := IF (SRC1[31]) Load_32(mem) ELSE 0 
DEST[63:32] := IF (SRC1[63]) Load_32(mem + 4) ELSE O 
DEST[95:64] := IF (SRC1[95]) Load_32(mem + 8) ELSE 0 
DEST[127:96] := IF (SRC1[127]) Load_32(mem + 12) ELSE O 
DEST[159:128] := IF (SRC1[159]) Load_32(mem + 16) ELSE 0 
DEST[191:160] := IF (SRC1[191]) Load_32(mem + 20) ELSE 0 
DEST[223:192] := IF (SRC1[223]) Load_32(mem + 24) ELSE 0 
DEST[255:224] := IF (SRC1[255]) Load_32(mem + 28) ELSE 0 


VPMASKMOVD -128-bit load 

DEST[31:0] := IF (SRC1[31]) Load_32(mem) ELSE 0 
DEST[63:32] := IF (SRC1[63]) Load_32(mem + 4) ELSE O 
DEST[95:64] := IF (SRC1[95]) Load_32(mem + 8) ELSE 0 
DEST[127:97] := IF (SRC1[127]) Load_32(mem + 12) ELSE O 
DEST[MAXVL-1:128] := 0 


VPMASKMOVQ - 256-bit load 

DEST[63:0] := IF (SRC1[63]) Load_64(mem) ELSE O 
DEST[127:64] := IF (SRC1[127]) Load_64(mem + 8) ELSE 0 
DEST[195:128] := IF (SRC1[191]) Load_64(mem + 16) ELSE 0 
DEST[255:196] := IF (SRC1[255]) Load_64(mem + 24) ELSE 0 


VPMASKMOVQ - 128-bit load 

DEST[63:0] := IF (SRC1[63]) Load_64(mem) ELSE 0 
DEST[127:64] := IF (SRC1[127]) Load_64(mem + 16) ELSE O 
DEST[MAXVL-1:128] := 0 


VPMASKMOVD - 256-bit store 

IF (SRC1[31]) DEST[31:0] := SRC2[31:0] 

IF (SRC1[63]) DEST[63:32] = SRC2[63:32] 

IF (SRC1[95]) DEST[95:64] := SRC2[95:64] 

IF (SRC1[127]) DEST[127:96] := SRC2[127:96] 

IF (SRC1[159]) DEST[159:1 28] :-=SRC2[159:128] 
IF (SRC1[191]) DEST[191:160] := SRC2[191:160] 
IF (SRC1[223]) DEST[223:1 92] := SRC2[223:192] 
IF (SRC1[255]) DEST[255:224] := SRC2[255:224] 


a a) 
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VPMASKMOVD - 128-bit store 
IF (SRC1[31]) DEST[31:0] := SRC2[31:0] 

IF (SRC1[63]) DEST[63:32] = SRC2[63:32] 

IF (SRC1[95]) DEST[95:64] := SRC2[95:64] 

IF (SRC1[127]) DEST[127:96] := SRC2[127:96] 


VPMASKMOVQ - 256-bit store 
IF (SRC1[63]) DEST[63:0] := SRC2[63:0] 

IF (SRC1[127]) DEST[127:64] :=SRC2[127:64] 

IF (SRC1[191]) DEST[191:128] := SRC2[191:128] 
IF (SRC1[255]) DEST[255:192] := SRC2[255:192] 


VPMASKMOVQ - 128-bit store 

IF (SRC1[63]) DEST[63:0] := SRC2[63:0] 

IF (SRC1[127]) DEST[127:64] :=SRC2[127:64] 

Intel C/C++ Compiler Intrinsic Equivalent 

VPMASKMOVD: __m256i _mm256_maskload_epi32(int const *a, __m256i mask) 
VPMASKMOVD: void _mm256_maskstore_epi32(int *a,__m256i mask, __m256i b) 
VPMASKMOVQ: __m256i _mm256_maskload_epi64(__int64 const *a, __m256i mask); 
VPMASKMOVQ: void +_mm256_maskstore_epi64(__int64 *a,___ m256i mask, __m256d b); 
VPMASKMOVD: __m128i__mm_maskload_epi32(int const *a,__m128i mask) 
VPMASKMOVD: void +_mm_maskstore_epi32(int *a,__m128i mask, __m128 b) 
VPMASKMOVQ: __m128i __mm_maskload_epi64(__int cont *a, __m128i mask); 
VPMASKMOVQ: void +=_mm_maskstore_epi64(__int64 *a,__m128i mask, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


INSTRUCTION SET REFERENCE, V-Z 


See Table 2-23, “Type 6 Class Exception Conditions” (No AC# reported for any mask bit combinations). 
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Vol.2C 5-425 


INSTRUCTION SET REFERENCE, V-Z 


VPMOVB2M/VPMOVW2M/VPMOVD2M/VPMOVQ2M—Convert a Vector Register to a Mask 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.F3.0F38.W0 29 /r RM VIV AVX512VL | Sets each bit ink1 to 1 or O based on the value of the most 
VPMOVBeM k1, xmm1 AVX512BW | significant bit of the corresponding byte in XMM1. 
EVEX.256.F3.0F38.W0 29 /r RM VIV AVX512VL_ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVBeM k1, ymm1 AVX512BW | significant bit of the corresponding byte in YMM1. 
EVEX.512.F3.0F38.W0 29 /r RM VIV AVX512BW | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVB2M k1, zmm1 significant bit of the corresponding byte in ZMM1. 
EVEX.128.F3.0F38.W1 29 /r RM VIV AVX512VL_ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVWeM k1, xmm1 AVX512BW | significant bit of the corresponding word in XMM1. 
EVEX.256.F3.0F38.W1 29 /r RM VIV AVX512VL_ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVWe2M k1, ymm1 AVX512BW | significant bit of the corresponding word in YMM1. 
EVEX.512.F3.0F38.W1 29 /r RM VIV AVX512BW | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVWeM k1, zmm1 significant bit of the corresponding word in ZMM1. 
EVEX.128.F3.0F38.W0 39 /r RM VIV AVX512VL_ | Sets each bit ink1 to 1 or O based on the value of the most 
VPMOVD2M k1, xmm1 AVX512DQ_ | significant bit of the corresponding doubleword in XMM1. 
EVEX.256.F3.0F38.W0 39 /r RM VIV AVX512VL | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVD2M k1, ymm1 AVX512DQ_ | significant bit of the corresponding doubleword in YMM1. 
EVEX.512.F3.0F38.W0 39 /r RM VN AVX512DQ_ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVD2M k1, zmm1 significant bit of the corresponding doubleword in ZMM1. 
EVEX.128.F3.0F38.W1 39 /r RM VIV AVX512VL_ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVQ2M k1, xmm1 AVX512DQ_ | significant bit of the corresponding quadword in XMM1. 
EVEX.256.F3.0F38.W1 39 /r RM VIV AVX512VL | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVQ2M k1, ymm1 AVX512DQ_ | significant bit of the corresponding quadword in YMM1. 
EVEX.512.F3.0F38.W1 39 /r RM VIN AVX512DQ | Sets each bit in k1 to 1 or O based on the value of the most 
VPMOVQ2M k1, zmm1 significant bit of the corresponding quadword in ZMM1. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a vector register to a mask register. Each element in the destination register is set to 1 or O depending on 


the value of most significant bit of the corresponding element in the source register. 


The source operand is a ZMM/YMM/XMM register. The destination operand is a mask register. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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VPMOVB2M/VPMOVW2M/VPMOVD2M/VPMOVQ2M—Convert a Vector Register to a Mask 


Operation 


VPMOVB2M (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF SRC[i+7] 
THEN -DEST{[j] := 1 
ELSE DEST{[j] := 0 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPMOVWeM (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF SRC[i+15] 
THEN -DEST[j] := 1 
ELSE DEST[j] := 0 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPMOVD2M (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF SRC[i+31] 
THEN DEST{[j] := 1 
ELSE DEST{[j] := 0 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPMOVQ2M (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF SRC[i+63] 
THEN -DEST{[j] := 1 
ELSE DEST{[j] := 0 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPMOVB2M/VPMOVW2M/VPMOVD2M/VPMOVQ2M—Convert a Vector Register to a Mask 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-427 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 


VPMPOVB2M __mmask64 _mm512_movepi8_mask(__m512i ); 
VPMPOVD2M __mmask16 __mm512_movepi32_mask(__m512i); 
VPMPOVQ2M __mmask8 _mm512_movepi64_mask(__m512i ); 
VPMPOVW2M __mmask32 _mm512_movepi16_mask(__m512i ); 
VPMPOVB2M __mmask32 _mm256_movepi8_mask(__m256i ); 
VPMPOVD2M __mmask8 _mm256_movepi32_mask(__m256i ); 
VPMPOVQ2M __mmask8 _mm256_movepi64_mask( __m256i ); 
VPMPOVW2M __mmask16 _mm256_movepi16_mask(__m256i ); 
VPMPOVB2M __mmask16 _mm_movepi8_mask(__m128i ); 
VPMPOVD2M __mmask8 _mm_movepi32_mask(__m128i ); 
VPMPOVQ2M __mmask8 _mm_movepi64_mask( __m128i ); 
VPMPOVW2M __mmask8 _mm_movepi16_mask(__m128i ); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-55, “Type E7NM Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMOVDB/VPMOVSDB/VPMOVUSDB—Down Convert DWord to Byte 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.F3.0F38.W0 31 /r A VIV AVX512VL | Converts 4 packed double-word integers from xmm2 
VPMOVDB xmm1/m32 {k1}{z}, xmm2 AVX512F into 4 packed byte integers in xmm1/m32 with 
truncation under writemask k1. 
EVEX.128.F3.0F38.W0 21 /r A VIV AVX512VL | Converts 4 packed signed double-word integers from 
VPMOVSDB xmm1/m32 {k1}{z}, xmm2 AVX512F Xmm_z into 4 packed signed byte integers in 
xmm1/m32 using signed saturation under writemask 
k1. 
EVEX.128.F3.0F38.W0 11 /r A VIV AVX512VL | Converts 4 packed unsigned double-word integers 
VPMOVUSDB xmm1/m32 {k1}{z}, AVX512F from xmm_2 into 4 packed unsigned byte integers in 
xmm2 xmm1/m32 using unsigned saturation under 
writemask k1. 
EVEX.256.F3.0F38.W0 31 /r A VIV AVX512VL | Converts 8 packed double-word integers from ymm2 
VPMOVDB xmm1/m64 {k1}{z}, ynm2 AVX512F into 8 packed byte integers in xmm1/m64 with 
truncation under writemask k1. 
EVEX.256.F3.0F38.W0 21 /r A VIV AVX512VL | Converts 8 packed signed double-word integers from 
VPMOVSDB xmm1/m64 {k1}{z}, ymm2 AVX512F ymm_2 into 8 packed signed byte integers in 
xmm1/m64 using signed saturation under writemask 
k1. 
EVEX.256.F3.0F38.W0 11 /r A VIV AVX512VL | Converts 8 packed unsigned double-word integers 
VPMOVUSDB xmm1/m64 {k1}{z}, ymm2 AVX512F from ymm_2 into 8 packed unsigned byte integers in 
xmm1/m64 using unsigned saturation under 
writemask k1. 
EVEX.512.F3.0F38.W0 31 /r A VIV AVX512F Converts 16 packed double-word integers from zmm2 
VPMOVDB xmm1/m128 {k1}{z}, zmm2 into 16 packed byte integers in xmm1/m128 with 
truncation under writemask k1. 
EVEX.512.F3.0F38.W0 21 /r A VIV AVX512F Converts 16 packed signed double-word integers 
VPMOVSDB xmm1/m128 {k1}{z}, zmm2 from zmm2 into 16 packed signed byte integers in 
xmm1/m128 using signed saturation under 
writemask k1. 
EVEX.512.F3.0F38.W0 11 /r A VIV AVX512F Converts 16 packed unsigned double-word integers 
VPMOVUSDB xmm1/m128 {k1}{z}, from zmm2 into 16 packed unsigned byte integers in 
zmm2 xmm1/m128 using unsigned saturation under 
writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Quarter Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVDB down converts 32-bit integer elements in the source operand (the second operand) into packed bytes 
using truncation. VPMOVSDB converts signed 32-bit integers into packed signed bytes using signed saturation. 
VPMOVUSDB convert unsigned double-word values into unsigned byte values using unsigned saturation. 


The source operand is a ZMM/YMM/XMM register. The destination operand is a XMM register or a 128/64/32-bit 


memory location. 


Down-converted byte elements are written to the destination operand (the first operand) from the least-significant 
byte. Byte elements of the destination operand are updated according to the writemask. Bits (MAXVL-1:128/64/32) 


of the register destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPMOVDB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TruncateDoublewordToByte (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 


VPMOVDB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TruncateDoublewordToByte (SRC[m+31:m]) 
ELSE *DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVSDB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateSignedDoubleWordToByte (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 


5-430 Vol. 2C VPMOVDB/VPMOVSDB/VPMOVUSDB—Down Convert DWord to Byte 


INSTRUCTION SET REFERENCE, V-Z 


VPMOVSDB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateSignedDoublewordToByte (SRC[m+31:m]) 
ELSE *DEST[i+7:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR 


VPMOVUSDB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedDoubleWordToByte (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 


VPMOVUSDB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedDoubleWordToByte (SRC[m+31:m]) 
ELSE *DEST[i+7:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 


VPMOVDB __m128i_mm512_cvtepi32_epi8(_m512i a); 

VPMOVDB __m128i_mm512_mask_cvtepi32_epi8(__m128is,__ mmask16 k, 
VPMOVDB __m128i_mm512_maskz_cvtepi32_epi8(__ mmask16 k,___m512i a); 
VPMOVDB void __mm512_mask_cvtepi32_storeu_epi8(void * d,__ mmask16 k, 
VPMOVSDB __m128i__mm512_cvtsepi32_epi8(__m512i a); 

VPMOVSDB __m128i __mm512_mask_cvtsepi32_epi8(__m128is,___ mmask16 k, 
VPMOVSDB __m128i__mm512_maskz_cvtsepi32_epi8(__ mmask16 k, __m512i a); 
VPMOVSDB void __mm512_mask_cvtsepi32_storeu_epi8(void * d,__ mmask16 k, __m512i a); 
VPMOVUSDB __m128i_mm512_cvtusepi32_epi8(__m512i a); 


m512i a); 


m512i a); 


m512i a); 


VPMOVUSDB __m128i_mm512_mask_cvtusepi32_epi8(__m128is,__ mmask16 k, __m512i a); 
VPMOVUSDB __m128i_mm512_maskz_cvtusepi32_epi8(__ mmask16 k, __m512i a); 
VPMOVUSDB void __mm512_mask_cvtusepi32_storeu_epi8(void * d,__ mmask16 k,__m512i a); 
VPMOVUSDB __m128i __mm256_cvtusepi32_epi8(__m256i a); 

VPMOVUSDB __m128i_mm256_mask_cvtusepi32_epi8(__m128i a,__ mmask8 k, __m256i b); 


VPMOVUSDB __m128i __mm256_maskz_cvtusepi32_epi8(__mmask8 k, __m256i b); 
VPMOVUSDB void _mm256_mask_cvtusepi32_storeu_epi8(void * , _ mmask8 k, __m256i b); 
VPMOVUSDB __m128i__mm_cvtusepi32_epi8(__m128i a); 

VPMOVUSDB __m128i__mm_mask_cvtusepi32_epi8(__m128i a,__ mmask8 k,___m128i b); 
VPMOVUSDB __m128i __mm_maskz_cvtusepi32_epi8(__ mmask8 k, __m128i b); 


VPMOVUSDB void _mm_mask_cvtusepi32_storeu_epi8(void * ,__ mmask8 k, __m128i b); 
VPMOVSDB __m128i__mm256_cvtsepi32_epi8(__m256i a); 
VPMOVSDB __m128i__mm256_mask_cvtsepi32_epi8(__m128i a,__ mmask8 k, __m256i b); 


VPMOVSDB __m128i__mm256_maskz_cvtsepi32_epi8(__mmask8 k, __m256i b); 


VPMOVSDB void _mm256_mask_cvtsepi32_storeu_epi8(void * , _ mmask8 k, __ m256i b); 
VPMOVSDB __m128i__mm_cvtsepi32_epi8(__m128i a); 
VPMOVSDB __m128i __mm_mask_cvtsepi32_epi8(__m128i a,__ mmask8 k, __m128i b); 


VPMOVSDB __m128i __mm_maskz_cvtsepi32_epi8(___mmask8 k, __m128i b); 
VPMOVSDB void _mm_mask_cvtsepi32_storeu_epi8(void *, _ mmask8 k, __m128i b); 
VPMOVDB __m128i _mm256_cvtepi32_epi8(__m256i a); 


VPMOVDB __m128i_mm256_mask_cvtepi32_epi8(__m128i a,__mmask8 k, __ m256i b); 
VPMOVDB __m128i_mm256_maskz_cvtepi32_epi8(___mmask8 k, __m256i b); 
VPMOVDB void _mm256_mask_cvtepi32_storeu_epi8(void * , __ mmask8 k, __ m256i b); 
VPMOVDB __m128i _mm_cvtepi32_epi8(__m128i a); 

VPMOVDB __m128i_mm_mask_cvtepi32_epi8(__m128i a,__mmask8 k, __m128i b); 
VPMOVDB __m128i_mm_maskz_cvtepi32_epi8(__mmask8 k, __m128i b); 

VPMOVDB void _mm_mask_cvtepi32_storeu_epi8(void * ,__ mmask8 k, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMOVDW/VPMOVSDW/VPMOVUSDW—Down Convert DWord to Word 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.F3.0F38.W0 33 /r A VIV AVX512VL | Converts 4 packed double-word integers from 
VPMOVDW xmm1/m64 {k1}{z}, xmm2 AVX512F xmm_2 into 4 packed word integers in xmm1/m64 

with truncation under writemask k1. 

EVEX.128.F3.0F38.W0 23 /r A VIV AVX512VL | Converts 4 packed signed double-word integers 
VPMOVSDW xmm1/m64 {k1}{z}, xmm2 AVX512F from xmm_2 into 4 packed signed word integers in 


ymm1/m64 using signed saturation under 
writemask k1. 

EVEX.128.F3.0F38.W0 13 /r A VIV AVX512VL | Converts 4 packed unsigned double-word integers 
VPMOVUSDW xmm1/m64 {k1}{z}, xmm2 AVX512F from xmm_2 into 4 packed unsigned word integers 
in xmm1/m64 using unsigned saturation under 
writemask k1. 


EVEX.256.F3.0F38.W0 33 /r A VIV AVX512VL | Converts 8 packed double-word integers from 
VPMOVDW xmm1/m128 {k1}{z}, ymm2 AVX512F ymm_e into 8 packed word integers in xmm1/m128 
with truncation under writemask k1. 
EVEX.256.F3.0F38.W0 23 /r A VIV AVX512VL | Converts 8 packed signed double-word integers 
VPMOVSDW xmm1/m128 {k1}{z}, ymm2 AVX512F from ymm_2 into 8 packed signed word integers in 


xmm1/m128 using signed saturation under 
writemask k1. 


EVEX.256.F3.0F38.W0 13 /r A VIV AVX512VL | Converts 8 packed unsigned double-word integers 
VPMOVUSDW xmm1/m128 {k1}{z}, AVX512F from ymm_2 into 8 packed unsigned word integers 
ymm2 in xmm1/m128 using unsigned saturation under 
writemask k1. 
EVEX.512.F3.0F38.W0 33 /r A VIV AVX512F Converts 16 packed double-word integers from 
VPMOVDW ymm1/m256 {k1}{z}, zmm2 zmm_z into 16 packed word integers in 
ymm1/m256 with truncation under writemask k1. 
EVEX.512.F3.0F38.W0 23 /r A VIV AVX512F Converts 16 packed signed double-word integers 
VPMOVSDW ymm1/m256 {k1}{z}, zmm2 from zmm2 into 16 packed signed word integers in 


ymm1/m256 using signed saturation under 
writemask k1. 


EVEX.512.F3.0F38.W0 13 /r A VIV AVX512F Converts 16 packed unsigned double-word integers 
VPMOVUSDW ymm1/m256 {k1}{z}, from zmm_2 into 16 packed unsigned word integers 
zmm2 in ynm1/m256 using unsigned saturation under 


writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVDW down converts 32-bit integer elements in the source operand (the second operand) into packed words 
using truncation. VPMOVSDW converts signed 32-bit integers into packed signed words using signed saturation. 
VPMOVUSDW convert unsigned double-word values into unsigned word values using unsigned saturation. 


The source operand is a ZMM/YMM/XMM register. The destination operand is a YMM/XMM/XMM register or a 
256/128/64-bit memory location. 


Down-converted word elements are written to the destination operand (the first operand) from the least-significant 
word. Word elements of the destination operand are updated according to the writemask. Bits (MAXVL- 
1:256/128/64) of the register destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPMOVDW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] = TruncateDoublewordToWord (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 


VPMOVDW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j*16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] = TruncateDoublewordToWord (SRC[m+31:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_; merging-masking 
Fl; 
ENDFOR 


VPMOVSDW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j* 16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] := SaturateSignedDoubleWordToWord (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 
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VPMOVSDW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] := SaturateSignedDoublewordToWord (SRC[m+31:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_ ; merging-masking 
Fl; 
ENDFOR 


VPMOVUSDW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1 
i:=j*16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+1 5:i] := SaturateUnsignedDoubleWordToWord (SRC[m+31:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 


VPMOVUSDW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] := SaturateUnsignedDoubleWordToWord (SRC[m+31:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_; merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 
VPMOVDW __m256i_mm512_cvtepi32_epil16(__m512i a); 


VPMOVDW __m256i__mm512_mask_cvtepi32_epi16(__m256i s,___ mmask16 k,___m512i a); 
VPMOVDW __m256i_mm512_maskz_cvtepi32_epi16(__mmask16 k,___m512i a); 
VPMOVDW void _mm512_mask_cvtepi32_storeu_epi16(void * d,__ mmask16 k,___m512i a); 
VPMOVSDW __m256i_mm512_cvtsepi32_epi16(__m512i a); 

VPMOVSDW __m256i_mm512_mask_cvtsepi32_epi16(__m256is,__ mmask16 k,___m512i a); 
VPMOVSDW __m256i_mm512_maskz_cvtsepi32_epi16(__ mmask16 k,__m512i a); 
VPMOVSDW void _mm512_mask_cvtsepi32_storeu_epi16(void * d,__ mmask16 k, __m512i a); 


VPMOVUSDW __m256i_mm512_cvtusepi32_epi16 __m512i a); 


VPMOVUSDW __m256i_mm512_mask_cvtusepi32_epi16(__m256is,__ mmask16 k, __m512i a); 
VPMOVUSDW __m256i_mm512_maskz_cvtusepi32_epi16(__mmask16 k,___m512i a); 
VPMOVUSDW void __mm512_mask_cvtusepi32_storeu_epi16(void * d,__ mmask16 k, __m512i a); 
VPMOVUSDW __m128i_mm256_cvtusepi32_epi16(__m256i a); 

VPMOVUSDW __m128i__mm256_mask_cvtusepi32_epi16(__m128i a,__mmask8 k, __m256i b); 


VPMOVUSDW __m128i__mm256_maskz_cvtusepi32_epi16(__ mmask8 k, __ m256i b); 
VPMOVUSDW void _mm256_mask_cvtusepi32_storeu_epi16(void * ,__ mmask8 k, __ m256i b); 
VPMOVUSDW __m128i __mm_cvtusepi32_epi16(__m128i a); 

VPMOVUSDW __m128i __mm_mask_cvtusepi32_epi16(__m128i a,___mmask8 k, 
VPMOVUSDW __m128i __mm_maskz_cvtusepi32_epi16(__mmask8 k, _m128i b); 


m128i b); 


VPMOVUSDW void _mm_mask_cvtusepi32_storeu_epi16(void * ,__ mmask8 k, __m128i b); 
VPMOVSDW __m128i_mm256_cvtsepi32_epi16(__m256i a); 
VPMOVSDW __m128i__mm256_mask_cvtsepi32_epi16(__m128i a,___ mmask8 k, __m256i b); 


VPMOVSDW __m128i__mm256_maskz_cvtsepi32_epi16(__ mmask8 k, __ m256i b); 
VPMOVSDW void __mm256_mask_cvtsepi32_storeu_epi16(void *,___ mmask8 k, __m256i b); 
VPMOVSDW __m128i__mm_cvtsepi32_epi16(__m128i a); 

VPMOVSDW __m128i__mm_mask_cvtsepi32_epi16(__m128i a,__mmask8 k, 
VPMOVSDW __m128i__mm_maskz_cvtsepi32_epi16(__ mmask8 k, __m128i b); 


m128i b); 


VPMOVSDW void _mm_mask_cvtsepi32_storeu_epi16(void *, __ mmask8 k, __m128i b); 
VPMOVDW __m128i__mm256_cvtepi32_epi16(__m256i a); 
VPMOVDW __m128i __mm256_mask_cvtepi32_epi16(__m128i a, __ mmask8 k, __m256i b); 


VPMOVDW __m128i_mm256_maskz_cvtepi32_epi16(__mmask8 k, __ m256i b); 
VPMOVDW void _mm256_mask_cvtepi32_storeu_epi16(void *,__ mmask8 k, __m256i b); 
VPMOVDW __m128i_mm_cvtepi32_epi16(__m128i a); 


VPMOVDW __m128i _mm_mask_cvtepi32_epi16(__m128i a,__ mmask8 k, __m128i b); 
VPMOVDW __m128i __mm_maskz_cvtepi32_epi16(__ mmask8 k, __m128i b); 
VPMOVDW void _mm_mask_cvtepi32_storeu_epi16(void *, __ mmask8 k, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMOVM2B/VPMOVM2W/VPMOVM2D/VPMOVM2Q—Convert a Mask Register to a Vector 


Register 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.F3.0F38.W0 28 /r RM VIV AVX512VL | Sets each byte in XMM1 to all 1’s or all O's based on the value 
VPMOVM2B xmm1, k1 AVX512BW | of the corresponding bit in k1. 
EVEX.256.F3.0F38.W0 28 /r RM VIV AVX512VL | Sets each byte in YMM1 to all 1's or all O's based on the value 
VPMOVM2B ymm1, k1 AVX512BW | of the corresponding bit in k1. 
EVEX.512.F3.0F38.W0 28 /r RM VIV AVX512BW | Sets each byte in ZMM1 to all 1's or all O's based on the value 
VPMOVM2B zmm1, k1 of the corresponding bit in k1. 
EVEX.128.F3.0F38.W1 28 /r RM VIN AVX512VL_ | Sets each word in XMM1 to all 1's or all O's based on the value 
VPMOVM2W xmm1, k1 AVX512BW | of the corresponding bit in k1. 
EVEX.256.F3.0F38.W1 28 /r RM VV AVX512VL_ | Sets each word in YMM1 to all 1’s or all O's based on the value 
VPMOVM2W ymm1, k1 AVX512BW | of the corresponding bit in k1. 
EVEX.512.F3.0F38.W1 28 /r RM VIN AVX512BW | Sets each word in ZMM1 to all 1’s or all O's based on the value 
VPMOVM2W zmm1, k1 of the corresponding bit in k1. 
EVEX.128.F3.0F38.W0 38 /r RM VIN AVX512VL_ | Sets each doubleword in XMM1 to all 1's or all O’s based on the 
VPMOVM2D xmm1, k1 AVX512DQ_ | value of the corresponding bit in k1. 
EVEX.256.F3.0F38.W0 38 /r RM VIN AVX512VL_ | Sets each doubleword in YMM1 to all 1’s or all O's based on the 
VPMOVM2D ymm1, k1 AVX512DQ_ | value of the corresponding bit in k1. 
EVEX.512.F3.0F38.W0 38 /r RM VN AVX512DQ_ | Sets each doubleword in ZMM1 to all 1's or all O’s based on the 
VPMOVM2D zmm1, k1 value of the corresponding bit in k1. 
EVEX.128.F3.0F38.W1 38 /r RM VIV AVX512VL | Sets each quadword in XMM1 to all 1's or all O’s based on the 
VPMOVM2Q xmm1, k1 AVX512DQ_ | value of the corresponding bit in k1. 
EVEX.256.F3.0F38.W1 38 /r RM VIV AVX512VL | Sets each quadword in YMM1 to all 1’s or all O's based on the 
VPMOVM2Q ymm1, k1 AVX512DQ_ | value of the corresponding bit in k1. 
EVEX.512.F3.0F38.W1 38 /r RM VV AVX512DQ | Sets each quadword in ZMM1 to all 1's or all O's based on the 
VPMOVM2Q zmm1, k1 value of the corresponding bit in k1. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Converts a mask register to a vector register. Each element in the destination register is set to all 1’s or all 0's 
depending on the value of the corresponding bit in the source mask register. 


The source operand is a mask register. The destination operand is a ZMM/YMM/XMM register. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


VPMOVM2B/VPMOVM2W/VPMOVM2D/VPMOVM2Q—Convert a Mask Register to a Vector Register 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPMOVM2B (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j :=0 TO KL-1 
i:=j*8 
IF SRC[j] 
THEN — DEST[i+7:i] := -1 
ELSE DEST[i+7:i] := 0 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVM2W (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TO KL-1 
i:=j*16 
IF SRC[j] 
THEN = DEST[i+15:i] = -1 
ELSE DEST[i+15:i] := 0 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVM2D (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF SRC[j] 
THEN —DEST[i+31:i] := -1 
ELSE DEST[i+31:i] := 0 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VPMOVM2Q (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF SRC[j] 
THEN  DEST[i+63:i] := -1 
ELSE DEST[i+63:i] := 0 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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VPMOVM2B/VPMOVM2W/VPMOVM2D/VPMOVM2Q—Convert a Mask Register to a Vector Register 


Intel C/C++ Compiler Intrinsic Equivalents 


VPMOVM2B 


m512i 


mm512_movm_epi8(__mmask64 ); 


VPMOVM2D 
VPMOVM2Q 
VPMOVM2W 
VPMOVM2B 


m512i 


m512i 


mm512_movm_epi32(__mmaské8 ); 
mm512_movm_epi64(__mmask16 ); 


m512i 


mm512_movm_epi16(__mmask32 ); 


m256i 


mm256_movm_epi8(__mmask32 ); 


VPMOVM2D 
VPMOVM2Q 
VPMOVM2W 
VPMOVM2B 


m256i 


mm256_movm_epi32(__mmask8 ); 


m256i 


mm256_movm_epi64(__mmaské8 ); 


m256i 


mm256_movm_epi16(__mmask16 ); 


m128i 


VPMOVM2D 
VPMOVM2Q 
VPMOVM2W 


m128i 


mm_movm_epi8( 
mm_movm_epi32( 


mmask16 ); 
mmask8 ); 


m128i 


mm_movm_epi64( 


mmask8 ); 


m1 28i 


mm_movm_epi1 6( 


mmask8 ); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


EVEX-encoded instruction, see Table 2-55, “Type E7NM Class Exception Conditions”; additionally: 


#UD 


VPMOVM2B/VPMOVM2W/VPMOVM2D/VPMOVM2Q—Convert a Mask Register to a Vector Register 


If EVEX.vvvv != 1111B. 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-439 


INSTRUCTION SET REFERENCE, V-Z 


VPMOVQB/VPMOVSQB/VPMOVUSQB—Down Convert QWord to Byte 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

EVEX.128.F3.0F38.W0 32 /r A VIV AVX512VL | Converts 2 packed quad-word integers from xmm2 

VPMOVQB xmm1/m16 {k1}{z}, xmm2 AVX512F into 2 packed byte integers in xmm1/m76 with 
truncation under writemask k1. 

EVEX.128.F3.0F38.W0 22 /r A VIV AVX512VL | Converts 2 packed signed quad-word integers from 

VPMOVSQB xmm1/m16 {k1}{z}, xmm2 AVX512F xmm_z into 2 packed signed byte integers in 
xmm1/m16 using signed saturation under writemask 
k1. 

EVEX.128.F3.0F38.W0 12 /r A VIV AVX512VL | Converts 2 packed unsigned quad-word integers 

VPMOVUSQB xmm1/m16 {k1}{z}, xmm2 AVX512F from xmm_2 into 2 packed unsigned byte integers in 
xmm1/m16 using unsigned saturation under 
writemask k1. 

EVEX.256.F3.0F38.W0 32 /r A VIV AVX512VL | Converts 4 packed quad-word integers from ymm2 

VPMOVQB xmm1/m32 {k1}{z}, ymm2 AVX512F into 4 packed byte integers in xmm1/m32 with 
truncation under writemask k1. 

EVEX.256.F3.0F38.W0 22 /r A VIV AVX512VL | Converts 4 packed signed quad-word integers from 

VPMOVSQB xmm1/m32 {k1}{z}, ymm2 AVX512F ymm_2 into 4 packed signed byte integers in 
xmm1/m32 using signed saturation under writemask 
k1. 

EVEX.256.F3.0F38.W0 12 /r A VIV AVX512VL | Converts 4 packed unsigned quad-word integers 

VPMOVUSQB xmm1/m32 {k1}{z}, ymm2 AVX512F from ymm_2 into 4 packed unsigned byte integers in 
xmm1/m32 using unsigned saturation under 
writemask k1. 

EVEX.512.F3.0F38.W0 32 /r A VIV AVX512F Converts 8 packed quad-word integers from zmm2 

VPMOVQB xmm1/m64 {k1}{z}, zmm2 into 8 packed byte integers in xmm1/m64 with 
truncation under writemask k1. 

EVEX.512.F3.0F38.W0 22 /r A VIV AVX512F Converts 8 packed signed quad-word integers from 

VPMOVSQB xmm1/m64 {k1}{z}, zmm2 zmm_2 into 8 packed signed byte integers in 
xmm1/m64 using signed saturation under writemask 
k1. 

EVEX.512.F3.0F38.W0 12 /r A VIV AVX512F Converts 8 packed unsigned quad-word integers 

VPMOVUSQB xmm1/m64 {k1}{z}, zmm2 from zmm2 into 8 packed unsigned byte integers in 
xmm1/m64 using unsigned saturation under 
writemask k1. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Eighth Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVQB down converts 64-bit integer elements in the source operand (the second operand) into packed byte 
elements using truncation. VPMOVSQB converts signed 64-bit integers into packed signed bytes using signed satu- 
ration. VPMOVUSQB convert unsigned quad-word values into unsigned byte values using unsigned saturation. The 
source operand is a vector register. The destination operand is an XMM register or a memory location. 


Down-converted byte elements are written to the destination operand (the first operand) from the least-significant 
byte. Byte elements of the destination operand are updated according to the writemask. Bits (MAXVL-1:64) of the 


destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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VPMOVQB/VPMOVSQB/VPMOVUSQB—Down Convert Qword to Byte 


Operation 


VPMOVQB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST{i+7:i] = TruncateQuadWordToByte (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/8] := 0; 


VPMOVQB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TruncateQuadWordToByte (SRC[m+63:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; Merging-masking 
Fl; 
ENDFOR 


VPMOVSQB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateSignedQuadWordToByte (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/8] := 0; 


VPMOVQB/VPMOVSQB/VPMOVUSQB—Down Convert QWord to Byte 


INSTRUCTION SET REFERENCE, V-Z 
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INSTRUCTION SET REFERENCE, V-Z 


VPMOVSQB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateSignedQuadWordToByte (SRC[m+63:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVUSQB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedQuadwordToByte (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/8] := 0; 


VPMOVUSQB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*8 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedQuadwordToByte (SRC[m+63:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 
VPMOVQB __m128i __mm512_cvtepi64_epi8(_m512i a); 


VPMOVQB __m128i__mm512_mask_cvtepi64_epi8(__m128i s,__ mmask8 k, 
VPMOVQB __m128i __mm512_maskz_cvtepi64_epi8(___mmask8 k, __m512i a); 


m512i a); 


VPMOVOQB void _mm512_mask_cvtepi64_storeu_epi8(void * d,___mmask8 k, __m512i a); 
VPMOVSQB __m128i__mm512_cvtsepi64_epi8(__m512i a); 
VPMOVSQB __m128i__mm512_mask_cvtsepi64_epi8(__m128i s,___mmask8 k, __m512i a); 


VPMOVSQB __m128i__mm512_maskz_cvtsepi64_epi8(__mmask8 k, __m512i a); 
VPMOVSQB void __mm512_mask_cvtsepi64_storeu_epi8(void * d,___mmask8 k, __m512i a); 
VPMOVUSQB __m128i __mm512_cvtusepi64_epi8( __m512i a); 

VPMOVUSQB __m128i_mm512_mask_cvtusepi64_epi8(__m128is,__ mmask8 k, 
VPMOVUSQB __m128i__mm512_maskz_cvtusepi64_epi8(_mmask8 k, __m512i a); 


m512i a); 


VPMOVUSQB void __mm512_mask_cvtusepi64_storeu_epi8(void * d,__ mmask8 k, __m512i a); 
VPMOVUSQB __m128i__mm256_cvtusepi64_epi8(__m256i a); 
VPMOVUSQB __m128i __mm256_mask_cvtusepi64_epi8(__m128i a, ___mmask8 k, __m256i b); 


VPMOVUSQB __m128i __mm256_maskz_cvtusepi64_epi8(__mmask8 k, __m256i b); 
VPMOVUSQB void _mm256_mask_cvtusepi64_storeu_epi8(void * , __ mmask8 k, __m256i b); 
VPMOVUSQB __m128i__mm_cvtusepi64_epi8(__m128i a); 


VPMOVUSQB __m128i __mm_mask_cvtusepi64_epi8(__m128i a, __ mmask8 k, __m128i b); 
VPMOVUSQB __m128i __mm_maskz_cvtusepi64_epi8(_mmask8 k, __m128i b); 
VPMOVUSQB void _mm_mask_cvtusepi64_storeu_epi8(void * , __ mmask8 k, __m128i b); 


VPMOVSQB __m128i__mm256_cvtsepi64_epi8(__m256i a); 

VPMOVSQB __m128i__mm256_mask_cvtsepi64_epi8(__m128i a, __ mmask8 k, __m256i b); 
VPMOVSQB __m128i __mm256_maskz_cvtsepi64_epi8(__mmask8 k, __m256i b); 
VPMOVSQB void __mm256_mask_cvtsepi64_storeu_epi8(void * , __ mmask8 k, __m256i b); 
VPMOVSQB __m128i __mm_cvtsepi64_epi8(__m128i a); 

VPMOVSQB __m128i __mm_mask_cvtsepi64_epi8(__m128i a, __mmask8 k, __m128i b); 
VPMOVSQB __m128i __mm_maskz_cvtsepi64_epi8(__mmask8 k, __m128i b); 

VPMOVSQB void _mm_mask_cvtsepi64_storeu_epi8(void * , __ mmask8 k, __m128i b); 
VPMOVOQB __m128i __mm256_cvtepi64_epi8(__m256i a); 

VPMOVQB __m128i __mm256_mask_cvtepi64_epi8(__m128i a,__mmask8 k, 
VPMOVQB __m128i _mm256_maskz_cvtepi64_epi8(___mmask8 k, __m256i b); 
VPMOVOQB void _mm256_mask_cvtepi64_storeu_epi8(void * ,___mmask8 k, __m256i b); 
VPMOVQB __m128i __mm_cvtepi64_epi8(__m128i a); 

VPMOVQB __m128i __mm_mask_cvtepi64_epi8(__m128i a,__mmask8 k, 
VPMOVQB __m128i _mm_maskz_cvtepi64_epi8(_mmask8 k, __m128i b); 
VPMOVOQB void _mm_mask_cvtepi64_storeu_epi8(void * , _ mmask8 k, __m128i b); 


m256i b); 


m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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INSTRUCTION SET REFERENCE, V-Z 


VPMOVQD/VPMOVSQD/VPMOVUSQD—Down Convert QWord to DWord 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.F3.0F38.W0 35 /r A VIV AVX512VL | Converts 2 packed quad-word integers from xmm2 
VPMOVQD xmm1/m128 {k1}{z}, xmm2 AVX512F into 2 packed double-word integers in xmm1/m128 

with truncation subject to writemask k1. 

EVEX.128.F3.0F38.W0 25 /r A VIV AVX512VL | Converts 2 packed signed quad-word integers from 
VPMOVSQD xmm1/m64 {k1}{z}, xmm2 AVX512F xmm_2 into 2 packed signed double-word integers 


in xmm1/m64 using signed saturation subject to 

writemask k1. 

EVEX.128.F3.0F38.W0 15 /r A VIV AVX512VL | Converts 2 packed unsigned quad-word integers 

VPMOVUSQD xmm1/m64 {k1}{z}, xmm2 AVX512F from xmm_2 into 2 packed unsigned double-word 

integers in xmm1/m64 using unsigned saturation 
subject to writemask k1. 


EVEX.256.F3.0F38.W0 35 /r A VIV AVX512VL | Converts 4 packed quad-word integers from ymm2 
VPMOVQD xmm1/m128 {k1}{z}, ynm2 AVX512F into 4 packed double-word integers in xmm1/m128 
with truncation subject to writemask k1. 
EVEX.256.F3.0F38.W0 25 /r A VIV AVX512VL | Converts 4 packed signed quad-word integers from 
VPMOVSQD xmm1/m128 {k1}{z}, ymm2 AVX512F ymm_e into 4 packed signed double-word integers in 


xmm1/m128 using signed saturation subject to 
writemask k1. 

EVEX.256.F3.0F38.W0 15 /r A VIV AVX512VL | Converts 4 packed unsigned quad-word integers 
VPMOVUSQD xmm1/m128 {k1}{z}, ynm2 AVX512F from ymm_2 into 4 packed unsigned double-word 
integers in xmm1/m128 using unsigned saturation 
subject to writemask k1. 


EVEX.512.F3.0F38.W0 35 /r A VIV AVX512F Converts 8 packed quad-word integers from zmm2 
VPMOVQD ymm1/m256 {k1}{z}, zmm2 into 8 packed double-word integers in ynm1/m256 
with truncation subject to writemask k1. 
EVEX.512.F3.0F38.W0 25 /r A VIV AVX512F Converts 8 packed signed quad-word integers from 
VPMOVSQD ymm1/m256 {k1}{z}, zmm2 zmm_2 into 8 packed signed double-word integers in 


ymm1/m256 using signed saturation subject to 
writemask k1. 

EVEX.512.F3.0F38.W0 15 /r A VIV AVX512F Converts 8 packed unsigned quad-word integers 
VPMOVUSQD ymm1/m256 {k1}{z}, zmm2 from zmm2 into 8 packed unsigned double-word 
integers in ymm1/m256 using unsigned saturation 
subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVQW down converts 64-bit integer elements in the source operand (the second operand) into packed double- 
words using truncation. VPMOVSQW converts signed 64-bit integers into packed signed doublewords using signed 
saturation. VPMOVUSQW convert unsigned quad-word values into unsigned double-word values using unsigned 
saturation. 


The source operand is a ZMM/YMM/XMM register. The destination operand is a YMM/XMM/XMM register or a 
256/128/64-bit memory location. 


Down-converted doubleword elements are written to the destination operand (the first operand) from the least- 
significant doubleword. Doubleword elements of the destination operand are updated according to the writemask. 
Bits (MAXVL-1:256/128/64) of the register destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VPMOVQD instruction (EVEX encoded version) reg-reg form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TruncateQuadWordToDWord (SRC[m+63:m]) 
ELSE *zeroing-masking* ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL/2] := 0; 


VPMOVQD instruction (EVEX encoded version) memory form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TruncateQuadwordToDWord (SRC[m+63:m]) 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVSQD instruction (EVEX encoded version) reg-reg form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j* 32 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = SaturateSignedQuadWordToDWord (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 
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VPMOVSQD instruction (EVEX encoded version) memory form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := SaturateSignedQuadWordToDWord (SRC[m+63:m]) 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVUSQD instruction (EVEX encoded version) reg-reg form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j* 32 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := SaturateUnsignedQuadWordToDWord (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 


VPMOVUSQD instruction (EVEX encoded version) memory form 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j* 32 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := SaturateUnsignedQuadWordToDWord (SRC[m+63:m]) 
ELSE *DEST[i+31:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 


VPMOVQD __m256i__mm512_cvtepi64_epi32(__m512i a); 

VPMOVQD __m256i_mm512_mask_cvtepi64_epi32(__m256i s,___ mmask8 k, 
VPMOVQD __m256i__mm512_maskz_cvtepi64_epi32(_mmask8 k, __m512i a); 

VPMOVQD void __mm512_mask_cvtepi64_storeu_epi32(void * d,__mmask8 k, __m512i a); 
VPMOVSQD __m256i __mm512_cvtsepi64_epi32(__m512i a); 

VPMOVSQD __m256i__mm512_mask_cvtsepi64_epi32(__m256i s,___mmask8 k, __m512i a); 
VPMOVSQD __m256i__mm512_maskz_cvtsepi64_epi32(_mmask8 k, __m512i a); 


m512i a); 


VPMOVSQD void __mm512_mask_cvtsepi64_storeu_epi32(void * d,___mmask8 k, __m512i a); 
VPMOVUSQD __m256i__mm512_cvtusepi64_epi32(_m512i a); 
VPMOVUSQD __m256i__mm512_mask_cvtusepi64_epi32(__m256i s, __mmask8 k, __m512i a); 


VPMOVUSQD __m256i __mm512_maskz_cvtusepi64_epi32(__mmask8 k, __m512i a); 
VPMOVUSQD void _mm512_mask_cvtusepi64_storeu_epi32(void * d,__ mmask8 k, __m512i a); 
VPMOVUSQD __m128i __mm256_cvtusepi64_epi32(__m256i a); 

VPMOVUSQD __m128i__mm256_mask_cvtusepi64_epi32(__m128i a,__mmask8 k, 
VPMOVUSQD __m128i _mm256_maskz_cvtusepi64_epi32(__mmask8 k, __m256i b); 
VPMOVUSQD void _mm256_mask_cvtusepi64_storeu_epi32(void * ,__ mmask8 k, __m256i b); 
VPMOVUSQD __m128i __mm_cvtusepi64_epi32(__m128i a); 

VPMOVUSQD __m128i __mm_mask_cvtusepi64_epi32(__m128i a,__ mmask8 k, 
VPMOVUSQD __m128i _mm_maskz_cvtusepi64_epi32(__mmask8 k, __m128i b); 


m256i b); 


m128i b); 


VPMOVUSQD void _mm_mask_cvtusepi64_storeu_epi32(void * , __ mmask8 k, __m128i b); 
VPMOVSQD __m128i __mm256_cvtsepi64_epi32(__m256i a); 
VPMOVSQD __m128i __mm256_mask_cvtsepi64_epi32(__m128i a, ___mmask8 k, __m256i b); 


VPMOVSQD __m128i__mm256_maskz_cvtsepi64_epi32(__mmask8 k, __m256i b); 
VPMOVSQD void _mm256_mask_cvtsepi64_storeu_epi32(void * , __ mmask8 k, __m256i b); 
VPMOVSQD __m128i__mm_cvtsepi64_epi32(__m128i a); 

VPMOVSQD __m128i __mm_mask_cvtsepi64_epi32(__m128i a,__ mmask8 k, 
VPMOVSQD __m128i__mm_maskz_cvtsepi64_epi32(__mmask8 k, __m128i b); 
VPMOVSQD void _mm_mask_cvtsepi64_storeu_epi32(void * ,__ mmask8 k, __m128i b); 
VPMOVQD __m128i __mm256_cvtepi64_epi32(__m256i a); 

VPMOVQD __m128i __mm256_mask_cvtepi64_epi32(__m128i a, __mmask8 k, __m256i b); 
VPMOVQD __m128i__mm256_maskz_cvtepi64_epi32(___mmask8 k, __m256i b); 


m128i b); 


VPMOVQD void _mm256_mask_cvtepi64_storeu_epi32(void * , __mmask8 k, __m256i b); 
VPMOVQD __m128i __mm_cvtepi64_epi32(__m128i a); 
VPMOVQD __m128i __mm_mask_cvtepi64_epi32(__m128i a,__ mmask8 k, __m128i b); 


VPMOVQD __m128i _mm_maskz_cvtepi64_epi32(__mmask8 k, __m128i b); 
VPMOVQD void _mm_mask_cvtepi64_storeu_epi32(void * , _ mmask8 k, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VPMOVQW/VPMOVSQW/VPMOVUSQW—Down Convert QWord to Word 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

EVEX.128.F3.0F38.W0 34 /r A VIV AVX512VL | Converts 2 packed quad-word integers from xmm2 

VPMOVQW xmm1/m32 {k1}{z}, xmm2 AVX512F into 2 packed word integers in xmm1/m32 with 
truncation under writemask k1. 

EVEX.128.F3.0F38.W0 24 /r A VIV AVX512VL | Converts 8 packed signed quad-word integers from 

VPMOVSQW xmm1/m32 {k1}{z}, xmm2 AVX512F zmm_2 into 8 packed signed word integers in 
xmm1/m32 using signed saturation under writemask 
k1. 

EVEX.128.F3.0F38.W0 14 /r A VIV AVX512VL | Converts 2 packed unsigned quad-word integers from 

VPMOVUSQW xmm1/m32 {k1}{z}, xmm2 AVX512F Xmm_z into 2 packed unsigned word integers in 
xmm1/m32 using unsigned saturation under 
writemask k1. 

EVEX.256.F3.0F38.W0 34 /r A VIV AVX512VL | Converts 4 packed quad-word integers from ymm2 

VPMOVQW xmm1/m64 {k1}{z}, ymm2 AVX512F into 4 packed word integers in xmm1/m64 with 
truncation under writemask k1. 

EVEX.256.F3.0F38.W0 24 /r A VIV AVX512VL | Converts 4 packed signed quad-word integers from 

VPMOVSQW xmm1/m64 {k1}{z}, ymm2 AVX512F ymm_2 into 4 packed signed word integers in 
xmm1/m64 using signed saturation under writemask 
k1. 

EVEX.256.F3.0F38.W0 14 /r A VIV AVX512VL | Converts 4 packed unsigned quad-word integers from 

VPMOVUSQW xmm1/m64 {k1}{2}, ymm2 AVX512F ymm_2 into 4 packed unsigned word integers in 
xmm1/m64 using unsigned saturation under 
writemask k1. 

EVEX.512.F3.0F38.W0 34 /r A VIV AVX512F Converts 8 packed quad-word integers from zmm2 

VPMOVQW xmm1/m128 {k1}{z}, zmm2 into 8 packed word integers in xmm1/m128 with 
truncation under writemask k1. 

EVEX.512.F3.0F38.W0 24 /r A VIV AVX512F Converts 8 packed signed quad-word integers from 

VPMOVSQW xmm1/m128 {k1}{z}, zmm2 zmm_2 into 8 packed signed word integers in 
xmm1/m128 using signed saturation under 
writemask k1. 

EVEX.512.F3.0F38.W0 14 /r A VIV AVX512F Converts 8 packed unsigned quad-word integers from 

VPMOVUSQW xmm1/m128 {k1}{z}, zmm_2 into 8 packed unsigned word integers in 

zmm2 xmm1/m128 using unsigned saturation under 
writemask k1. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Quarter Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVQW down converts 64-bit integer elements in the source operand (the second operand) into packed words 
using truncation. VPMOVSQW converts signed 64-bit integers into packed signed words using signed saturation. 
VPMOVUSQW convert unsigned quad-word values into unsigned word values using unsigned saturation. 


The source operand is a ZMM/YMM/XMM register. The destination operand is a XMM register or a 128/64/32-bit 


memory location. 


Down-converted word elements are written to the destination operand (the first operand) from the least-significant 
word. Word elements of the destination operand are updated according to the writemask. Bits (MAXVL- 
1:128/64/32) of the register destination are zeroed. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


5-448 Vol. 2C 


VPMOVQW/VPMOVSQW/VPMOVUSQW—Down Convert QWord to Word 


Operation 


VPMOVQW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] = TruncateQuadWordToWord (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 


VPMOVQW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] = TruncateQuadWordToWord (SRC[m+63:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_ ; merging-masking 
Fl; 
ENDFOR 


VPMOVSQW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m :=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST{i+15:i] = SaturateSignedQuadWordToWord (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 
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VPMOVSQW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*16 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] := SaturateSignedQuadwordToWord (SRC[m+63:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_; merging-masking 
Fl; 
ENDFOR 


VPMOVUSQW instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1 
i:=j*16 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] := SaturateUnsignedQuadWordToWord (SRC[m+63:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+15:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/4] := 0; 


VPMOVUSQW instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
m:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] := SaturateUnsignedQuadWordToWord (SRC[m+63:m]) 
ELSE 
*DEST[i+15:i] remains unchanged* —_; merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 
VPMOVQW __m128i __mm512_cvtepi64_epi16(__m512i a); 


VPMOVQW __m128i __mm512_mask_cvtepi64_epi16(__m128i s, __ mmask8 k, __m512i a); 
VPMOVQW __m128i __mm512_maskz_cvtepi64_epi16(_mmask8 k, __m512i a); 
VPMOVQW void __mm512_mask_cvtepi64_storeu_epi16(void * d,__ mmask8 k, __m512i a); 


VPMOVSQW __m128i__mm512_cvtsepi64_epi16(__m512i a); 
VPMOVSQW __m128i__mm512_mask_cvtsepi64_epi16(__m128i s,__ mmask8 k, __m512i a); 
VPMOVSQW __m128i__mm512_maskz_cvtsepi64_epi16(__mmask8 k, __m512i a); 


VPMOVSQW void __mm512_mask_cvtsepi64_storeu_epi1 6(void * d,___mmask8 k, __m512i a); 
VPMOVUSQW __m128i__mm512_cvtusepi64_epi16(__m512i a); 
VPMOVUSQW __m128i__mm512_mask_cvtusepi64_epi16(__m128i s,___ mmask8 k, __m512i a); 


VPMOVUSQW __m128i__mm512_maskz_cvtusepi64_epi16(__mmask8 k, __m512i a); 


VPMOVUSQW void _mm512_mask_cvtusepi64_storeu_epil 6(void * d, __ mmask8 k, __m512i a); 
VPMOVUSQD __m128i __mm256_cvtusepi64_epi32(__m256i a); 
VPMOVUSQD __m128i __mm256_mask_cvtusepi64_epi32(__m128i a,___mmask8 k, __m256i b); 


VPMOVUSQD __m128i _mm256_maskz_cvtusepi64_epi32(__mmask8 k, __m256i b); 
VPMOVUSQD void _mm256_mask_cvtusepi64_storeu_epi32(void * ,__ mmask8 k, __m256i b); 
VPMOVUSQD __m128i __mm_cvtusepi64_epi32(__m128i a); 

VPMOVUSQD __m128i __mm_mask_cvtusepi64_epi32(__m128i a,__ mmask8 k, 
VPMOVUSQD __m128i _mm_maskz_cvtusepi64_epi32(__mmask8 k, __m128i b); 


m128i b); 


VPMOVUSQD void _mm_mask_cvtusepi64_storeu_epi32(void * , __ mmask8 k, __m128i b); 
VPMOVSQD __m128i __mm256_cvtsepi64_epi32(__m256i a); 
VPMOVSQD __m128i __mm256_mask_cvtsepi64_epi32(__m128i a, ___mmask8 k, __m256i b); 


VPMOVSQD __m128i__mm256_maskz_cvtsepi64_epi32(__mmask8 k, __m256i b); 
VPMOVSQD void _mm256_mask_cvtsepi64_storeu_epi32(void * , __ mmask8 k, __m256i b); 
VPMOVSQD __m128i__mm_cvtsepi64_epi32(__m128i a); 

VPMOVSQD __m128i __mm_mask_cvtsepi64_epi32(__m128i a,__ mmask8 k, 
VPMOVSQD __m128i__mm_maskz_cvtsepi64_epi32(__mmask8 k, __m128i b); 
VPMOVSQD void _mm_mask_cvtsepi64_storeu_epi32(void * ,__ mmask8 k, __m128i b); 
VPMOVQD __m128i __mm256_cvtepi64_epi32(__m256i a); 

VPMOVQD __m128i __mm256_mask_cvtepi64_epi32(__m128i a, __mmask8 k, __m256i b); 
VPMOVQD __m128i__mm256_maskz_cvtepi64_epi32(___mmask8 k, __m256i b); 


m128i b); 


VPMOVQD void _mm256_mask_cvtepi64_storeu_epi32(void * , __mmask8 k, __m256i b); 
VPMOVQD __m128i __mm_cvtepi64_epi32(__m128i a); 
VPMOVQD __m128i __mm_mask_cvtepi64_epi32(__m128i a,__ mmask8 k, __m128i b); 


VPMOVQD __m128i _mm_maskz_cvtepi64_epi32(__mmask8 k, __m128i b); 
VPMOVQD void _mm_mask_cvtepi64_storeu_epi32(void * , _ mmask8 k, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 


VPMOVQW/VPMOVSQW/VPMOVUSQW—Down Convert QWord to Word 


Vol. 2C 


5-451 


INSTRUCTION SET REFERENCE, V-Z 


VPMOVWB/VPMOVSWB/VPMOVUSWB—Down Convert Word to Byte 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.F3.0F38.W0 30 /r A VIV AVX512VL_ | Converts 8 packed word integers from xmm2 into 8 
VPMOVWB xmm1/m64 {k1}{z}, xmm2 AVX512BW | packed bytes in xmm1/m64 with truncation under 
writemask k1. 
EVEX.128.F3.0F38.W0 20 /r A VIV AVX512VL_ | Converts 8 packed signed word integers from xmm2 
VPMOVSWB xmm1/m64 {k1}{z}, AVX512BW | into 8 packed signed bytes in xmm1/m64 using 
xmm2 signed saturation under writemask k1. 
EVEX.128.F3.0F38.W0 10 /r A VIV AVX512VL_ | Converts 8 packed unsigned word integers from 
VPMOVUSWB xmm1/m64 {k1}{z}, AVX512BW | xmm2 into 8 packed unsigned bytes in 8mm1/m64 
xmm2 using unsigned saturation under writemask k1. 
EVEX.256.F3.0F38.W0 30 /r A VIV AVX512VL_ | Converts 16 packed word integers from ymm2 into 
VPMOVWB xmm1/m128 {k1}{z}, AVX512BW | 16 packed bytes in xmm1/m128 with truncation 
ymm2 under writemask k1. 
EVEX.256.F3.0F38.W0 20 /r A VIV AVX512VL_ | Converts 16 packed signed word integers from ymm2 
VPMOVSWB xmm1/m128 {k1}{z}, AVX512BW | into 16 packed signed bytes in xmm1/m128 using 
ymm2 signed saturation under writemask k1. 
EVEX.256.F3.0F38.W0 10 /r A VIV AVX512VL_ | Converts 16 packed unsigned word integers from 
VPMOVUSWB xmm1/m128 {k1}{z}, AVX512BW | ymm2into 16 packed unsigned bytes in xmm1/m128 
ymm2 using unsigned saturation under writemask k1. 
EVEX.512.F3.0F38.W0 30 /r A VIV AVX512BW | Converts 32 packed word integers from zmm2 into 
VPMOVWB ymm1/m256 {k1}{z}, 32 packed bytes in ymm1/m256 with truncation 
zmm2 under writemask k1. 
EVEX.512.F3.0F38.W0 20 /r A VIV AVX512BW | Converts 32 packed signed word integers from zmm2 
VPMOVSWB ymm1/m256 {k1}{z}, into 32 packed signed bytes in ymm1/m256 using 
zmm2 signed saturation under writemask k1. 
EVEX.512.F3.0F38.W0 10 /r A VIV AVX512BW | Converts 32 packed unsigned word integers from 
VPMOVUSWB ymm1/m256 {k1}{z}, zmm2z into 32 packed unsigned bytes in ynm1/m256 
zmm2 using unsigned saturation under writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Half Mem ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


VPMOVWB down converts 16-bit integers into packed bytes using truncation. VPMOVSWEB converts signed 16-bit 
integers into packed signed bytes using signed saturation. VPMOVUSWB convert unsigned word values into 
unsigned byte values using unsigned saturation. 


The source operand is aZMM/YMM/XMM register. The destination operand is a YMM/XMM/XMM register or a 


256/128/64-bit memory location. 


Down-converted byte elements are written to the destination operand (the first operand) from the least-significant 
byte. Byte elements of the destination operand are updated according to the writemask. Bits (MAXVL- 


1:256/128/64) of the register destination are zeroed. 


Note: EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
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Operation 


VPMOVWB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j:=O TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TruncatewordToByte (SRC[m+15:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 


VPMOVWB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j:=O TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = TruncateWordToByte (SRC[m+15:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVSWB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=O TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateSignedWordToByte (SRC[m+15:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 
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VPMOVSWEB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] = SaturateSignedWordToByte (SRC[m+15:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 


VPMOVUSWB instruction (EVEX encoded versions) when dest is a register 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedWordToByte (SRC[m+15:m]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+7:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+7:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL/2] := 0; 


VPMOVUSWB instruction (EVEX encoded versions) when dest is memory 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TOKI-1 
i:=j*8 
m:=j* 16 
IF k1[j] OR *no writemask* 
THEN DEST[i+7:i] := SaturateUnsignedWordToByte (SRC[m+15:m]) 
ELSE 
*DEST[i+7:i] remains unchanged* ; merging-masking 
Fl; 
ENDFOR 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalents 


VPMOVUSWB __m256i_mm512_cvtusepi16_epi8(__m512i a); 

VPMOVUSWB __m256i__mm512_mask_cvtusepi16_epi8(__m256i a,___ mmask32 k, 
VPMOVUSWB __m256i__mm512_maskz_cvtusepi16_epi8(__ mmask32 k,___m512ib); 
VPMOVUSWB void _mm512_mask_cvtusepi16_storeu_epi8(void *,__ mmask32 k, __m512ib); 
VPMOVSWB __m256i__mm512_cvtsepi16_epi8(__m512i a); 

VPMOVSWB __m256i_mm512_mask_cvtsepi16_epi8(__m256i a,__ mmask32 k,__m512i b); 
VPMOVSWB __m256i __mm512_maskz_cvtsepi16_epi8(__ mmask32 k, __m512i b); 
VPMOVSWB void _mm512_mask_cvtsepi16_storeu_epi8(void * ,__ mmask32 k,__m512i b); 
VPMOVWB __m256i_mm512_cvtepi16_epi8(__m512i a); 

VPMOVWB __m256i_mm512_mask_cvtepi16_epi8(__m256i a, ___ mmask32 k, 
VPMOVWB __m256i_mm512_maskz_cvtepi16_epi8(___mmask32 k,___m512i b); 
VPMOVWB void __mm512_mask_cvtepi16_storeu_epi8(void * , _ mmask32 k,___m512i b); 
VPMOVUSWB __m128i__mm256_cvtusepi16_epi8(__m256i a); 

VPMOVUSWB __m128i __mm256_mask_cvtusepi16_epi8(__m128i a,__ mmask16 k, 
VPMOVUSWB __m128i__mm256_maskz_cvtusepi16_epi8(__mmask16 k, __m256i b); 
VPMOVUSWB void _mm256_mask_cvtusepi16_storeu_epi8(void *,__ mmask16 k, __m256i b); 
VPMOVUSWB __m128i__mm_cvtusepi16_epi8(__m1 283 a); 

VPMOVUSWB __m128i __mm_mask_cvtusepi16_epi8(__m128i a,__ mmask8 k, __m128i b); 
VPMOVUSWB __m128i __mm_maskz_cvtusepi16_epi8(__mmask8 k, __m128i b); 
VPMOVUSWB void _mm_mask_cvtusepi16_storeu_epi8(void *, _ mmask8 k,___m128i b); 
VPMOVSWB __m128i __mm256_cvtsepi16_epi8(__m256i a); 

VPMOVSWB __m128i__mm256_mask_cvtsepi16_epi8(__m128i a,__ mmask16 k,__ m256i b); 
VPMOVSWB __m128i __mm256_maskz_cvtsepi16_epi8(__ mmask16 k, __m256i b); 


m512i b); 


m512i b); 


m256i b); 


VPMOVSWB void _mm256_mask_cvtsepi16_storeu_epi8(void * ,__ mmask16 k, __m256i b); 
VPMOVSWB __m128i __mm_cvtsepi16_epi8(__m128i a); 
VPMOVSWB __m128i__mm_mask_cvtsepi16_epi8(__m128i a,__ mmask8 k, __m128i b); 


VPMOVSWB __m128i __mm_maskz_cvtsepi16_epi8(___mmask8 k, __m128i b); 
VPMOVSWB void _mm_mask_cvtsepi16_storeu_epi8(void *,__ mmask8 k, __m128i b); 
VPMOVWB __m128i_mm256_cvtepi16_epi8(__m256i a); 

VPMOVWB __m128i__mm256_mask_cvtepi16_epi8(__m128i a,__ mmask16 k, 
VPMOVWB __m128i_mm256_maskz_cvtepi16_epi8(__ mmask16 k, __m256i b); 
VPMOVWB void _mm256_mask_cvtepi16_storeu_epi8(void * , _ mmask16 k, __m256i b); 
VPMOVWB __m128i_mm_cvtepi16_epi8(__m128i a); 

VPMOVWB __m128i __mm_mask_cvtepi16_epi8(__m128i a,___ mmask8 k, 
VPMOVWB __m128i __mm_maskz_cvtepi16_epi8(__ mmask8 k, __m128i b); 
VPMOVWB void _mm_mask_cvtepi16_storeu_epi8(void * ,__ mmask8 k, __m128i b); 


m256i b); 


m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-53, “Type E6 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VPMULTISHIFTQB - Select Packed Unaligned Bytes from Quadword Sources 


Opcode / Op/ | 64/32 CPUID Feature | Description 
Instruction En bitMode | Flag 

Support 
EVEX.128.66.0F38.W1 83 /r A VIV AVX512_VBMI | Select unaligned bytes from qwords in 
VPMULTISHIFTQB xmm1 {k1}{z}, AVX512VL xmm3/m128/m64bcst using control bytes in 
xmm2,xmm3/m128/m64bcst xmm_2, write byte results to xmm1 under k1. 
EVEX.256.66.0F38.W1 83 /r A VIV AVX512_VBMI | Select unaligned bytes from qwords in 
VPMULTISHIFTQB ymm1 {k1}{z}, AVX512VL ymm3/m256/m64bcst using control bytes in 
ymm2,ymm3/m256/m64bcst ymm2, write byte results to ymm1 under k1. 
EVEX.512.66.0F38.W1 83 /r A VIV AVX512_VBMI | Select unaligned bytes from qwords in 
VPMULTISHIFTQB zmm1 {k1}{Z}, zmm3/m512/m64bcst using control bytes in 
zmm2,zmm3/m512/m64bcst zmme2, write byte results to zmm1 under k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction selects eight unaligned bytes from each input qword element of the second source operand (the 
third operand) and writes eight assembled bytes for each qword element in the destination operand (the first 
operand). Each byte result is selected using a byte-granular shift control within the corresponding qword element 
of the first source operand (the second operand). Each byte result in the destination operand is updated under the 
writemask k1. 


Only the low 6 bits of each control byte are used to select an 8-bit slot to extract the output byte from the qword 
data in the second source operand. The starting bit of the 8-bit slot can be unaligned relative to any byte boundary 
and is extracted from the input qword source at the location specified in the low 6-bit of the control byte. If the 8- 
bit slot would exceed the qword boundary, the out-of-bound portion of the 8-bit slot is wrapped back to start from 
bit 0 of the input qword element. 


The first source operand is a ZMM/YMM/XMM register. The second source operand can be a ZMM/YMM/XMM reg- 
ister, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64-bit memory loca- 
tion. The destination operand is a ZMM/YMM/XMM register. 
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Operation 


INSTRUCTION SET REFERENCE, V-Z 


VPMULTISHIFTQB DEST, SRC1, SRC2 (EVEX encoded version) 
(KL, VL) = (2, 128),(4, 256), (8, 512) 


FOR i := 0 TO KL-1 


IF EVEX.b=1 AND src2 is memory THEN 
tcur := src2.qword[0]; //broadcasting 


ELSE 


tcur := src2.qword[i]; 


Fl; 
FOR j:=Oto7 


ctrl := src1.qword[i].byte[j] & 63; 
FOR k := 0 to 7 
res,bit[k] := tcur.bit[ (ctrl+k) mod 64 J; 


ENDFOR 


IF k1[i*8+j] or no writemask THEN 
DEST.qword[i].byte[j] := res; 

ELSE IF zeroing-masking THEN 
DEST.qword[i].byte[j] := 0; 


ENDFOR 
ENDFOR 


DEST.qword[MAX_VL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


VPMULTISHIFTQB 
VPMULTISHIFTQB 
VPMULTISHIFTQB 
VPMULTISHIFTQB 
VPMULTISHIFTQB 
VPMULTISHIFTQB 
VPMULTISHIFTQB 


VPMULTISHIFTQB __m128i __mm_mask_multishift_epi64_epi8(__m128i s, 
VPMULTISHIFTQB __m128i __mm_maskz_multishift_epi64_epi8(__mmask8 k,__m128i a, 


m512i_mm512_multishift_epi64_epi8(__m512i a,__m512ib); 
m512i_mm512_mask_multishift_epi64_epi8(__m512i s,__ mmask64 k,__m512i a,_m512ib); 
m512i_mm512_maskz_multishift_epi64_epi8(__ mmask64 k,___m512i a,__m512i b); 
m256i__mm256_multishift_epi64_epi8(__ m256i a,___ m256i b); 
m256i__mm256_mask_multishift_epi64_epi8(__m256i s,__ mmask32 k,__ m256i a,___m256i b); 
m256i_mm256_maskz_multishift_epi64_epi8(__ mmask32 k, __ m256i a,__m256i b); 
__m128i_mm_multishift_epi64_epi8(__m128i a, ___m128i b); 


mmask8 k,___m128i a,__m128i b); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


m128i b); 


See Table 2-50, “Type E4NF Class Exception Conditions”. 
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VPOPCNT — Return the Count of Number of Bits Set to 1 in BYTE/WORD/DWORD/QWORD 


Opcode/ Op/ | 64/32 CPUID Feature Flag Description 
Instruction En bit Mode 
Support 
EVEX.128.66.0F38.W0 54 /r A VIV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTB xmm1{k1}{Z}, AVX512VL xmm2/m128 and puts the result in xmm1 with 
xmm2/m128 writemask k1. 
EVEX.256.66.0F38.W0 54 /r A VV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTB ymm1{k1}{Z}, AVX512VL ymm2/m256 and puts the result in ymm1 with 
ymm2/m256 writemask k1. 
EVEX.512.66.0F38.W0 54 /r A VV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTB zmm1{k1}{Z}, zmm2/m512 and puts the result in zmm1 with 
zmm2/m512 writemask k1. 
EVEX.128.66.0F38.W1 54 /r A VV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTW xmm1{k1}{Z}, AVX512VL xmm_2/m128 and puts the result in xmm1 with 
xmm2/m128 writemask k1. 
EVEX.256.66.0F38.W1 54 /r A VIV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTW ymm1{k1}{Z}, AVX512VL ymm2/m256 and puts the result in ymm1 with 
ymm2/m256 writemask k1. 
EVEX.512.66.0F38.W1 54 /r A VV AVX512_BITALG Counts the number of bits set to one in 
VPOPCNTW zmm1{k1}{z}, zmm2/m512 and puts the result in zmm1 with 
zmm2/m512 writemask k1. 
EVEX.128.66.0F38.W0 55 /r B VIN AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTD xmm1{k1}{Z}, AVX512VL xmm2/m128/m32bcst and puts the result in 
xmm2/m1 28/m32bcst xmm1 with writemask k1. 
EVEX.256.66.0F38.W0 55 /r B VIN AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTD ymm1{k1}{Z}, AVX512VL ymm2/m256/m32bcst and puts the result in 
ymm2/m256/m32bcst ymm1 with writemask k1. 
EVEX.512.66.0F38.W0 55 /r B VIN AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTD zmm1{k1}{Z}, zmm2/m512/m32bcst and puts the result in 
zmm2/m512/m32bcst zmm1 with writemask k1. 
EVEX.128.66.0F38.W1 55 /r B VV AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTQ xmm1{k1}{2}, AVX512VL xmm2/m128/m32bcst and puts the result in 
xmme2/m1 28/m64bcst xmm1 with writemask k1. 
EVEX.256.66.0F38.W1 55 /r B VV AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTQ ymm1{k1}{2}, AVX512VL ymm2/m256/m32bcst and puts the result in 
ymm2/m256/m64bcst ymm1 with writemask k1. 
EVEX.512.66.0F38.W1 55 /r B VV AVX512_VPOPCNTDQ | Counts the number of bits set to one in 
VPOPCNTQ zmm1{k1}{z}, zmm2/m512/m64bcst and puts the result in 
zmm2/m512/m64bcst zmm1 with writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) ModRM:r/m (r) NA NA 
B Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction counts the number of bits set to one in each byte, word, dword or qword element of its source (e.g., 
zmm2 or memory) and places the results in the destination register (Zmm1). This instruction supports memory 


fault suppression. 
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VPOPCNT — Return the Count of Number of Bits Set to 1 in BYTE/WORD/DWORD/QWORD 


Operation 


VPOPCNTB 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
DEST.byte[j] := POPCNT(SRC.byte[j]) 
ELSE IF *merging-masking*: 
*DEST.byte[j] remains unchanged* 
ELSE: 
DEST.byte[j] := 0 
DEST[MAX_VL-1:VL] := 0 


VPOPCNTW 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
DEST.word[j] := POPCNT(SRC.word[j]) 
ELSE IF *merging-masking*: 
*DEST.word[j] remains unchanged* 
ELSE: 
DEST.word[j] := 0 
DEST[MAX_VL-1:VL] := 0 


VPOPCNTD 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
IF SRC is broadcast memop: 
t:= SRC.dword[0] 
ELSE: 
t:= SRC.dword[j] 
DEST.dword[j] := POPCNT(t) 
ELSE IF *merging-masking*: 
*DEST..dword[j] remains unchanged* 
ELSE: 
DEST..dword[j] := 0 
DEST[MAX_VL-1:VL] := 0 


VPOPCNTQ 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
IF SRC is broadcast memop: 
t:= SRC.qword[0] 
ELSE: 
t:= SRC.qword[j] 
DEST.qword[j] := POPCNT(t) 
ELSE IF *merging-masking*: 
*DEST..qword{[j] remains unchanged* 
ELSE: 
DEST..qword[j] := 0 
DEST[MAX_VL-1:VL] := 0 


VPOPCNT — Return the Count of Number of Bits Set to 1 in BYTE/WORD/DWORD/QWORD 


INSTRUCTION SET REFERENCE, V-Z 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPOPCNTW __m128i__mm_popcnt_epi16(__m1 28i); 

VPOPCNTW __m128i __mm_mask_popcnt_epi16(__m128i,__ mmask8, 
VPOPCNTW __m128i_mm_maskz_popcnt_epi16(__mmask8, __m128i); 

VPOPCNTW __m256i__mm256_popcnt_epi16(__m256i); 

VPOPCNTW __m256i__mm256_mask_popcnt_epi16(__m256i,__ mmask16, __ m256i); 
VPOPCNTW __m256i__mm256_maskz_popcnt_epi16(__mmask16, __m256i); 
VPOPCNTW __m512i_mm512_popcnt_epi16(__m51 2); 

VPOPCNTW __m512i_mm512_mask_popcnt_epi16(__m512i,__ mmask32, 
VPOPCNTW __m512i _mm512_maskz_popcnt_epi16(__mmask32, __m512i); 
VPOPCNTQ __m128i _mm_popcnt_epi64(__m1 28i); 

VPOPCNTQ __m128i _mm_mask_popcnt_epi64(__m128i,___ mmask8, __m128i); 
VPOPCNTQ __m128i _mm_maskz_popcnt_epi64(__mmask8, __m128i); 
VPOPCNTQ __m256i _mm256_popcnt_epi64(__m256i); 

VPOPCNTQ __m256i _mm256_mask_popcnt_epi64(__m256i,___mmask8, 
VPOPCNTQ __m256i _mm256_maskz_popcnt_epi64(__mmask8, __m256i); 
VPOPCNTQ __m512i _mm512_popcnt_epi64(__m512i); 

VPOPCNTQ __m512i _mm512_mask_popcnt_epi64(__m512i,__ mmask8, __m512i); 
VPOPCNTQ __m512i _mm512_maskz_popcnt_epi64(__mmask8, __m512i); 
VPOPCNTD __m128i _mm_popcnt_epi32(__m128i); 

VPOPCNTD __m128i _mm_mask_popcnt_epi32(__m128i, __ mmask8, 
VPOPCNTD __m128i _mm_maskz_popcnt_epi32(__mmask8, __m128i); 

VPOPCNTD __m256i _mm256_popcnt_epi32(__m256i); 

VPOPCNTD __m256i _mm256_mask_popcnt_epi32(__m256i, _ mmask8, __m256i); 
VPOPCNTD __m256i _mm256_maskz_popcnt_epi32(__mmask8, __m256i); 
VPOPCNTD __m512i _mm512_popcnt_epi32(__m512i); 

VPOPCNTD __m512i _mm512_mask_popcnt_epi32(__m512i, _ mmask16, 
VPOPCNTD __m512i _mm512_maskz_popcnt_epi32(__mmask16, __m512i); 
VPOPCNTB __m128i _mm_popcnt_epi8(__m128i); 

VPOPCNTB __m128i _mm_mask_popcnt_epi8(__m128i, __ mmask16, __m128i); 
VPOPCNTB __m128i _mm_maskz_popcnt_epi8(__mmask16, __m128i); 
VPOPCNTB __m256i _mm256_popcnt_epi8(__m256i); 

VPOPCNTB __m256i _mm256_mask_popcnt_epi8(__m256i,__ mmask32, 
VPOPCNTB ___m256i _mm256_maskz_popcnt_epi8(__mmask32, __m256i); 
VPOPCNTB __m512i _mm512_popcnt_epi8(__m51 2i); 

VPOPCNTB__m512i _mm512_mask_popcnt_epi8(__m512i,__ mmask64, __m512i); 
VPOPCNTB __m512i _mm512_maskz_popcnt_epi8(__mmask64, __m512i); 


m1 28i); 


m512i); 


m256i); 


m1 28i); 


m512i); 


m256i); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 


See Type E4. 
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VPROLD/VPROLVD/VPROLQ/VPROLVQ—Bit Rotate Left 


INSTRUCTION SET REFERENCE, V-Z 


Opcode/ Op/€En 64/32 CPUID Description 
Instruction bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 15 /r B VIV AVX512VL | Rotate doublewords in xmm2 left by count in the 
VPROLVD xmm1 {k1}{z}, xmm2, AVX512F corresponding element of xmm3/m128/m32bcst. 
xmm3/m128/m32bcst Result written to xmm1 under writemask k1. 
EVEX.128.66.0F.WO 72 /1 ib A VV AVX512VL | Rotate doublewords in xmm2/m128/m3 2bcst left 
VPROLD xmm1 {k1}{z}, AVX512F by immé. Result written to xmm1 using 
xmm2/m128/m32bcst, imm8 writemask k1. 
EVEX.128.66.0F38.W1 15 /r B VIV AVX512VL | Rotate quadwords in xmmz left by count in the 
VPROLVQ xmm1 {k1}{z}, xmm2, AVX512F corresponding element of xmm3/m128/m64bcst. 
xmm3/m128/m64bcst Result written to xmm1 under writemask k1. 
EVEX.128.66.0F.W1 72 /1 ib A VIV AVX512VL | Rotate quadwords in xmm2/m128/m64bcst left 
VPROLQ xmm1 {k1}{Z}, AVX512F by immé. Result written to xmm1 using 
xmm2/m128/m64bcst, imm8 writemask k1. 
EVEX.256.66.0F38.W0 15 /r B VIV AVX512VL | Rotate doublewords in ymm2 left by count in the 
VPROLVD ymm1 {k1}{z}, ymm2, AVX512F corresponding element of ymm3/m256/m32bcst. 
ymm3/m256/m32bcst Result written to ymm1 under writemask k1. 
EVEX.256.66.0F.WO 72 /1 ib A VIV AVX512VL | Rotate doublewords in ymm2/m256/m32bcst left 
VPROLD ymm1 {k1}{z}, AVX512F by immé. Result written to ymm1 using 
ymm2/m256/m32bcst, imm8 writemask k1. 
EVEX.256.66.0F38.W1 15 /r B VIV AVX512VL | Rotate quadwords in ymm2 left by count in the 
VPROLVQ ymm1 {k1}{z}, ymm2, AVX512F corresponding element of ymm3/m256/m64bcst. 
ymm3/m256/m64bcst Result written to ymm1 under writemask k1. 
EVEX.256.66.0F.W1 72/1 ib A VIV AVX512VL | Rotate quadwords in ymm2/m256/m64bcst left 
VPROLQ ymm1 {k1}{Z}, AVX512F by imm8. Result written to ymm1 using 
ymm2/m256/m64bcst, imm8 writemask k1. 
EVEX.512.66.0F38.W0 15 /r B VIV AVX512F Rotate left of doublewords in zmm2 by count in 
VPROLVD zmm1 {k1}{z}, zmm2, the corresponding element of 
zmm3/m512/m32bcst zmm3/m512/m32bcst. Result written to zmm1 

using writemask k1. 

EVEX.512.66.0F.WO 72 /1 ib A VIN AVX512F Rotate left of doublewords in 
VPROLD zmm1 {k1}{Z}, zmm3/m512/m32bcst by imms. Result written to 
zmm2/m51 2/m32bcst, imm8 zmm1 using writemask k1. 
EVEX.512.66.0F38.W1 15 /r B VIV AVX512F Rotate quadwords in zmm2 left by count in the 
VPROLVQ zmm1 {k1}{z}, zmm2, corresponding element of zmm3/m512/m64bcst. 
zmm3/m512/m64bcst Result written to zmm1under writemask k1. 
EVEX.512.66.0F.W1 72 /1 ib A VIV AVX512F Rotate quadwords in zmm2/m512/m64bcst left 
VPROLQ zmm1 {k1}{Z}, by immé. Result written to zmm1 using 
zmm2/m512/m64bcst, imm8 writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full VEX.vvvv (w) ModRM:r/m (R) Imms NA 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Rotates the bits in the individual data elements (doublewords, or quadword) in the first source operand to the left 
by the number of bits specified in the count operand. If the value specified by the count operand is greater than 31 
(for doublewords), or 63 (for a quadword), then the count operand modulo the data size (32 or 64) is used. 


EVEX.128 encoded version: The destination operand is a XMM register. The source operand is a XMM register or a 
memory location (for immediate form). The count operand can come either from an XMM register or a memory 
location or an 8-bit immediate. Bits (MAXVL-1:128) of the corresponding ZMM register are zeroed. 


EVEX.256 encoded version: The destination operand is a YMM register. The source operand is a YMM register or a 
memory location (for immediate form). The count operand can come either from an XMM register or a memory 
location or an 8-bit immediate. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 


EVEX.512 encoded version: The destination operand is a ZMM register updated according to the writemask. For the 
count operand in immediate form, the source operand can be a ZMM register, a 512-bit memory location or a 512- 
bit vector broadcasted from a 32/64-bit memory location, the count operand is an 8-bit immediate. For the count 
operand in variable form, the first source operand (the second operand) is a ZMM register and the counter operand 
(the third operand) is a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32/64-bit 
memory location. 


Operation 


LEFT_ROTATE_DWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC modulo 32; 
DEST[31:0] := (SRC << COUNT) | (SRC >> (32 - COUNT); 


LEFT_ROTATE_QWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC modulo 64; 
DEST[63:0] := (SRC << COUNT) | (SRC >> (64 - COUNT); 


VPROLD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST{[i+31:i] = LEFT_ROTATE_DWORDS(SRC1[3 1:0], imm8) 
ELSE DEST[i+31:i] := LEFT_ROTATE_DWORDS(SRC1[i+31:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPROLVD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] = LEFT_ROTATE_DWORDS(SRC1[i+31:i], SRC2[31:0]) 
ELSE DEST[i+31:i] := LEFT_ROTATE_DWORDS(SRC1[i+31:i], SRC2[i+31:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPROLQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN DEST[i+63:i] = LEFT_ROTATE_QWORDS(SRC1 [63:0], imm8) 
ELSE DEST[i+63:i] := LEFT_ROTATE_QWORDS(SRC1[i+63:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPROLVQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+63:i] = LEFT_ROTATE_QWORDS(SRC1[i+63:i], SRC2[63:0]) 
ELSE DEST[i+63:i] := LEFT_ROTATE_QWORDS(SRC1[i+63:i], SRC2[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPROLD __m512i_mm512_rol_epi32(__m512i a, int imm); 

VPROLD __m512i_mm512_mask_rol_epi32(__m512i a,__mmask16 k,___m512ib, int imm); 
VPROLD __m512i_mm512_maskz_rol_epi32(__mmask16 k,__m512ia, int imm); 

VPROLD __m256i_mm256_rol_epi32(__m256i a, int imm); 

VPROLD __m256i __mm256_mask_rol_epi32(__m256i a,__ mmask8 k, 
VPROLD __m256i __mm256_maskz_rol_epi32(__mmask8 k, 
VPROLD __m128i __mm_rol_epi32(__m128i a, int imm); 
VPROLD __m128i__mm_mask_rol_epi32(__m128i a,__ mmask8 k, __m128i b, int imm); 
VPROLD __m128i__mm_maskz_rol_epi32(__mmask8 k,___m128i a, int imm); 

VPROLQ __m512i_mm512_rol_epi64(__m512i a, int imm); 

VPROLQ __m512i_mm512_mask_rol_epi64(__m512i a, ___mmask8 k, __m512ib, int imm); 
VPROLQ __m512i__mm512_maskz_rol_epi64(__mmask8 k, __m512i a, int imm); 

VPROLQ __m256i__mm256_rol_epi64(__m256i a, int imm); 

VPROLQ __m256i __mm256_mask_rol_epi64(__m256i a, __mmask8 k, __m256i b, int imm); 
VPROLQ __m256i _mm256_maskz_rol_epi64(_mmask8 k, __m256i a, int imm); 

VPROLQ __m128i__mm_rol_epi64(__m128i a, int imm); 

VPROLQ __m128i __mm_mask_rol_epi64(__m128i a, __mmask8 k, 
VPROLQ __m128i __mm_maskz_rol_epi64(__mmask8 k, __m128i a, int imm); 

VPROLVD __m512i_mm512_rolv_epi32(__m512i a,__m512i cnt); 

VPROLVD __m512i_mm512_mask_rolv_epi32(__m512i a,__ mmask16 k,__m512ib,___m512i cnt); 
VPROLVD __m512i_mm512_maskz_rolv_epi32(__mmask16 k,__m512i a, _m512i cnt); 
VPROLVD __m256i__mm256_rolv_epi32(__m256i a,__ m256i cnt); 

VPROLVD __m256i __mm256_mask_rolv_epi32(__m256i a,__ mmask8 k,___ m256i b, __m256i cnt); 
VPROLVD __m256i __mm256_maskz_rolv_epi32(__mmask8 k,___ m256i a, __m256i cnt); 

VPROLVD __m128i__mm_rolv_epi32(__m128i a,__m128i cnt); 

VPROLVD __m128i __mm_mask_rolv_epi32(__m128i a,__mmask8 k,__m128i b,___m128i cnt); 
VPROLVD __m128i__mm_maskz_rolv_epi32(__mmask8 k,___m128i a,__m128i cnt); 

VPROLVQ __m512i_mm512_rolv_epi64(__m512i a,__m512i cnt); 

VPROLVQ __m512i_mm512_mask_rolv_epi64(__m512i a,___mmask8 k, __m512i b,__m512i cnt); 
VPROLVQ __m512i_mm512_maskz_rolv_epi64(__mmask8 k,___m512i a, ___m512i cnt); 

VPROLVQ __m256i__mm256_rolv_epi64(__m256i a, ___m256i cnt); 

VPROLVQ __m256i__mm256_mask_rolv_epi64(__m256i a, ___mmask8 k, __m256i b, __m256i cnt); 
VPROLVQ __m256i__mm256_maskz_rolv_epi64(__mmask8 k, __m256i a, __m256i cnt); 

VPROLVQ __m128i __mm_rolv_epi64(__m128i a, __m128i cnt); 


m256i b, int imm); 
m256i a, int imm); 


m1 28i b, int imm); 
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VPROLVQ __m128i __mm_mask_rolv_epi64(__m128i a, ___mmask8 k, __m128i b, 
VPROLVQ __m128i __mm_maskz_rolv_epi64(__mmask8 k, __m128i a, 


m128i cnt); 
m1 28i cnt); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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VPRORD/VPRORVD/VPRORQ/VPRORVQ—Bit Rotate Right 


Opcode/ Op/En | 64/32 CPUID Description 
Instruction bit Mode | Feature 
Support Flag 
EVEX.128.66.0F38.W0 14 /r B VIV AVX512VL | Rotate doublewords in xmm2 right by count in 
VPRORVD xmm1 {k1}z}, xmm2, AVX512F the corresponding element of 
xmm3/m1 28/m32bcst xmm3/m128/m32bcst, store result using 
writemask k1. 
EVEX.128.66.0F.WO 72 /0 ib A VV AVX512VL | Rotate doublewords in xmm2/m128/m32bcst 
VPRORD xmm1 {k1}{Z}, AVX512F right by immé8, store result using writemask k1. 
xmm2/m128/m32bcst, imm8 
EVEX.128.66.0F38.W1 14 /r B VIV AVX512VL | Rotate quadwords in xmm_2 right by count in the 
VPRORVQ xmm1 {k1}{z}, xmm2, AVX512F corresponding element of xmm3/m128/m64bcst, 
xmm3/m1 28/m64bcst store result using writemask k1. 
EVEX.128.66.0F.W1 72 /0 ib A VIV AVX512VL | Rotate quadwords in xmm2/m128/m64best right 
VPRORQ xmm1 {k1}{z}, AVX512F by immé8, store result using writemask k1. 
xmm2/m128/m64bcst, imm8 
EVEX.256.66.0F38.W0 14 /r B VIV AVX512VL | Rotate doublewords in ymmd2 right by count in 
VPRORVD ymm1 {k1}{z}, ymm2, AVX512F the corresponding element of 
ymm3/m256/m32bcst ymm3/m256/m32bcst, store using result 
writemask k1. 
EVEX.256.66.0F.WO 72 /0 ib A VV AVX512VL | Rotate doublewords in ymm2/m256/m32bcst 
VPRORD ymm1 {k1}{z}, AVX512F right by immé8, store result using writemask k1. 
ymm2/m256/m32bcst, imm8 
EVEX.256.66.0F38.W1 14 /r B VIV AVX512VL | Rotate quadwords in ymm2 right by count in the 
VPRORVQ ymm1 {k1}{z}, ymm2, AVX512F corresponding element of ynm3/m256/m64bcst, 
ymm3/m256/m64bcst store result using writemask k1. 
EVEX.256.66.0F.W1 72 /0 ib A VIV AVX512VL | Rotate quadwords in ynm2/m256/m64best right 
VPRORQ ymm1 {k1}{Z}, AVX512F by immé8, store result using writemask k1. 
ymm2/m256/m64bcst, imm8 
EVEX.512.66.0F38.W0 14 /r B VV AVX512F Rotate doublewords in zmm2 right by count in 
VPRORVD zmm1 {k1}{z}, zmm2, the corresponding element of 
zmm3/m512/m32bcst zmm3/m512/m32bcst, store result using 
writemask k1. 
EVEX.512.66.0F.W0 72 /0 ib A VIN AVX512F Rotate doublewords in zmm2/m512/m32bcst 
VPRORD zmm1 {k1}{Z}, right by immé8, store result using writemask k1. 
zmm2/m512/m32bcst, imm8 
EVEX.512.66.0F38.W1 14 /r B VIV AVX512F Rotate quadwords in zmm2 right by count in the 
VPRORVQ zmm1 {k1}{z}, zmm2, corresponding element of zmm3/m512/m64bcst, 
zmm3/m512/m64bcst store result using writemask k1. 
EVEX.512.66.0F.W1 72 /0 ib A VIV AVX512F Rotate quadwords in zmm2/m512/m64bcst right 
VPRORQ zmm1 {k1}{Z}, by immé8, store result using writemask k1. 
zmm2/m512/m64bcst, imm8 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full VEX.vvvv (w) ModRM:r/m (R) Imm8s NA 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Rotates the bits in the individual data elements (doublewords, or quadword) in the first source operand to the right 
by the number of bits specified in the count operand. If the value specified by the count operand is greater than 31 
(for doublewords), or 63 (for a quadword), then the count operand modulo the data size (32 or 64) is used. 


EVEX.128 encoded version: The destination operand is a XMM register. The source operand is a XMM register or a 
memory location (for immediate form). The count operand can come either from an XMM register or a memory 
location or an 8-bit immediate. Bits (MAXVL-1:128) of the corresponding ZMM register are zeroed. 


EVEX.256 encoded version: The destination operand is a YMM register. The source operand is a YMM register or a 
memory location (for immediate form). The count operand can come either from an XMM register or a memory 
location or an 8-bit immediate. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 


EVEX.512 encoded version: The destination operand is a ZMM register updated according to the writemask. For the 
count operand in immediate form, the source operand can be a ZMM register, a 512-bit memory location or a 512- 
bit vector broadcasted from a 32/64-bit memory location, the count operand is an 8-bit immediate. For the count 
operand in variable form, the first source operand (the second operand) is a ZMM register and the counter operand 
(the third operand) is a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32/64-bit 
memory location. 


Operation 


RIGHT_ROTATE_DWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC modulo 32; 
DEST[31:0] := (SRC >> COUNT) | (SRC << (32 - COUNT); 


RIGHT_ROTATE_QWORDS(SRC, COUNT_SRC) 
COUNT := COUNT_SRC modulo 64; 
DEST[63:0] := (SRC >> COUNT) | (SRC << (64 - COUNT); 


VPRORD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory*) 
THEN DEST[i+31:i] = RIGHT_ROTATE_DWORDS( SRC1[31:0], imm8) 
ELSE DEST[i+31:i] := RIGHT_ROTATE_DWORDS(SRC1[i+31:i], imm8) 


Fl; 
ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPRORVD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] = RIGHT_ROTATE_DWORDS(SRC1[i+31:i], SRC2[31:0]) 
ELSE DEST[i+31:i] := RIGHT_ROTATE_DWORDS(SRC1[i+31:i], SRC2[i+3 1:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VPRORQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC1 *is memory’) 
THEN DEST[i+63:i] = RIGHT_ROTATE_QWORDS(SRC1[63:0], imm8) 
ELSE DEST[i+63:i] := RIGHT_ROTATE_QWORDS(SRC1[i+63:i], imm8]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 
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VPRORVQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


THEN DEST[i+63:i] := RIGHT_ROTATE_QWORDS(SRC1[i+63:i], SRC2[63:0]) 
ELSE DEST[i+63:i] = RIGHT_ROTATE_QWORDS(SRC1[i+63:i], SRC2[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPRORD __m512i_mm512_ror_epi32(__m512i a, int imm); 
VPRORD __m512i_mm512_mask_ror_epi32(__m512i a, 


VPRORD __m512i__mm512_maskz_ror_epi32(__mmask16 k, 


VPRORD __m256i __mm256_ror_epi32(__m256i a, int imm); 
VPRORD __m256i __mm256_mask_ror_epi32(__m256i a, 


VPRORD __m128i __mm_ror_epi32(__m128i a, int imm); 


VPRORD __m128i __mm_mask_ror_epi32(__m128i a,___mmask8 k, __m128ib, int imm); 
VPRORD __m128i __mm_maskz_ror_epi32(__mmask8 k, __m128i a, int imm); 


VPRORQ __m512i_mm512_ror_epi64(__m512i a, int imm); 
VPRORQ __m512i_mm512_mask_ror_epi64(__m512i a, 


VPRORQ __m512i_mm512_maskz_ror_epi64(__mmask8 k, 


VPRORQ __m256i__mm256_ror_epi64(__m256i a, int imm); 
VPRORQ __m256i__mm256_mask_ror_epi64(__m256i a, 


VPRORQ __m256i __mm256_maskz_ror_epi64(__mmask8 k, 


VPRORQ __m128i__mm_ror_epi64(__m128i a, int imm); 


VPRORQ __m128i__mm_mask_ror_epi64(__m128i a, __mmask8 k, 
VPRORQ __m128i __mm_maskz_ror_epi64(__mmask8 k, __m128i a, int imm); 

m512i cnt); 

mmask16 k,__m512ib,___m512i cnt); 
VPRORVD __m512i_mm512_maskz_rorv_epi32(__mmask16 k, 
VPRORVD __m256i_mm256_rorv_epi32(__m256i a, __ m256i cnt); 


VPRORVD __m512i_mm512_rorv_epi32(__m512ia, 
VPRORVD __m512i_mm512_mask_rorv_epi32(__m512i a, 


VPRORVD __m256i__mm256_mask_rorv_epi32(__m256i a, 


VPRORVD __m256i__mm256_maskz_rorv_epi32(__mmask8 k, __m256i a, 
VPRORVD __m128i__mm_rorv_epi32(__m128i a, __m128i cnt); 
mmask8 k,___m128i b, __m128i cnt); 


VPRORVD __m128i__mm_mask_rorv_epi32(__m128i a, 
VPRORVD __m128i__mm_maskz_rorv_epi32(__mmask8 k, 
VPRORVQ __m512i_mm512_rorv_epi64(__m512i a, 
VPRORVQ __m512i_mm512_mask_rorv_epi64(__m512i a, 


VPRORVQ __m512i_mm512_maskz_rorv_epi64(__mmask8 k, __m512i a, 
m256i cnt); 
mmask8 k,___m256i b, __m256i cnt); 


VPRORVQ __m256i__mm256_rorv_epi64(__m256i a, 
VPRORVQ __m256i__mm256_mask_rorv_epi64(__m256i a, 


VPRORVQ __m256i _mm256_maskz_rorv_epi64(__mmask8 k, 
m1 28i cnt); 


VPRORVQ __m128i __mm_rorv_epi64(__m128i a, 
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mmask16 k,___m512ib, int imm); 
m512i a, int imm); 


mmask8 k, __m256i b, int imm); 
VPRORD __m256i __mm256_maskz_ror_epi32(__mmask8 k, __m256i a, int imm); 


m512i b, int imm); 
m512i a, int imm); 


mmask8 k, __m256i b, int imm); 
m256i a, int imm); 


m128i b, int imm); 


m512i cnt); 
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VPRORVQ __m128i _mm_mask_rorv_epi64(__m128i a, __mmask8 k, __m128i b, __m128i cnt); 
VPRORVQ __m128i _mm_maskz_rorv_epi64(__mmask8 k, __m128i a, __m128i cnt); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 


5-470 Vol. 2C VPRORD/VPRORVD/VPRORQ/VPRORVQ—Bit Rotate Right 


INSTRUCTION SET REFERENCE, V-Z 


VPSCATTERDD/VPSCATTERDQ/VPSCATTERQD/VPSCATTERQQ—Scatter Packed Dword, Packed 
Qword with Signed Dword, Signed Qword Indices 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 AO /vsib A VIV AVX512VL | Using signed dword indices, scatter dword values to 
VPSCATTERDD vm32x {k1}, xmm1 AVX512F memory using writemask k1. 
EVEX.256.66.0F38.W0 AO /vsib A VIV AVX512VL | Using signed dword indices, scatter dword values to 
VPSCATTERDD vm32y {k1}, ymm1 AVX512F memory using writemask k1. 
EVEX.512.66.0F38.W0 AO /vsib A VIV AVX512F Using signed dword indices, scatter dword values to 
VPSCATTERDD vm32z {k1}, zmm1 memory using writemask k1. 
EVEX.128.66.0F38.W1 AO /vsib A VIV AVX512VL_ | Using signed dword indices, scatter qword values to 
VPSCATTERDQ vm32x {k1}, xmm1 AVX512F memory using writemask k1. 
EVEX.256.66.0F38.W1 AO /vsib A VIV AVX512VL_ | Using signed dword indices, scatter qword values to 
VPSCATTERDQ vm32x {k1}, ymm1 AVX512F memory using writemask k1. 
EVEX.512.66.0F38.W1 AO /vsib A VIV AVX512F Using signed dword indices, scatter qword values to 
VPSCATTERDQ vm32y {k1}, zmm1 memory using writemask k1. 
EVEX.128.66.0F38.W0 A1 /vsib A VIV AVX512VL | Using signed qword indices, scatter dword values to 
VPSCATTERQD vm64x {k1}, xmm1 AVX512F memory using writemask k1. 
EVEX.256.66.0F38.W0 Al /vsib A VIV AVX512VL | Using signed qword indices, scatter dword values to 
VPSCATTERQD vm64y {k1}, xmm1 AVX512F memory using writemask k1. 
EVEX.512.66.0F38.W0 Al /vsib A VIV AVX512F Using signed qword indices, scatter dword values to 
VPSCATTERQD vm64z {k1}, ymm1 memory using writemask k1. 
EVEX.128.66.0F38.W1 A1 /vsib A VIV AVX512VL_ | Using signed qword indices, scatter qword values to 
VPSCATTERQQ vm64x {k1}, xmm1 AVX512F memory using writemask k1. 
EVEX.256.66.0F38.W1 A1 /vsib A VIV AVX512VL_ | Using signed qword indices, scatter qword values to 
VPSCATTERQQ vm64y {k1}, ymm1 AVX512F memory using writemask k1. 
EVEX.512.66.0F38.W1 Al /vsib A VIV AVX512F Using signed qword indices, scatter qword values to 
VPSCATTERQQ vm64z {k1}, zmm1 memory using writemask k1. 


Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


BaseReg (R): VSIB:base, 
VectorReg(R): VSIB:index 


A Tuple1 Scalar ModRM:reg (r) NA NA 


Description 


Stores up to 16 elements (8 elements for qword indices) in doubleword vector or 8 elements in quadword vector to 
the memory locations pointed by base address BASE_ADDR and index vector VINDEX, with scale SCALE. The 
elements are specified via the VSIB (i.e., the index register is a vector register, holding packed indices). Elements 
will only be stored if their corresponding mask bit is one. The entire mask register will be set to zero by this instruc- 
tion unless it triggers an exception. 


This instruction can be suspended by an exception if at least one element is already scattered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask register are partially updated. If any traps or interrupts are pending from already scattered 
elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


Note that: 


¢ Only writes to overlapping vector indices are guaranteed to be ordered with respect to each other (from LSB to 
MSB of the source registers). Note that this also include partially overlapping vector indices. Writes that are not 
overlapped may happen in any order. Memory ordering with other instructions follows the Intel-64 memory 
ordering model. Note that this does not account for non-overlapping indices that map into the same physical 
address locations. 
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¢ If two or more destination indices completely overlap, the “earlier” write(s) may be skipped. 

¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination ZMM will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 


¢ Elements may be scattered in any order, but faults must be delivered in a right-to left order; thus, elements to 
the left of a faulting one may be gathered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be gathered. 


¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 
* Not valid with 16-bit effective addresses. Will deliver a #UD fault. 


¢ If this instruction overwrites itself and then takes a fault, only a subset of elements may be completed before 
the fault is delivered (as described above). If the fault handler completes and attempts to re-execute this 
instruction, the new instruction will be executed, and the scatter will not complete. 

Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 

ModRM.rm is different than 100b. 


This instruction has special disp8*N and alignment rules. N is considered to be the size of a single vector element. 


The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 
ignored. 

The instruction will #UD fault if the kO mask register is specified. 


The instruction will #UD fault if EVEX.Z = 1. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 
VINDEX stands for the memory operand vector of indices (a ZMM register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1 or 4 byte displacement 


VPSCATTERDD (EVEX encoded versions) 
(KL, VL)= (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR +SignExtend(VINDEX[i+31:i]) * SCALE + DISP] := SRC[i+31:i] 
k1[j] := 0 


Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


VPSCATTERDQ (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 

i:=j* 64 

k:=j* 32 

IF k1[j] OR *no writemask* 

THEN MEM[BASE_ADDR +SignExtend(VINDEX[k+31:k]) * SCALE + DISP] := SRC[i+63:i] 
k1[j] := 0 

Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
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VPSCATTERQD (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 

i:=j* 32 

k:=j* 64 

IF k1[j] OR *no writemask* 

THEN MEM[BASE_ADDR + (VINDEX[k+63:k]) * SCALE + DISP] := SRC[i+31:i] 
k1[j] := 0 


Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


VPSCATTERQQ (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j:= 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR + (VINDEX[j+63;j]) * SCALE + DISP] := SRC[i+63:i] 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSCATTERDD void __mm512_i32scatter_epi32(void * base,___m512i vdx,__m512i a, int scale); 
VPSCATTERDD void _mm256_i32scatter_epi32(void * base, __ m256i vdx,___ m256i a, int scale); 
VPSCATTERDD void _mm_i32scatter_epi32(void * base,___m128i vdx, __m128i a, int scale); 
VPSCATTERDD void _mm512_mask_i32scatter_epi32(void * base, _ mmask16 k,___m512i vdx, 
VPSCATTERDD void _mm256_mask_i32scatter_epi32(void * base, _ mmask8 k,___ m256i vdx, __m256i a, int scale); 
VPSCATTERDD void _mm_mask_i32scatter_epi32(void * base, __ mmask8 k,___m128i vdx, __m128i a, int scale); 
VPSCATTERDQ void _mm512_i32scatter_epi64(void * base, ___ m256i vdx,___m512i a, int scale); 

VPSCATTERDQ void _mm256_i32scatter_epi64(void * base, __m128i vdx, __m256i a, int scale); 

VPSCATTERDQ void _mm_i32scatter_epi64(void * base, __m128i vdx, __m128i a, int scale); 

VPSCATTERDQ void _mm512_mask_i32scatter_epi64(void * base, __ mmask8 k, __m256i vdx,___m512i a, int scale); 
VPSCATTERDQ void _mm256_mask_i32scatter_epi64(void * base, __ mmask8 k, __m128i vdx, __m256i a, int scale); 
VPSCATTERDQ void _mm_mask_i32scatter_epi64(void * base, __mmask8 k, __m128i vdx, __m128i a, int scale); 
VPSCATTERQD void _mm512_i64scatter_epi32(void * base, ___m512i vdx, __m256i a, int scale); 

VPSCATTERQD void _mm256_i64scatter_epi32(void * base, ___m256i vdx, __m128i a, int scale); 

VPSCATTERQD void _mm_i64scatter_epi32(void * base, __m128i vdx, __m128i a, int scale); 

VPSCATTERQD void _mm512_mask_i64scatter_epi32(void * base, __ mmask8 k, __m512i vdx, __m256i a, int scale); 
VPSCATTERQD void _mm256_mask_i64scatter_epi32(void * base, __ mmask8 k, __m256i vdx, __m128i a, int scale); 
VPSCATTERQD void _mm_mask_i64scatter_epi32(void * base, __mmask8 k, __m128i vdx, __m128i a, int scale); 
VPSCATTERQQ void __mm512_i64scatter_epi64(void * base, __m512i vdx, __m512i a, int scale); 

VPSCATTERQQ void __mm256_i64scatter_epi64(void * base, __m256i vdx, __m256i a, int scale); 

VPSCATTERQQ void __mm_i64scatter_epi64(void * base, ___m128i vdx, __m128i a, int scale); 

VPSCATTERQQ void __mm512_mask_i64scatter_epi64(void * base, __ mmask8 k, __m512i vdx, __m512i a, int scale); 
VPSCATTERQQ void __mm256_mask_i64scatter_epi64(void * base, __mmask8 k, __m256i vdx, __m256i a, int scale); 
VPSCATTERQQ void __mm_mask_i64scatter_epi64(void * base, _ mmask8 k, __m128i vdx, __m128i a, int scale); 


m512i a, int scale); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 
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Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F3A.W1 70 /r /ib A VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDW xmm1{k1}{z}, xmm2, AVX512VL extract result shifted to the left by constant 
xmm3/m128, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.W1 70 /r /ib A VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDW ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the left by constant 
ymm3/m256, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.W1 70 /r /ib A VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDW zmm1{k1}{z}, zmm2, extract result shifted to the left by constant 
zmm3/m51 2, imm8 value in imm8 into zmm1. 
EVEX.128.66.0F3A.WO 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDD xmm1{k1}{z}, xmm2, AVX512VL extract result shifted to the left by constant 
xmm3/m128/m32bcst, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.WO 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDD ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the left by constant 
ymm3/m256/m32bcst, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.WO 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDD zmm1{k1}{z}, zmm2, extract result shifted to the left by constant 
zmm3/m512/m32bcst, imm8 value in imm8 into zmm1. 
EVEX.128.66.0F3A.W1 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDQ xmm1{k1}{z}, xmm2, AVX512VL extract result shifted to the left by constant 
xmm3/m128/m64bcst, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.W1 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDQ ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the left by constant 
ymm3/m256/m64bcst, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.W1 71 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHLDQ zmm1{k1}{z}, zmm2, extract result shifted to the left by constant 
zmm3/m512/m64bcst, imm8 value in imm8 into zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé (r) 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé8 (r) 

Description 

Concatenate packed data, extract result shifted to the left by constant value. 

This instruction supports memory fault suppression. 
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Operation 


VPSHLDW DEST, SRC2, SRC3, imm8 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j :=0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(SRC2.word[j], SRC3.word[j]) << (imm8 & 15) 
DEST.word[j] := tmp.word[1] 
ELSE IF *zeroing*: 
DEST.word[j] := 0 
*ELSE DEST.word[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHLDD DEST, SRC2, SRC3, imm8 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.dword[0] 
ELSE: 
tsrc3 := SRC3.dword{[j] 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(SRC2.dword[j], tsrc3) << (imm8 & 31) 
DEST.dword{[j] := tmp.dword[1] 
ELSE IF *zeroing*: 
DEST.dword{j] := 0 
*ELSE DEST.dword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHLDQ DEST, SRC2, SRC3, imm8 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.qword[0] 
ELSE: 
tsrc3 := SRC3.qword|[j] 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(SRC2.qword[j], tsrc3) << (imm8 & 63) 
DEST.qword{[j] := tmp.qword[1] 
ELSE IF *zeroing*: 
DEST.qword[j] := 0 
*ELSE DEST.qword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 
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VPSHLDD __m128i _mm_shldi_epi32(__m128i, __m128i, int); 

VPSHLDD __m128i__mm_mask_shldi_epi32(__m128i,__ mmask8, __m128i,___m128i, int); 
VPSHLDD __m128i __mm_maskz_shldi_epi32(__mmask8, __m128i,__m128i, int); 

VPSHLDD __m256i __mm256_shldi_epi32(__m256i, __m256i, int); 

VPSHLDD __m256i_mm256_mask_shldi_epi32(__m256i,__ mmask8,__ m256i,___ m256i, int); 
VPSHLDD __m256i __mm256_maskz_shldi_epi32(__mmask8, _ m256i, __ m256i, int); 
VPSHLDD __m512i__mm512_shldi_epi32(__m512i, ___m512i, int); 

VPSHLDD __m512i_mm512_mask_shldi_epi32(__m512i,__ mmask16,___m512i,___m512i, int); 
VPSHLDD __m512i_mm512_maskz_shldi_epi32(__mmask16,__m512i,__m512i, int); 
VPSHLDQ __m128i _mm_shldi_epi64(__m128i, __m128i, int); 

VPSHLDQ __m128i _mm_mask_shldi_epi64(__m128i, __ mmask8, __m128i, __m128i, int); 
VPSHLDQ __m128i _mm_maskz_shldi_epi64(__mmask8, __m128i, __m128i, int); 

VPSHLDQ __m256i __mm256_shldi_epi64(__m256i, __m256i, int); 

VPSHLDQ __m256i _mm256_mask_shldi_epi64(__m256i, __mmask8, __m256i, __m256i, int); 
VPSHLDQ __m256i _mm256_maskz_shldi_epi64(__mmask8, __m256i, __m256i, int); 
VPSHLDQ __m512i __mm512_shldi_epi64(__m512i, __m512i, int); 

VPSHLDQ __m512i_mm512_mask_shldi_epi64(__m512i, __mmask8, __m512i, __m512i, int); 
VPSHLDQ __m512i _mm512_maskz_shldi_epi64(__mmask8, __m512i, __m512i, int); 
VPSHLDW __m128i__mm_shldi_epi16(__m128i, __m128i, int); 

VPSHLDW __m128i__mm_mask_shldi_epi16(__m128i,__ mmask8, __m128i,___m128i, int); 
VPSHLDW __m128i __mm_maskz_shldi_epi16(__mmask8,___m128i,__m128i, int); 

VPSHLDW __m256i __mm256_shldi_epi16(__m256i, __m256i, int); 

VPSHLDW __m256i_mm256_mask_shlidi_epi16(__m256i,__ mmask16, __ m256i, __ m256i, int); 
VPSHLDW __m256i __mm256_maskz_shldi_epi16(__mmask16,___ m256i, __ m256i, int); 
VPSHLDW __m512i__mm512_shldi_epi16(__m512i, __m512i, int); 

VPSHLDW __m512i_mm512_mask_shldi_epi16(__m512i,__ mmask32,___m512i,___m512i, int); 
VPSHLDW __m512i_mm512_maskz_shldi_epi16(__mmask32,___m512i,__m512i, int); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Type E4. 
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VPSHLDV — Concatenate and Variable Shift Packed Data Left Logical 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.W1 70 /r A VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHLDVW xmm1{k1}{z}, xmm2, AVX512VL shifted to the left by value in xmm3/m1 28 into 
xmm3/m128 xmm1. 
EVEX.256.66.0F38.W1 70 /r A VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHLDVW ymm1{k1}{z}, ymm2, AVX512VL shifted to the left by value in xmm3/m256 into 
ymm3/m256 ymm1. 
EVEX.512.66.0F38.W1 70 /r A VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHLDVW zmm1{k1}{z}, zmm2, shifted to the left by value in zmm3/m512 into 
zmm3/m512 zmm1. 
EVEX.128.66.0F38.W0 71 /r B VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHLDVD xmm1{k1}{z}, xmm_2, AVX512VL shifted to the left by value in xmm3/m1 28 into 
xmm3/m128/m32bcst xmm1. 
EVEX.256.66.0F38.W0 71 /r B VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHLDVD ymm1{k1}{z}, ymm2, AVX512VL shifted to the left by value in xmm3/m256 into 
ymm3/m256/m32bcst ymm1. 
EVEX.512.66.0F38.W0 71 /r B VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHLDVD zmm1{k1}{z}, zmm2, shifted to the left by value in zmm3/m512 into 
zmm3/m512/m32bcst zmm1. 
EVEX.128.66.0F38.W1 71 /r B VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHLDVQ xmm1{k1}{z}, xmm2, AVX512VL shifted to the left by value in xmm3/m1 28 into 
xmm3/m128/m64bcst xmm1. 
EVEX.256.66.0F38.W1 71 /r B VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHLDVQ ymm1{k1}{z}, ymm2, AVX512VL shifted to the left by value in xmm3/m256 into 
ymm3/m256/m64bcst ymm1. 
EVEX.512.66.0F38.W1 71 /r B VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHLDVQ zmm1{k1}{z}, zmm2, shifted to the left by value in zmm3/m512 into 
zmm3/m512/m64bcst zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Concatenate packed data, extract result shifted to the left by variable value. 


This instruction supports memory fault suppression. 
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VPSHLDV — Concatenate and Variable Shift Packed Data Left Logical 


Operation 


FUNCTION concat(a,b): 

IF words: 
d.word[1] :=a 
d.word[O] := b 
return d 

ELSE IF dwords: 
q.dword[1] :=a 
q.dword[0] := b 
return q 

ELSE IF qwords: 
o.qword[1] :=a 
o.qword[0] := b 
return o 


VPSHLDVW DEST, SRC2, SRC3 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TOKL-1: 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(DEST.word[j], SRC2.word[j]) << (SRC3.word[j] & 15) 
DEST.word{j] := tmp.word[1] 
ELSE IF *zeroing*: 
DEST.word[j] := 0 
*ELSE DEST.word[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHLDVD DEST, SRC2, SRC3 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.dword[0] 
ELSE: 
tsrc3 := SRC3.dword|j] 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(DEST.dword[j], SRC2.dword[j]) << (tsrc3 & 31) 
DEST.dword{j] := tmp.dword[1] 
ELSE IF *zeroing*: 
DEST.dword[j] := 0 
*ELSE DEST.dword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHLDV — Concatenate and Variable Shift Packed Data Left Logical 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-479 


INSTRUCTION SET REFERENCE, V-Z 


VPSHLDVQ DEST, SRC2, SRC3 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=O TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.qword[0] 
ELSE: 
tsrc3 := SRC3.qword{[j] 
IF MaskBit(j) OR *no writemask*: 
tmp := concat(DEST.qword[j], SRC2.qword[j]) << (tsrc3 & 63) 
DEST.qword{j] := tmp.qword[1] 
ELSE IF *zeroing*: 
DEST.qword[j] := 0 
*ELSE DEST.qword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSHLDVW __m128i __mm_shldv_epi16(__m128i, __m128i,___m128i); 

VPSHLDVW __m128i__mm_mask_shldv_epi16(__m128i,__ mmask8,___m128i, __m128i); 
VPSHLDVW __m128i __mm_maskz_shldv_epi16(__mmask8, __m128i,___m128i, __m128i); 
VPSHLDVW __m256i _mm256_shldv_epi16(__m256i, __ m256i, __m256i); 

VPSHLDVW __m256i__mm256_mask_shldv_epil16(__m256i,__ mmask16, __ m256i, __ m256i); 
VPSHLDVW __m256i __mm256_maskz_shldv_epi16(__mmask16,__m256i,___ m256i, __ m256i); 
VPSHLDVQ___m512i) _mm512_shldv_epi64(__m512i,__m512i,__m512i); 

VPSHLDVQ __m512) _mm512_mask_shldv_epi64(__m512i, __ mmask8, ___m512i,___m512i); 
VPSHLDVQ __m512i) _mm512_maskz_shldv_epi64(__mmask8, __m512i,__m512i,___m512i); 
VPSHLDVW __m128i _mm_shldv_epi16(__m128i, __m128i, __m128i); 

VPSHLDVW __m128i _mm_mask_shldv_epi16(__m128i,__ mmask8, __m128i,___m128i); 
VPSHLDVW __m128i _mm_maskz_shldv_epi16(__mmask8, __m128i,__m128i,__m128i); 
VPSHLDVW __m256i _mm256_shIdv_epi16(__m256i, __m256i, __m256i); 

VPSHLDVW __m256i _mm256_mask_shldv_epi16(__m256i,___ mmask16, __ m256i, __ m256i); 
VPSHLDVW __m256i _mm256_maskz_shldv_epi16(__mmask16,__ m256i,___ m256i,___ m256i); 
VPSHLDVW __m512i _mm512_shIdv_epi16(__m512i, __m512i,___m512i); 

VPSHLDVW __m512i _mm512_mask_shldv_epi16(__m512i,__ mmask32,___m512i,__m512i); 
VPSHLDVW __m512i _mm512_maskz_shldv_epi16(__mmask32,___m512i,___m512i,__m512i); 
VPSHLDVD __m128i _mm_shldv_epi32(__m128i, __m128i, __m128i); 

VPSHLDVD __m128i _mm_mask_shldv_epi32(__m128i, __ mmask8, __m128i, __m128i); 
VPSHLDVD __m128i _mm_maskz_shldv_epi32(__mmask8, __m128i, __m128i, __m128i); 
VPSHLDVD __m256i _mm256_shIdv_epi32(__m256i, __m256i, __m256i); 

VPSHLDVD __m256i _mm256_mask_shldv_epi32(__m256i,__ mmask8, __m256i,__ m256i); 
VPSHLDVD __m256i _mm256_maskz_shldv_epi32(__mmask8,__m256i,__ m256i, __ m256i); 
VPSHLDVD __m512i _mm512_shldv_epi32(__m512i,___m512i, __m512i); 

VPSHLDVD __m512i _mm512_mask_shldv_epi32(__m512i,__ mmask16,__m512i,___m512i); 
VPSHLDVD __m512i _mm512_maskz_shldv_epi32(__mmask16,___m512i,__m512i,__m512i); 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Type E4. 
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VPSHRD — Concatenate and Shift Packed Data Right Logical 


INSTRUCTION SET REFERENCE, V-Z 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F3A.W1 72 /r /ib A VV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDW xmm1{k1}{z}, xmm2, AVX512VL extract result shifted to the right by constant 
xmm3/m128, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.W1 72 /r /ib A VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDW ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the right by constant 
ymm3/m256, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.W1 72 /r /ib A VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDW zmm1{k1}{z}, zmm2, extract result shifted to the right by constant 
zmm3/m512, imm8 value in imm8 into zmm1. 
EVEX.128.66.0F3A.WO 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDD xmm1{k1}{z}, xmm2z, AVX512VL extract result shifted to the right by constant 
xmm3/m128/m32bcst, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.WO 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDD ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the right by constant 
ymm3/m256/m32bcst, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.WO 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDD zmm1{k1}{z}, zmm2, extract result shifted to the right by constant 
zmm3/m512/m32bcst, imm8 value in imm8 into zmm1. 
EVEX.128.66.0F3A.W1 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDQ xmm1{k1}{z}, xmm2, AVX512VL extract result shifted to the right by constant 
xmm3/m128/m64bcst, imm8 value in imm8 into xmm1. 
EVEX.256.66.0F3A.W1 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDQ ymm1{k1}{z}, ymm2, AVX512VL extract result shifted to the right by constant 
ymm3/m256/m64bcst, imm8 value in imm8 into ymm1. 
EVEX.512.66.0F3A.W1 73 /r /ib B VIV AVX512_VBMI2 Concatenate destination and source operands, 
VPSHRDQ zmm1{k1}{z}, zmm2, extract result shifted to the right by constant 
zmm3/m512/m64bcst, imm8 value in imm8 into zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé (r) 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) immé (r) 

Description 

Concatenate packed data, extract result shifted to the right by constant value. 

This instruction supports memory fault suppression. 

VPSHRD — Concatenate and Shift Packed Data Right Logical Vol.2C 5-481 


INSTRUCTION SET REFERENCE, V-Z 


Operation 


VPSHRDW DEST, SRC2, SRC3, imm8 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1: 

IF MaskBit(j) OR *no writemask*: 


DEST.word[j] := concat(SRC3.word[j], SRC2.word[j]) >> (imm8 & 15) 


ELSE IF *zeroing*: 
DEST.word[j] := 0 
*ELSE DEST.word[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHRDD DEST, SRC2, SRC3, imm8 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.dword[0] 
ELSE: 
tsrc3 := SRC3.dword|j] 
IF MaskBit(j) OR *no writemask*: 
DEST.dword{j] := concat(tsrc3, SRC2.dword{j]) >> (imm8 & 31) 
ELSE IF *zeroing*: 
DEST.dword{j] := 0 
*ELSE DEST.dword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHRDQ DEST, SRC2, SRC3, imm8 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.qword[0] 
ELSE: 
tsrc3 := SRC3.qword{[j] 
IF MaskBit(j) OR *no writemask*: 
DEST.qword[j] := concat(tsrc3, SRC2.qword[j]) >> (imm8 & 63) 
ELSE IF *zeroing*: 
DEST.qword{j] := 0 
*ELSE DEST.qword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 
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VPSHRD — Concatenate and Shift Packed Data Right Logical 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSHRDQ __m128i _mm_shrdi_epi64(__m128i, __m128i, int); 
VPSHRDQ __m128i _mm_mask_shrdi_epi64(__m128i, __ mmask8, 
VPSHRDQ __m128i _mm_maskz_shrdi_epi64(__mmask8, __m128i, __m128i, int); 
VPSHRDQ __m256i _mm256_shrdi_epi64(__m256i, __m256i, int); 


VPSHRDQ __m256i _mm256_mask_shrdi_epi64(__m256i, __mmask8, __m256i, __m256i, int); 
m256i,__ m256i, int); 


VPSHRDQ __m256i _mm256_maskz_shrdi_epi64(__mmask8, 
VPSHRDQ __m512i _mm512_shrdi_epi64(__m512i, __m512i, int); 
VPSHRDQ __m512i _mm512_mask_shrdi_epi64(__m512i, __ mmask8, 


m512i, 


VPSHRDQ __m512i _mm512_maskz_shrdi_epi64(__mmask8, __m512i, __m512i, int); 


VPSHRDD __m128i __mm_shrdi_epi32(__m128i, __m128i, int); 


VPSHRDD __m128i __mm_mask_shrdi_epi32(__m128i,__ mmask8, __m128i,__m128i, int); 


VPSHRDD __m128i __mm_maskz_shrdi_epi32(__mmask8, ___m128i, 
VPSHRDD __m256i _mm256_shrdi_epi32(__m256i, __m256i, int); 
VPSHRDD __m256i__mm256_mask_shrdi_epi32(__m256i,__ mmask8, __m256i, 
VPSHRDD __m256i __mm256_maskz_shrdi_epi32(__mmask8, __m256i, 
VPSHRDD __m512i __mm512_shrdi_epi32(__m512i, __m512i, int); 

VPSHRDD __m512i_mm512_mask_shrdi_epi32(__m512i,__ mmask16,___m512i, 


m1 28i, int); 


VPSHRDD __m512i_mm512_maskz_shrdi_epi32(__mmask16, __m512i, 
VPSHRDW __m128i__mm_shrdi_epi16(__m128i, __m128i, int); 
VPSHRDW __m128i __mm_mask_shrdi_epi16(__m128i,__ mmask8, __m128i, 


VPSHRDW __m128i __mm_maskz_shrdi_epi16(__mmask8, __m128i,___m128i, int); 
VPSHRDW __m256i __mm256_shrdi_epi16(__m256i, __m256i, int); 


VPSHRDW __m256i_mm256_mask_shrdi_epi16(__m256i,__ mmask16,___ m256i, __m256i, int); 
m256i, int); 


VPSHRDW __m256i__mm256_maskz_shrdi_epi16(__mmask16, __m256i, 
VPSHRDW __m512i__mm512_shrdi_epi16(__m512i, __m512i, int); 

VPSHRDW __m512i__mm512_mask_shrdi_epi16(__m512i,___ mmask32, 
VPSHRDW __m512i_mm512_maskz_shrdi_epi16(__mmask32,___m512i, 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Type E4. 


VPSHRD — Concatenate and Shift Packed Data Right Logical 


m128i,__m128i, int); 


m256i, int); 


m512i, int); 


m1 28i, int); 


m512i,__m512i, int); 
m51 2i, int); 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-483 


INSTRUCTION SET REFERENCE, V-Z 


VPSHRDV — Concatenate and Variable Shift Packed Data Right Logical 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.W1 72 /r A VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHRDVW xmm1{k1}{z}, xmm2, AVX512VL shifted to the right by value in xmm3/m128 
xmm3/m128 into xmm1. 
EVEX.256.66.0F38.W1 72 /r A VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHRDVW ymm1{k1}{z}, ymm2, AVX512VL shifted to the right by value in xmm3/m256 
ymm3/m256 into ymm1. 
EVEX.512.66.0F38.W1 72 /r A VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHRDVW zmm1{k1}{z}, zmm2, shifted to the right by value in zmm3/m512 
zmm3/m512 into zmm1. 
EVEX.128.66.0F38.W0 73 /r B VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHRDVD xmm1{k1}{z}, xmm2, AVX512VL shifted to the right by value in xmm3/m128 
xmm3/m128/m32bcst into xmm1. 
EVEX.256.66.0F38.W0 73 /r B VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHRDVD ymm1{k1}{z}, ymm2, AVX512VL shifted to the right by value in xmm3/m256 
ymm3/m256/m32bcst into ymm1. 
EVEX.512.66.0F38.W0 73 /r B VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHRDVD zmm1{k1}{z}, zmm2, shifted to the right by value in zmm3/m512 
zmm3/m512/m32bcst into zmm1. 
EVEX.128.66.0F38.W1 73 /r B VIN AVX512_VBMI2 Concatenate xmm1 and xmm2, extract result 
VPSHRDVQ xmm1{k1}{z}, xmm2, AVX512VL shifted to the right by value in xmm3/m128 
xmm3/m128/m64bcst into xmm1. 
EVEX.256.66.0F38.W1 73 /r B VIV AVX512_VBMI2 Concatenate ymm1 and ymm2, extract result 
VPSHRDVQ ymm1{k1}{z}, ymm2, AVX512VL shifted to the right by value in xmm3/m256 
ymm3/m256/m64bcst into ymm1. 
EVEX.512.66.0F38.W1 73 /r B VIN AVX512_VBMI2 Concatenate zmm1 and zmm2, extract result 
VPSHRDVQ zmm1{k1}{z}, zmm2, shifted to the right by value in zmm3/m512 
zmm3/m512/m64bcst into zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Concatenate packed data, extract result shifted to the right by variable value. 
This instruction supports memory fault suppression. 
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VPSHRDV — Concatenate and Variable Shift Packed Data Right Logical 


Operation 


VPSHRDVW DEST, SRC2, SRC3 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1: 

IF MaskBit(j) OR *no writemask*: 


DEST.word[j] := concat(SRC2.word[j], DEST.word[j]) >> (SRC3.word[j] & 15) 


ELSE IF *zeroing*: 
DEST.word[j] := 0 
*ELSE DEST.word[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHRDVD DEST, SRC2, SRC3 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.dword[0] 
ELSE: 
tsrc3 := SRC3.dword|j] 
IF MaskBit(j) OR *no writemask*: 
DEST.dword[j] := concat(SRC2.dword{j], DEST.dword[j]) >> (tsrc3 & 31) 
ELSE IF *zeroing*: 
DEST.dword[j] := 0 
*ELSE DEST.dword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHRDVQ DEST, SRC2, SRC3 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TOKL-1: 
IF SRC3 is broadcast memop: 
tsrc3 := SRC3.qword[0] 
ELSE: 
tsrc3 := SRC3.qword|j] 
IF MaskBit(j) OR *no writemask*: 
DEST.qword[j] := concat(SRC2.qword[j], DEST.qword[j]) >> (tsrc3 & 63) 
ELSE IF *zeroing*: 
DEST.qword[j] := 0 
*ELSE DEST.qword[j] remains unchanged* 
DEST[MAX_VL-1:VL] := 0 


VPSHRDV — Concatenate and Variable Shift Packed Data Right Logical 


INSTRUCTION SET REFERENCE, V-Z 


Vol.2C 5-485 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSHRDVQ ___m128i _mm_shrdv_epi64(__m128i, m128i); 

VPSHRDVQ __m128i _mm_mask_shrdv_epi64(__m128i, __ mmask8, __m128i, __m128i); 
VPSHRDVQ __m128i _mm_maskz_shrdv_epi64( m128i,__m128i,__m128i); 
VPSHRDVQ ___m256i _mm256_shrdv_epi64( m256i, __m256i); 

VPSHRDVQ __m256i _mm256_mask_shrdv_epi64( mmask8,___m256i,__ m256i); 
VPSHRDVQ ___m256i _mm256_maskz_shrdv_epi64(__mmask8, __m256i,__m256i, __m256i); 
VPSHRDVQ__m512i _mm512_shrdv_epi64( m512i,___m512i); 

VPSHRDVQ ___m512i _mm512_mask_shrdv_epi64( mmask8, _m512i,__m512i); 
VPSHRDVQ___m512i _mm512_maskz_shrdv_epi64(__mmask8, __m512i,__m512i,__m512i); 
VPSHRDVD __m128i __mm_shrdv_epi32( m128i); 

VPSHRDVD __m128i __mm_mask_shrdv_epi32( mmask8, __m128i,__m128i); 
VPSHRDVD __m128i__mm_maskz_shrdv_epi32( m128i,__m128i,__m128i); 
VPSHRDVD __m256i __mm256_shrdv_epi32(__m256i, __m256i, __m256i); 

VPSHRDVD __m256i __mm256_mask_shrdv_epi32( mmask8,__m256i,__ m256i); 
VPSHRDVD __m256i__mm256_maskz_shrdv_epi32( m256i,__ m256i,___ m256i); 
VPSHRDVD __m512i__mm512_shrdv_epi32(__m512i,___m512i, ___m512i); 

VPSHRDVD __m512i_mm512_mask_shrdv_epi32( mmask16,__m512i,___m512i); 
VPSHRDVD __m512i_mm512_maskz_shrdv_epi32(__mmask16,___m512i,__m512i,___m512i); 
VPSHRDVW __m128i__mm_shrdv_epi16(__m128i, m1 28i); 

VPSHRDVW __m128i __mm_mask_shrdv_epi16( mmask8, __m128i,__m128i); 
VPSHRDVW __m128i__mm_maskz_shrdv_epi16( m128i,__m128i,__m128i); 
VPSHRDVW __m256i _mm256 m256i,__m256i); 

VPSHRDVW __m256i _mm256_mask_shrdv_epi16( mmask16,__m256i,___ m256i); 
VPSHRDVW __m256i __mm256_maskz_shrdv_epi16(__mmask16,__ m256i,__ m256i,__ m256i); 
VPSHRDVW __m512i__mm512 m512i,__m512i); 

VPSHRDVW __m512i_mm512_mask_shrdv_epi16( mmask32,__m512i,__m512i); 
VPSHRDVW __m512i_mm512_maskz_shrdv_epi16(__mmask32,___m512i,__m512i,__m512i); 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


See Type E4. 
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VPSHRDV — Concatenate and Variable Shift Packed Data Right Logical 


INSTRUCTION SET REFERENCE, V-Z 


VPSHUFBITQMB — Shuffle Bits from Quadword Elements Using Byte Indexes into Mask 


Opcode/ Op/ 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.128.66.0F38.WO 8F /r A VIV AVX512_BITALG Extract values in xmm2 using control bits of 
VPSHUFBITOMB k1{k2}, xmm2, AVX512VL xmm3/m128 with writemask k2 and leave the 
xmm3/m128 result in mask register k1. 
EVEX.256.66.0F38.WO 8F /r A VIV AVX512_BITALG Extract values in ymm2 using control bits of 
VPSHUFBITOMB k1{k2}, ymm2, AVX512VL ymm3/m256 with writemask k2 and leave the 
ymm3/m256 result in mask register k1. 
EVEX.512.66.0F38.WO 8F /r A VIV AVX512_BITALG Extract values in zmm_2 using control bits of 
VPSHUFBITOMB k1{k2}, zmm2, zmm3/m51 2 with writemask k2 and leave the 
zmm3/m512 result in mask register k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


The VPSHUFBITQMB instruction performs a bit gather select using second source as control and first source as 
data. Each bit uses 6 control bits (2nd source operand) to select which data bit is going to be gathered (first source 
operand). A given bit can only access 64 different bits of data (first 64 destination bits can access first 64 data bits, 
second 64 destination bits can access second 64 data bits, etc.). 

Control data for each output bit is stored in 8 bit elements of SRC2, but only the 6 least significant bits of each 
element are used. 


This instruction uses write masking (zeroing only). This instruction supports memory fault suppression. 


The first source operand is a ZMM register. The second source operand is a ZMM register or a memory location. The 
destination operand is a mask register. 


Operation 


VPSHUFBITQMB DEST, SRC1, SRC2 
(KL, VL) = (16,128), (32,256), (64, 512) 
FOR i := 0 TO KL/8-1: //Qword 
FOR j := 0 to 7: // Byte 
IF k2[i*8+j] or *no writemask*: 
m := SRC2.qword{[i].byte[j] & Ox3F 
k1[i*8+j] = SRC1.qword[i].bit[m] 
ELSE: 
k1[i*8+j] := 0 
k1[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSHUFBITQMB __mmask16 _mm_bitshuffle_epi64_mask(__m128i, 


m128i); 


VPSHUFBITQMB __mmask16 _mm_mask_bitshuffle_epi64_mask(__mmask16, __m128i, __m128i); 
VPSHUFBITQMB __mmask32 _mm256_bitshuffle_epi64_mask(__m256i, __m256i); 

VPSHUFBITQMB __mmask32 _mm256_mask_bitshuffle_epi64_mask(__mmask32, __m256i, __m256i); 
VPSHUFBITQMB __mmask64 __mm512_bitshuffle_epi64_mask(__m512i, __m512i); 

VPSHUFBITQMB __mmask64 _mm512_mask_bitshuffle_epi64_mask(__mmask64, __m512i,___m512i); 


VPSHUFBITQMB — Shuffle Bits from Quadword Elements Using Byte Indexes into Mask Vol.2C 5-487 


INSTRUCTION SET REFERENCE, V-Z 


VPSLLVW/VPSLLVD/VPSLLVQ—Variable Bit Shift Left Logical 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W0O 47 /r A VV AVX2 Shift doublewords in xmm2 left by amount specified in 
VPSLLVD xmm1, xmm2, xmm3/m128 the corresponding element of xmm3/m1 28 while 
shifting in Os. 
VEX.128.66.0F38.W1 47 /r A VV AVX2 Shift quadwords in xmmz left by amount specified in 
VPSLLVQ xmm1, xmm2, xmm3/m128 the corresponding element of xmm3/m1 28 while 
shifting in Os. 
VEX.256.66.0F38.W0O 47 /r A VV AVX2 Shift doublewords in ymm2 left by amount specified in 
VPSLLVD ymm1, ymm2, ymm3/m256 the corresponding element of ymm3/m256 while 
shifting in Os. 
VEX.256.66.0F38.W1 47 /r A VV AVX2 Shift quadwords in ymm2 left by amount specified in 
VPSLLVQ ymm1, ymm2, ymm3/m256 the corresponding element of ymm3/m256 while 
shifting in Os. 
EVEX.128.66.0F38.W1 12 /r B VIV AVX512VL_ | Shift words in xmm2 left by amount specified in the 
VPSLLVW xmm1 {k1}{z}, xmm_2, AVX512BW | corresponding element of xmm3/m128 while shifting 
xmm3/m128 in Os using writemask k1. 
EVEX.256.66.0F38.W1 12 /r B VIV AVX512VL_ | Shift words in ymm2 left by amount specified in the 
VPSLLVW ymm1 {k1}{z}, ymm2, AVX512BW | corresponding element of ymm3/m256 while shifting 
ymm3/m256 in Os using writemask k1. 
EVEX.512.66.0F38.W1 12 /r B VIV AVX512BW | Shift words in zmm2 left by amount specified in the 
VPSLLVW zmm1 {k1}{z}, zmm2, corresponding element of zmm3/m512 while shifting 
zmm3/m512 in Os using writemask k1. 
EVEX.128.66.0F38.W0 47 /r C VIV AVX512VL_ | Shift doublewords in xmmz left by amount specified in 
VPSLLVD xmm1 {k1}{z}, xmm2, AVX512F the corresponding element of xmm3/m128/m32bcst 
xmm3/m1 28/m32bcst while shifting in Os using writemask k1. 
EVEX.256.66.0F38.W0 47 /r C VIV AVX512VL_ | Shift doublewords in ymm2 left by amount specified in 
VPSLLVD ymm1 {k1}{z}, ymm2, AVX512F the corresponding element of ymm3/m256/m32bcst 
ymm3/m256/m32bcst while shifting in Os using writemask k1. 
EVEX.512.66.0F38.W0 47 /r C VIV AVX512F Shift doublewords in zmm_2 left by amount specified in 
VPSLLVD zmm1 {k1}{z}, zmm2, the corresponding element of zmm3/m512/m32bcst 
zmm3/m512/m32bcst while shifting in Os using writemask k1. 
EVEX.128.66.0F38.W1 47 /r C VIV AVX512VL_ | Shift quadwords in xmm2 left by amount specified in 
VPSLLVQ xmm1 {k1}{z}, xmm2, AVX512F the corresponding element of xmm3/m128/m64bcst 
xmm3/m1 28/m64bcst while shifting in Os using writemask k1. 
EVEX.256.66.0F38.W1 47 /r C VIV AVX512VL_ | Shift quadwords in ymm2 left by amount specified in 
VPSLLVQ ymm1 {k1}{z}, ymm2, AVX512F the corresponding element of ymm3/m256/m64bcst 
ymm3/m256/m64bcst while shifting in Os using writemask k1. 
EVEX.512.66.0F38.W1 47 /r C VIV AVX512F Shift quadwords in zmm2 left by amount specified in 
VPSLLVQ zmm1 {k1}{z}, zmm2, the corresponding element of zmm3/m512/m64bcst 
zmm3/m512/m64bcst while shifting in Os using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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INSTRUCTION SET REFERENCE, V-Z 


Description 


Shifts the bits in the individual data elements (words, doublewords or quadword) in the first source operand to the 
left by the count value of respective data elements in the second source operand. As the bits in the data elements 
are shifted left, the empty low-order bits are cleared (set to 0). 


The count values are specified individually in each data element of the second source operand. If the unsigned 
integer value specified in the respective data element of the second source operand is greater than 15 (for word), 
31 (for doublewords), or 63 (for a quadword), then the destination data element are written with 0. 

VEX.128 encoded version: The destination and first source operands are XMM registers. The count operand can be 
either an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination register 
are zeroed. 

VEX.256 encoded version: The destination and first source operands are YMM registers. The count operand can be 
either an YMM register or a 256-bit memory. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 
EVEX encoded VPSLLVD/Q: The destination and first source operands are ZMM/YMM/XMM registers. The count 
operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512-bit vector broad- 
casted from a 32/64-bit memory location. The destination is conditionally updated with writemask k1. 

EVEX encoded VPSLLVW: The destination and first source operands are ZMM/YMM/XMM registers. The count 
operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is condition- 
ally updated with writemask k1. 


Operation 


VPSLLVW (EVEX encoded version) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] = ZeroExtend(SRC1[i+15:i] << SRC2[i+15:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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VPSLLVD (VEX.128 version) 
COUNT_O := SRC2[31 : 0] 
(* Repeat Each COUNT_i for the 2nd through 4th dwords of SRC2*) 
COUNT_3 := SRC2[127 : 96]; 
IF COUNT_O < 32 THEN 
DEST[31:0] := ZeroExtend(SRC1[31:0] << COUNT_O); 
ELSE 
DEST[31:0] := 0; 
(* Repeat shift operation for 2nd through 4th dwords *) 
IF COUNT_3 < 32 THEN 
DEST[1 27:96] := ZeroExtend(SRC1[127:96] << COUNT_3); 
ELSE 
DEST[127:96] := 0; 
DEST[MAXVL-1:128] := 0; 


VPSLLVD (VEX.256 version) 
COUNT_O := SRC2[31 : OJ; 
(* Repeat Each COUNT_i for the 2nd through 7th dwords of SRC2*) 
COUNT_7 := SRC2[255 : 224]; 
IF COUNT_O < 32 THEN 
DEST[31:0] := ZeroExtend(SRC1[31:0] << COUNT_O); 
ELSE 
DEST[31:0] := 0; 
(* Repeat shift operation for 2nd through 7th dwords *) 
IF COUNT_7 < 32 THEN 
DEST[255:224] := ZeroExtend(SRC1[255:224] << COUNT_7); 
ELSE 
DEST[255:224] := 0; 
DEST[MAXVL-1:256] := 0; 


VPSLLVD (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] = ZeroExtend(SRC1[i+31:i] << SRC2[31:0]) 
ELSE DEST[i+31:i] := ZeroExtend(SRC1[i+31:i] << SRC2[i+31:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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VPSLLVW/VPSLLVD/VPSLLVQ—Variable Bit Shift Left Logical 


VPSLLVQ (VEX.128 version) 

COUNT_O := SRC2[63 : 0]; 

COUNT_1 := SRC2[127 : 64]; 

IF COUNT_O < 64THEN 

DEST[63:0] := ZeroExtend(SRC1[63:0] << COUNT_O); 
ELSE 

DEST[63:0] := 0; 

IF COUNT_1 < 64 THEN 

DEST[1 27:64] := ZeroExtend(SRC1[127:64] << COUNT_1); 
ELSE 

DEST[127:96] := 0; 

DEST[MAXVL-1:1 28] := 0; 


VPSLLVQ (VEX.256 version) 
COUNT_O := SRC2[63 : 0]; 
(* Repeat Each COUNT_i for the 2nd through 4th dwords of SRC2*) 
COUNT_3 := SRC2[255 : 192]; 
IF COUNT_O < G4THEN 
DEST[63:0] := ZeroExtend(SRC1[63:0] << COUNT_O); 
ELSE 
DEST[63:0] := 0; 
(* Repeat shift operation for 2nd through 4th dwords *) 
IF COUNT_3 < 64 THEN 
DEST[255:192] := ZeroExtend(SRC1[255:192] << COUNT_3); 
ELSE 
DEST[255:192] := 0; 
DEST[MAXVL-1:256] := 0; 


VPSLLVQ (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] := ZeroExtend(SRC1[i+63:i] << SRC2[63:0]) 
ELSE DEST[i+63:i] := ZeroExtend(SRC1[i+63:i] << SRC2[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VPSLLVW 
VPSLLVW 
VPSLLVW 
VPSLLVW 
VPSLLVW 
VPSLLVW 
VPSLLVW 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVQ 
VPSLLVQ 
VPSLLVQ 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVD 
VPSLLVQ 


m512i_mm512_sllv_epi16(__m512i a,__m512i cnt); 
m512i_mm512_mask_sllv_epi16(__m512is,__ mmask32 k,__m512i a,__m512i cnt); 
m512i_mm512_maskz_sllv_epi16(__mmask32 k, __m512ia,__m512i cnt); 
m256i_mm256_mask_sllv_epi16(__m256i s,__ mmask16 k,___ m256i a,__ m256i cnt); 
m256i__mm256_maskz_sllv_epi16(__mmask16 k, __ m256i a,__ m256i cnt); 
m128i_mm_mask_sllv_epi16(__m128is,__ mmask8 k,___m128i a,__m128i cnt); 
m128i_mm_maskz_sllv_epi16(__mmask8 k,___m128i a,__m128i cnt); 
m512i_mm512_sllv_epi32(__m512i a,__m512i cnt); 


m512i 


m512i 


mm512_mask_sllv_epi32(__m512is,__ mmask16 k,___m512ia,__m512i cnt); 
mm512_maskz_sllv_epi32(__mmask16 k,__m512i a,__m512i cnt); 


m256i 


mm256_mask_sllv_epi32(__m256is,__ mmask8 k,___ m256i a,___ m256i cnt); 


m256i 


mm256_maskz_sllv_epi32(__mmask8 k,__ m256i a,__ m256i cnt); 


m128i 


mm_mask_sllv_epi32(__m128is,__ mmask8 k,___m128i a,__m128i cnt); 


m128i 


mm_maskz_sllv_epi32(__mmask8 k,__m128i a, __m128i cnt); 


m512i 


mm512_sllv_epi64(__m512i a,__m512i cnt); 


m512i 


mm512_mask_sllv_epi64(__m512is,__ mmask8 k,___m512i a,__m512i cnt); 
mm512_maskz_sllv_epi64(__mmask8 k,__m512i a, __m512i cnt); 


mmask8 k,___m256i a, __m256i cnt); 


mm256_maskz_sllv_epi64(__ mmask8 k,__ m256i a,__ m256i cnt); 


mm_mask_sllv_epi64(__m128is,__ mmask8 k,___m128i a,__m128i cnt); 


m128i a,__m128i cnt); 


m512i 
m256i__mm256_mask_sllv_epi64(__m256i s, 
m256i 

m128i 

m128i __mm_maskz_sllv_epi64(__mmask8 k, 
m256i_mm256_sllv_epi32 (__m256i m, 


m256i count) 


m256i 


m256i count) 


mm256_sllv_epi64 (__m256i m, 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
VEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPSLLVD/VPSLLVQ, see Table 2-49, “Type E4 Class Exception Conditions”. 

EVEX-encoded VPSLLVW, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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VPSLLVW/VPSLLVD/VPSLLVQ—Variable Bit Shift Left Logical 


INSTRUCTION SET REFERENCE, V-Z 


VPSRAVW/VPSRAVD/VPSRAVQ—Variable Bit Shift Right Arithmetic 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
VEX.128.66.0F38.W0 46 /r A VIV AVX2 Shift doublewords in xmm_2 right by amount specified 
VPSRAVD xmm1, xmm2, xmm3/m128 in the corresponding element of xmm3/m128 while 
shifting in sign bits. 
VEX.256.66.0F38.W0 46 /r A VIV AVX2 Shift doublewords in ymm2 right by amount specified 
VPSRAVD ymm1, ymm2, ymm3/m256 in the corresponding element of ymm3/m256 while 
shifting in sign bits. 
EVEX.128.66.0F38.W1 11 /r B VIV AVX512VL_ | Shift words in xmm2 right by amount specified in the 
VPSRAVW xmm1 {k1}{z}, xmm2, AVX512BW | corresponding element of xmm3/m1 28 while shifting 
xmm3/m128 in sign bits using writemask k1. 
EVEX.256.66.0F38.W1 11 /r B VIV AVX512VL_ | Shift words in ymm2 right by amount specified in the 
VPSRAVW ymm1 {k1}{z}, ymm2, AVX512BW | corresponding element of ymm3/m256 while shifting 
ymm3/m256 in sign bits using writemask k1. 
EVEX.512.66.0F38.W1 11 /r B VIV AVX512BW | Shift words in zmm_2 right by amount specified in the 
VPSRAVW zmm1 {k1}{z}, zmm2, corresponding element of zmm3/m512 while shifting 
zmm3/m512 in sign bits using writemask k1. 
EVEX.128.66.0F38.W0O 46 /r C VIV AVX512VL_ | Shift doublewords in xmm2 right by amount specified 
VPSRAVD xmm1 {k1}{z}, xmm2, AVX512F in the corresponding element of 
xmm3/m128/m32bcst xmm3/m128/m32bcst while shifting in sign bits 
using writemask k1. 
EVEX.256.66.0F38.W0 46 /r C VIV AVX512VL_ | Shift doublewords in ymm2 right by amount specified 
VPSRAVD ymm1 {k1}{z}, ymm2, AVX512F in the corresponding element of 
ymm3/m256/m32bcst ymm3/m256/m32bcst while shifting in sign bits 
using writemask k1. 
EVEX.512.66.0F38.W0 46 /r C VIV AVX512F Shift doublewords in zmm2 right by amount specified 
VPSRAVD zmm1 {k1}{z}, zmm2, in the corresponding element of 
zmm3/m512/m32bcst zmm3/m512/m32bcst while shifting in sign bits using 
writemask k1. 
EVEX.128.66.0F38.W1 46 /r C VIV AVX512VL_ | Shift quadwords in xmm2 right by amount specified 
VPSRAVQ xmm1 {k1}{z}, xmm2, AVX512F in the corresponding element of 
xmm3/m128/m64bcst xmm3/m128/m64bcst while shifting in sign bits 
using writemask k1. 
EVEX.256.66.0F38.W1 46 /r C VIV AVX512VL_ | Shift quadwords in ymm2 right by amount specified 
VPSRAVQ ymm1 {k1}{z}, ymm2, AVX512F in the corresponding element of 
ymm3/m256/m64bcst ymm3/m256/m64bcst while shifting in sign bits 
using writemask k1. 
EVEX.512.66.0F38.W1 46 /r C VIV AVX512F Shift quadwords in zmm_2 right by amount specified in 
VPSRAVQ zmm1 {k1}{z}, zmm2, the corresponding element of zmm3/m512/m64bcst 
zmm3/m512/m64bcst while shifting in sign bits using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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INSTRUCTION SET REFERENCE, V-Z 


Description 


Shifts the bits in the individual data elements (word/doublewords/quadword) in the first source operand (the 
second operand) to the right by the number of bits specified in the count value of respective data elements in the 
second source operand (the third operand). As the bits in the data elements are shifted right, the empty high-order 
bits are set to the MSB (sign extension). 


The count values are specified individually in each data element of the second source operand. If the unsigned 
integer value specified in the respective data element of the second source operand is greater than 15 (for words), 
31 (for doublewords), or 63 (for a quadword), then the destination data element is filled with the corresponding 
sign bit of the source element. 


VEX.128 encoded version: The destination and first source operands are XMM registers. The count operand can be 
either an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination register 
are zeroed. 

VEX.256 encoded version: The destination and first source operands are YMM registers. The count operand can be 
either an YMM register or a 256-bit memory. Bits (MAXVL-1:256) of the corresponding destination register are 
zeroed. 

EVEX.512/256/128 encoded VPSRAVD/W: The destination and first source operands are ZMM/YMM/XMM registers. 
The count operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128- 
bit vector broadcasted from a 32/64-bit memory location. The destination is conditionally updated with writemask 
k1. 

EVEX.512/256/128 encoded VPSRAVQ: The destination and first source operands are ZMM/YMM/XMM registers. 
The count operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is 
conditionally updated with writemask k1. 


Operation 


VPSRAVW (EVEX encoded version) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 


i:=j*16 
IF k1[j] OR *no writemask* 
THEN 
COUNT := SRC2[i+3:i] 
IF COUNT < 16 
THEN = DEST[i+15:i] := SignExtend(SRC1[i+15:i] >> COUNT) 
ELSE 
FORK :=0T015 
DEST[i+k] := SRC1[i+15] 
ENDFOR; 
Fl 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{i+1 5:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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VPSRAVD (VEX.128 version) 
COUNT_O := SRC2[31 : 0] 

(* Repeat Each COUNT_i for the 2nd through 4th dwords of SRC2*) 
COUNT_3 := SRC2[127 : 96]; 
DEST[31:0] := SignExtend(SRC1[31:0] >> COUNT_0); 

(* Repeat shift operation for 2nd through 4th dwords *) 
DEST[1 27:96] := SignExtend(SRC1[127:96] >> COUNT_3); 
DEST[MAXVL-1:1 28] := 0; 


VPSRAVD (VEX.256 version) 
COUNT_O := SRC2[31 : 0]; 

(* Repeat Each COUNT_i for the 2nd through 8th dwords of SRC2*) 
COUNT_7 := SRC2[255 : 224]; 
DEST[31:0] := SignExtend(SRC1[31:0] >> COUNT_O); 

(* Repeat shift operation for 2nd through 7th dwords *) 
DEST[255:224] := SignExtend(SRC1[255:224] >> COUNT_7); 
DEST[MAXVL-1:256] := 0; 


VPSRAVD (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


THEN 
COUNT := SRC2[4:0] 
IF COUNT < 32 
THEN — DEST[i+31:i] := SignExtend(SRC1[i+31:i] >> COUNT) 
ELSE 
FOR k := 0 TO 31 
DEST[i+k] := SRC1[i+31] 
ENDFOR; 
Fl 
ELSE 
COUNT := SRC2[i+4:i] 
IF COUNT < 32 
THEN — DEST[i+31:i] := SignExtend(SRC1[i+31:i] >> COUNT) 
ELSE 
FOR k := 0 TO 31 
DEST[i+k] := SRC1[i+31] 
ENDFOR; 
Fl 
Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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VPSRAVQ (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN 
COUNT := SRC2[5:0] 
IF COUNT < 64 
THEN — DEST[i+63:i] := SignExtend(SRC1[i+63:i] >> COUNT) 
ELSE 
FOR k := 0 T0 63 
DEST[i+k] := SRC1[i+63] 
ENDFOR; 
Fl 
ELSE 
COUNT := SRC2[i+5:i] 
IF COUNT < 64 
THEN —DEST[i+63:i] := SignExtend(SRC1[i+63:i] >> COUNT) 
ELSE 
FOR k := 0 T0 63 
DEST[i+k] := SRC1[i+63] 
ENDFOR; 
Fl 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0; 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPSRAVD __m512i 


mm512_srav_epi32(__m512i a, ___m512i cnt); 


VPSRAVD __m512i 


mm512_mask_srav_epi32(__m512i s,__ mmask16 m, 


VPSRAVD __m512i 


m512ia,__m512i cnt); 


mm512_maskz_srav_epi32(__mmask16 m,__m512i a, ___m512i cnt); 


VPSRAVD __m256i 


mm256_srav_epi32(__m256i a, __ m256i cnt); 


VPSRAVD __m256i 


mm256_mask_srav_epi32(__m256i s,__ mmask8 m,___ m256i a, __m256i cnt); 


VPSRAVD __m256i 


mm256_maskz_srav_epi32(__mmask8 m,__m256i a, __ m256i cnt); 


VPSRAVD __m128i 


VPSRAVD __m128i 


mm_srav_epi32(__m128i a, __m128i cnt); 


VPSRAVD __m128i 


VPSRAVQ __m512i 


VPSRAVQ __m512i 


VPSRAVQ __m512i 


VPSRAVQ __m256i 


VPSRAVQ __m256i 


mm_mask_srav_epi32(__m128is,__ mmask8 m, __m128i a, _m128i cnt); 
mm_maskz_srav_epi32(__mmask8 m,__m128i a, __m128i cnt); 
mm512_srav_epi64(__m512ia,__m512i cnt); 
mm512_mask_srav_epi64(__m512is,__ mmask8 m,___m512i a, __m512i cnt); 
mm512_maskz_srav_epi64(__ mmask8 m,___m512i a,_m512i cnt); 
mm256_srav_epi64(__m256i a, __ m256i cnt); 
mm256_mask_srav_epi64(__m256i s,__ mmask8 m, __m256i a, ___m256i cnt); 


VPSRAVQ __m256i 


mm256_maskz_srav_epi64(__mmask8 m,___m256i a, __m256i cnt); 


VPSRAVQ __m128i 


VPSRAVQ __m128i 


mm_srav_epi64(__m128i a, __m128i cnt); 
mm_mask_srav_epi64(__m128is,__ mmask8 m,__m128i a,__m128i cnt); 


VPSRAVQ __m128i 


VPSRAVW __m512i 


VPSRAVW __m512i 


mm_maskz_srav_epi64(__mmask8 m, __m128i a,__m128i cnt); 
mm512_srav_epi16(__m512ia,__m512i cnt); 
mm512_mask_srav_epi16(__m512is,__ mmask32 m,__m512i a, _m512i cnt); 


VPSRAVW __m512i 


mm512_maskz_srav_epi16(__mmask32 m,__m512i a, ___m512i cnt); 


VPSRAVW __m256i 


mm256_srav_epi16(__m256i a, ___ m256i cnt); 


VPSRAVW __m256i 


VPSRAVW __m256i 


mm256_mask_srav_epi16(__m256i s,___ mmask16 m,___m256i a, ___m256i cnt); 
mm256_maskz_srav_epi16(__mmask16 m,__m256i a, __m256i cnt); 


VPSRAVW __m128i 


mm_srav_epil16(__m128i a, __m128i cnt); 


VPSRAVW __m128i 


mm_mask_srav_epi16(__m128is,__ mmask8 m, __m128i a,__m128i cnt); 


VPSRAVW __m128i 


mm_maskz_srav_epi32(__mmask8 m,_m128i a, ___m128i cnt); 


VPSRAVD __m256i 


mm256_srav_epi32 (__m256i m, __m256i count) 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions”. 
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VPSRLVW/VPSRLVD/VPSRLVQ—Variable Bit Shift Right Logical 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
VEX.128.66.0F38.W0 45 /r A VIV AVX2 Shift doublewords in xmm2 right by amount specified 
VPSRLVD xmm1, xmm2, xmm3/m128 in the corresponding element of xmm3/m128 while 
shifting in Os. 
VEX.128.66.0F38.W1 45 /r A VIV AVX2 Shift quadwords in xmm_2 right by amount specified in 
VPSRLVQ xmm1, xmm2, xmm3/m128 the corresponding element of xmm3/m1 28 while 
shifting in Os. 
VEX.256.66.0F38.W0 45 /r A VIV AVX2 Shift doublewords in ymm2 right by amount specified 
VPSRLVD ymm1, ymm2, ymm3/m256 in the corresponding element of ymm3/m256 while 
shifting in Os. 
VEX.256.66.0F38.W1 45 /r A VIV AVX2 Shift quadwords in ymm_2 right by amount specified in 
VPSRLVQ ymm1, ymm2, ymm3/m256 the corresponding element of ynm3/m256 while 
shifting in Os. 
EVEX.128.66.0F38.W1 10 /r B VIV AVX512VL_ | Shift words in xmm2 right by amount specified in the 
VPSRLVW xmm1 {k1}{z}, xmme2, AVX512BW | corresponding element of xmm3/m128 while shifting 
xmm3/m128 in Os using writemask k1. 
EVEX.256.66.0F38.W1 10 /r B VIV AVX512VL_ | Shift words in ymm_2 right by amount specified in the 
VPSRLVW ymm1 {k1}{z}, ymm2, AVX512BW | corresponding element of ymm3/m256 while shifting 
ymm3/m256 in Os using writemask k1. 
EVEX.512.66.0F38.W1 10 /r B VIV AVX512BW | Shift words in zmm2 right by amount specified in the 
VPSRLVW zmm1 {k1}{z}, zmm2, corresponding element of zmm3/m512 while shifting 
zmm3/m512 in Os using writemask k1. 
EVEX.128.66.0F38.W0 45 /r C VIV AVX512VL_ | Shift doublewords in xmm_2 right by amount specified 
VPSRLVD xmm1 {k1}{z}, xmm2, AVX512F in the corresponding element of xmm3/m128/m32bcst 
xmm3/m1 28/m32bcst while shifting in Os using writemask k1. 
EVEX.256.66.0F38.W0 45 /r C VIV AVX512VL_ | Shift doublewords in ymm_2 right by amount specified 
VPSRLVD ymm1 {k1}{z}, ymm2, AVX512F in the corresponding element of ynm3/m256/m32bcst 
ymm3/m256/m32bcst while shifting in Os using writemask k1. 
EVEX.512.66.0F38.W0 45 /r C VIV AVX512F Shift doublewords in zmm2 right by amount specified 
VPSRLVD zmm1 {k1}{z}, zmm2, in the corresponding element of zmm3/m512/m32bcst 
zmm3/m512/m32bcst while shifting in Os using writemask k1. 
EVEX.128.66.0F38.W1 45 /r C VIV AVX512VL_ | Shift quadwords in xmm2 right by amount specified in 
VPSRLVQ xmm1 {k1}{z}, xmm2, AVX512F the corresponding element of xmm3/m128/m64bcst 
xmm3/m128/m64bcst while shifting in Os using writemask k1. 
EVEX.256.66.0F38.W1 45 /r C VIV AVX512VL_ | Shift quadwords in ymm2 right by amount specified in 
VPSRLVQ ymm1 {k1}{z}, ymm2, AVX512F the corresponding element of ynm3/m256/m64bcst 
ymm3/m256/m64bcst while shifting in Os using writemask k1. 
EVEX.512.66.0F38.W1 45 /r C VIV AVX512F Shift quadwords in zmm2 right by amount specified in 
VPSRLVQ zmm1 {k1}{z}, zmm2, the corresponding element of zmm3/m512/m64bcst 
zmm3/m512/m64bcst while shifting in Os using writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
B Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Shifts the bits in the individual data elements (words, doublewords or quadword) in the first source operand to the 
right by the count value of respective data elements in the second source operand. As the bits in the data elements 
are shifted right, the empty high-order bits are cleared (set to 0). 

The count values are specified individually in each data element of the second source operand. If the unsigned 
integer value specified in the respective data element of the second source operand is greater than 15 (for word), 
31 (for doublewords), or 63 (for a quadword), then the destination data element are written with 0. 

VEX.128 encoded version: The destination and first source operands are XMM registers. The count operand can be 
either an XMM register or a 128-bit memory location. Bits (MAXVL-1:128) of the corresponding destination register 
are zeroed. 

VEX.256 encoded version: The destination and first source operands are YMM registers. The count operand can be 
either an YMM register or a 256-bit memory. Bits (MAXVL-1:256) of the corresponding ZMM register are zeroed. 
EVEX encoded VPSRLVD/Q: The destination and first source operands are ZMM/YMM/XMM registers. The count 
operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512-bit vector broad- 
casted from a 32/64-bit memory location. The destination is conditionally updated with writemask k1. 

EVEX encoded VPSRLVW: The destination and first source operands are ZMM/YMM/XMM registers. The count 
operand can be either a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is condition- 
ally updated with writemask k1. 


Operation 


VPSRLVW (EVEX encoded version) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 


FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN DEST[i+15:i] = ZeroExtend(SRC1[i+15:i] >> SRC2[i+15:i]) 


ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{i+15:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+15:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 


VPSRLVD (VEX.128 version) 
COUNT_O := SRC2[31 : 0] 

(* Repeat Each COUNT_i for the 2nd through 4th dwords of SRC2*) 
COUNT_3 := SRC2[127 : 96]; 
IF COUNT_O < 32 THEN 

DEST[31:0] := ZeroExtend(SRC1[31:0] >> COUNT_O); 
ELSE 

DEST[31:0] := 0; 

(* Repeat shift operation for 2nd through 4th dwords *) 
IF COUNT_3 < 32 THEN 

DEST[1 27:96] := ZeroExtend(SRC1[127:96] >> COUNT_3); 
ELSE 

DEST[1 27:96] := 0; 
DEST[MAXVL-1:1 28] := 0; 
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VPSRLVD (VEX.256 version) 
COUNT_O := SRC2[31 : OJ; 
(* Repeat Each COUNT_i for the 2nd through 7th dwords of SRC2*) 
COUNT_7 := SRC2[255 : 224]; 
IF COUNT_O < 32 THEN 
DEST[31:0] := ZeroExtend(SRC1[31:0] >> COUNT_0); 
ELSE 
DEST[31:0] := 0; 
(* Repeat shift operation for 2nd through 7th dwords *) 
IF COUNT_7 < 32 THEN 
DEST[255:224] := ZeroExtend(SRC1[255:224] >> COUNT_7); 
ELSE 
DEST[255:224] := 0; 
DEST[MAXVL-1:256] := 0; 


VPSRLVD (EVEX encoded version) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST[i+31:i] = ZeroExtend(SRC1[i+31:i] >> SRC2[31:0]) 
ELSE DEST[i+31:i] := ZeroExtend(SRC1[i+31:i] >> SRC2[i+31:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 


VPSRLVQ (VEX.128 version) 
COUNT_O := SRC2[63 : 0]; 
COUNT_1 := SRC2[127 : 64]; 
IF COUNT_O < 64 THEN 
DEST[63:0] := ZeroExtend(SRC1[63:0] >> COUNT_O); 
ELSE 
DEST[63:0] := 0; 
IF COUNT_1 < 64 THEN 
DEST[127:64] := ZeroExtend(SRC1[127:64] >> COUNT_1); 
ELSE 
DEST[127:64] := 0; 
DEST[MAXVL-1:128] := 0; 
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VPSRLVQ (VEX.256 version) 
COUNT_O := SRC2[63 : 0]; 
(* Repeat Each COUNT_i for the 2nd through 4th dwords of SRC2*) 
COUNT_3 := SRC2[255 : 192]; 
IF COUNT_O < 64 THEN 
DEST[63:0] := ZeroExtend(SRC1[63:0] >> COUNT_O); 
ELSE 
DEST[63:0] := 0; 
(* Repeat shift operation for 2nd through 4th dwords *) 
IF COUNT_3 < 64 THEN 
DEST[255:1 92] := ZeroExtend(SRC1[255:192] >> COUNT_3); 
ELSE 
DEST[255:192] := 0; 
DEST[MAXVL-1:256] := 0; 


VPSRLVQ (EVEX encoded version) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] := ZeroExtend(SRC1[i+63:i] >> SRC2[63:0]) 
ELSE DEST[i+63:i] := ZeroExtend(SRC1[i+63:i] >> SRC2[i+63:i]) 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 

DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0; 
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Intel C/C++ Compiler Intrinsic Equivalent 


VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVW 
VPSRLVD 
VPSRLVD 
VPSRLVD 
VPSRLVD 
VPSRLVD 
VPSRLVD 
VPSRLVD 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVQ 
VPSRLVD 
VPSRLVQ 


m512i 


mm512_srlv_epi16(__m512i a, __m512i cnt); 


m512i 


mm512_mask_srlv_epi16(__m512is,___ mmask32 k,__m512i a,__m512i cnt); 


m512i 


mm512_maskz_srlv_epi16(__mmask32 k,___m512i a,__m512i cnt); 


m256i 


mm256_mask_srlv_epi16(__m256i s,__ mmask16 k,__ m256i a, __m256i cnt); 


m256i 


mm256_maskz_srlv_epi16(__mmask16 k,__ m256i a, __m256i cnt); 


m128i 


mm_mask_srlv_epi16(__m128i s,___ mmask8 k,__m128i a, ___m128i cnt); 


m1 28i 


mm_maskz_srlv_epi16(__mmask8 k,___m128i a,__m128i cnt); 


m256i 


mm256_srlv_epi32 (__m256i m, __m256i count) 


m512i 


mm512_srlv_epi32(__m512i a, __m512i cnt); 


m512i_mm512_mask_srlv_epi32(__m512is,__ mmask16 k,__m512ia,__m512i cnt); 
m512i_mm512_maskz_srlv_epi32(__mmask16 k,__m512ia,__m512i cnt); 
m256i__mm256_mask_srlv_epi32(__m256is,__ mmask8 k,__ m256i a, __ m256i cnt); 
m256i__mm256_maskz_srlv_epi32(__mmask8 k,___ m256i a, __ m256i cnt); 

m128i __mm_mask_srlv_epi32(__m128i s,__ mmask8 k,___m128i a, ___m128i cnt); 
m128i__mm_maskz_srlv_epi32(__mmask8 k,__m128i a, __m128i cnt); 
m512i_mm512_srlv_epi64(__m512ia,___m512i cnt); 
m512i_mm512_mask_srlv_epi64(__m512is,__ mmask8 k,__m512ia,___m512i cnt); 
m512i_mm512_maskz_srlv_epi64(__ mmask8 k,__ m512ia,___m512i cnt); 

m256i __mm256_mask_srlv_epi64(__m256is,__ mmask8 k,___ m256i a, __ m256i cnt); 
m256i __mm256_maskz_srlv_epi64(__ mmask8 k,___ m256i a, __ m256i cnt); 

m128i __mm_mask_srlv_epi64(__m128i s,__ mmask8 k,__m128i a, ___m128i cnt); 
m128i __mm_maskz_srlv_epi64(___mmask8 k,__m128i a, ___m128i cnt); 

m256i __mm256_srlv_epi64 (__m256i m, __m256i count) 
m128i_mm_srlv_epi32(__m128i a,__m128i cnt); 
m128i_mm_srlv_epi64(__m128i a,___m128i cnt); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
VEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded VPSRLVD/Q, see Table 2-49, “Type E4 Class Exception Conditions”. 


EVEX-encoded VPSRLVW, see Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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VPTERNLOGD/VPTERNLOGQ—Bitwise Ternary Logic 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F3A.WO 25 /r ib A VIV AVX512VL | Bitwise ternary logic taking xmm1, xmme2 and 
VPTERNLOGD xmm1 {k1}{z}, xmm2, AVX512F xmm3/m128/m32bcst as source operands and writing 
xmm3/m128/m32bcst, imm8 the result to xmm1 under writemask k1 with dword 


granularity. The immediate value determines the specific 
binary function being implemented. 


EVEX.256.66.0F3A.WO 25 /r ib A VIV AVX512VL | Bitwise ternary logic taking ymm1, ymm2 and 
VPTERNLOGD ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m32bcst as source operands and writing 
ymm3/m256/m32bcst, imm8 the result to ymm1 under writemask k1 with dword 


granularity. The immediate value determines the specific 
binary function being implemented. 


EVEX.512.66.0F3A.WO 25 /r ib A VIV AVX512F Bitwise ternary logic taking zmm1, zmm2 and 
VPTERNLOGD zmm1 {k1}{z}, zmm2, zmm3/m512/m32bcst as source operands and writing 
zmm3/m512/m32bcst, imm8 the result to zmm1 under writemask k1 with dword 


granularity. The immediate value determines the specific 
binary function being implemented. 


EVEX.128.66.0F3A.W1 25 /r ib A VIV AVX512VL | Bitwise ternary logic taking xmm1, xmme2 and 
VPTERNLOGQ xmm1 {k1}{z}, xmm_2, AVX512F xmm3/m128/m64bcst as source operands and writing 
xmm3/m128/m64bcst, imm8 the result to xmm1 under writemask k1 with qword 


granularity. The immediate value determines the specific 
binary function being implemented. 


EVEX.256.66.0F3A.W1 25 /r ib A VV AVX512VL | Bitwise ternary logic taking ymm1, ymm2 and 
VPTERNLOGQ ymm1 {k1}{z}, ymm2, AVX512F ymm3/m256/m64bcst as source operands and writing 
ymm3/m256/m64bcst, imm8 the result to ymm1 under writemask k1 with qword 


granularity. The immediate value determines the specific 
binary function being implemented. 


EVEX.512.66.0F3A.W1 25 /r ib A VIV AVX512F Bitwise ternary logic taking zmm1, zmm2 and 
VPTERNLOGQ zmm1 {k1}{z}, zmm2, zmm3/m512/m64bcst as source operands and writing 
zmm3/m512/m64bcst, imm8 the result to zmm1 under writemask k1 with qword 


granularity. The immediate value determines the specific 
binary function being implemented. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


VPTERNLOGD/Q takes three bit vectors of 512-bit length (in the first, second and third operand) as input data to 
form a set of 512 indices, each index is comprised of one bit from each input vector. The imm8 byte specifies a 
boolean logic table producing a binary value for each 3-bit index value. The final 512-bit boolean result is written 
to the destination operand (the first operand) using the writemask k1 with the granularity of doubleword element 
or quadword element into the destination. 


The destination operand is a ZMM (EVEX.512)/YMM (EVEX.256)/XMM (EVEX.128) register. The first source 
operand is a ZMM/YMM/XMM register. The second source operand can be a ZMM/YMM/XMM register, a 
512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 32/64-bit memory location The 
destination operand is a ZMM register conditionally updated with writemask k1. 
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Table 5-9 shows two examples of Boolean functions specified by immediate values OxE2 and OxE4, with the look up 
result listed in the fourth column following the three columns containing all possible values of the 3-bit index. 


Table 5-9. Examples of VPTERNLOGD/Q Imm8 Boolean Function and Input Index Values 


VPTERNLOGD reg1, reg2, src3, OxE2 Bit Result with | VPTERNLOGD reg1, reg2, src3, OxE4 Bit Result with 
Bit(reg1) Bit(reg2) Bit(src3) ImmB=OxE2 | Bitiregl) Bit(reg2) —_| Bit(src3) Imme=Oxet 

0 0 0 0 0 0 0 0 

0 0 1 1 0 0 1 0 

0 1 0 0 0 1 0 1 

0 1 1 0 0 1 1 0 

1 0 0 0 1 0 0 0 

1 0 1 1 1 0 1 1 

1 1 0 1 1 1 0 1 

1 1 1 1 1 1 1 1 


Specifying different values in imm8 will allow any arbitrary three-input Boolean functions to be implemented in 
software using VPTERNLOGD/Q. Table 5-1 and Table 5-2 provide a mapping of all 256 possible imm8 values to 
various Boolean expressions. 


Operation 

VPTERNLOGD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 


i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
FOR k := 0 TO 31 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST{j][k] := imm[(DEST[i+k] << 2) + (SRC1[i+k ] << 1) + SRC2[k J] 
ELSE DESTI[j][k] := imm[(DEST[i+k] << 2) + (SRC1[ i+k ] << 1) + SRC2[ i+k J] 
Fl; 
; table lookup of immediate bellow; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31 +i:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31 +i:i] := O 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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VPTERNLOGQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 


i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
FOR k := 0 TO 63 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN DEST{j][k] := imm[(DEST[i+k] << 2) + (SRC1[i+k ] << 1) + SRC2[ k J] 
ELSE DEST{j][k] := imm[(DEST[i+k] << 2) + (SRC1[i+k ] << 1) + SRC2[ i+k J] 
Fl; ; table lookup of immediate bellow; 
ELSE 
IF *merging-masking* ; Merging-masking 
THEN *DEST[63+i:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63+i:i] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPTERNLOGD __m512i_mm512_ternarylogic_epi32(__m512i a,__m512ib, int imm); 
VPTERNLOGD __m512i_mm512_mask_ternarylogic_epi32(__m512is,__ mmask16 m,__m512i a,_m512ib, int imm); 


VPTERNLOGD __m512i_mm512_maskz_ternarylogic_epi32(__mmask m,_m512i a,__m512i, int imm); 
VPTERNLOGD __m256i_mm256_ternarylogic_epi32(__m256i a,___m256i b, int imm); 
VPTERNLOGD __m256i_mm256_mask_ternarylogic_epi32(__m256i s,__ mmask8 m, __m256i a, __m256i b, int imm); 


VPTERNLOGD __m256i_mm256_maskz_ternarylogic_epi32(__mmask8 m, __m256i a,__m256i b, int imm); 
VPTERNLOGD __m128i_mm_ternarylogic_epi32(__m128i a,__m128ib, int imm); 

VPTERNLOGD __m128i __mm_mask_ternarylogic_epi32(__m128i s,__ mmask8 m, __m128i a,__m128ib, int imm); 
VPTERNLOGD __m128i __mm_maskz_ternarylogic_epi32(__ mmask8 m, __m128i a,__m128i b, int imm); 
VPTERNLOGQ __m512i_mm512_ternarylogic_epi64(__m512i a,__m512ib, int imm); 

VPTERNLOGQ __m512i_mm512_mask_ternarylogic_epi64(__m512is,__ mmask8 m,___m512i a,__m512ib, int imm); 
VPTERNLOGQ __m512i_mm512_maskz_ternarylogic_epi64(__ mmask8 m, ___m512i a,__m512ib, int imm); 
VPTERNLOGQ __m256i_mm256_ternarylogic_epi64(__m256i a, ___ m256i b, int imm); 

VPTERNLOGQ __m256i__mm256_mask_ternarylogic_epi64(__m256is,__ mmask8 m, __m256i a,__m256i b, int imm); 
VPTERNLOGQ __m256i__mm256_maskz_ternarylogic_epi64(__ mmask8 m, __m256i a, __m256i b, int imm); 
VPTERNLOGQ __m128i_mm_ternarylogic_epi64(__m128i a, __m128i b, int imm); 

VPTERNLOGQ __m128i __mm_mask_ternarylogic_epi64(__m128is,__ mmask8 m, ___m128i a,__m128i b, int imm); 
VPTERNLOGQ __m128i__mm_maskz_ternarylogic_epi64(__ mmask8 m, __m128i a,__m128i }, int imm); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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VPTESTMB/VPTESTMW/VPTESTMD/VPTESTMQ—Logical AND and Set Mask 


VPTESTMB k2 {k1}, xmm2, 
xmm3/m128 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W0 26 /r A VIV AVX512VL Bitwise AND of packed byte integers in xmm2 and 


AVX512BW | xmm3/m128 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 


EVEX.256.66.0F38.W0 26 /r 
VPTESTMB k2 {k1}, ymm2, 
ymm3/m256 


A VIV AVX512VL Bitwise AND of packed byte integers in ymm2 and 
AVX512BW | ymm3/m256 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 


EVEX.512.66.0F38.W0O 26 /r 
VPTESTMB k2 {k1}, zmm2, 
zmm3/m512 


A VIV AVX512BW | Bitwise AND of packed byte integers in zmm2 and 
zmm3/m512 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 


EVEX.128.66.0F38.W1 26 /r 
VPTESTMW k2 {k1}, xmm_z, 
xmm3/m128 


A VIV AVX512VL Bitwise AND of packed word integers in xmm2 and 
AVX512BW | xmm3/m128 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 


EVEX.256.66.0F38.W1 26 /r 
VPTESTMW k2 {k1}, ymm_2, 
ymm3/m256 
EVEX.512.66.0F38.W1 26 /r 
VPTESTMW k2 {k1}, zmm2, 
zmm3/m512 


A VIV AVX512VL Bitwise AND of packed word integers in ymm2 and 
AVX512BW | ymm3/m256 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 
A VV AVX512BW | Bitwise AND of packed word integers in zmm2 and 
zmm3/m512 and set mask k2 to reflect the zero/non-zero 
status of each element of the result, under writemask k1. 


EVEX.128.66.0F38.W0 27 /r B VIV AVX512VL Bitwise AND of packed doubleword integers in xmm2 and 

VPTESTMD k2 {k1}, xmm2, AVX512F xmm3/m128/m32bcst and set mask k2 to reflect the 

xmm3/m128/m32bcst zero/non-zero status of each element of the result, under 
writemask k1. 

EVEX.256.66.0F38.W0 27 /r B VIV AVX512VL Bitwise AND of packed doubleword integers in ymm2 and 

VPTESTMD k2 {k1}, ymm2, AVX512F ymm3/m256/m32bcst and set mask k2 to reflect the 

ymm3/m256/m32bcst zero/non-zero status of each element of the result, under 
writemask k1. 

EVEX.512.66.0F38.W0 27 /r B VIV AVX512F Bitwise AND of packed doubleword integers in zmm2 and 

VPTESTMD k2 {k1}, zmm2, zmm3/m512/m32bcst and set mask k2 to reflect the 

zmm3/m512/m32bcst zero/non-zero status of each element of the result, under 


writemask k1. 


EVEX.128.66.0F38.W1 27 /r 
VPTESTMQ k2 {k1}, xmm2, 
xmm3/m128/m64bcst 


B VIV AVX512VL Bitwise AND of packed quadword integers in xmm_2 and 
AVX512F xmm3/m128/m64bcst and set mask k2 to reflect the 
zero/non-zero status of each element of the result, under 
writemask k1. 


EVEX.256.66.0F38.W1 27 /r 
VPTESTMQ k2 {k1}, ymm2, 
ymm3/m256/m64bcst 


B VIV AVX512VL Bitwise AND of packed quadword integers in ymm2 and 
AVX512F ymm3/m256/m64bcst and set mask k2 to reflect the 
zero/non-zero status of each element of the result, under 
writemask k1. 


EVEX.512.66.0F38.W1 27 /r 
VPTESTMQ k2 {k1}, zmm2, 
zmm3/m512/m64bcst 


B VIV AVX512F Bitwise AND of packed quadword integers in zmm2 and 
zmm3/m512/m64bcst and set mask k2 to reflect the 
zero/non-zero status of each element of the result, under 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
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Description 


Performs a bitwise logical AND operation on the first source operand (the second operand) and second source 


operand (the third operand) and stores the result in the destination operand (the first operand) under the 
writemask. Each bit of the result is set to 1 if the bitwise AND of the corresponding elements of the first and second 


src operands is non-zero; otherwise it is set to 0. 


INSTRUCTION SET REFERENCE, V-Z 


VPTESTMD/VPTESTMQ: The first source operand is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 


32/64-bit memory location. The destination operand is a mask register updated under the writemask. 


VPTESTMB/VPTESTMW: The first source operand is a ZMM/YMM/XMM register. The second source operand can be a 
ZMM/YMM/XMM register or a 512/256/128-bit memory location. The destination operand is a mask register 


updated under the writemask. 


Operation 


VPTESTMB (EVEX encoded versions) 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF k1[j] OR *no writemask* 
THEN — DEST{j] := (SRC1[i+7:i] BITWISE AND SRC2[i+7:i] != 0)? 1 : 0; 
ELSE DEST{j] = 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPTESTMW (EVEX encoded versions) 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF k1[j] OR *no writemask* 
THEN — DEST{[j] = (SRC1[i+15:i] BITWISE AND SRC2[i+15:i] != 0)? 1 : 0; 
ELSE DEST{[j] = 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPTESTMD (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


THEN DEST{j] := (SRC1[i+31:i] BITWISE AND SRC2[31:0] != 0)? 1 : 0; 
ELSE DEST{j] = (SRC1[i+31:i] BITWISE AND SRC2[i+31:i] != 0)? 1 : 0; 


Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 
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VPTESTMQ (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST{j] := (SRC1[i+63:i] BITWISE AND SRC2[63:0] != 0)? 1 : 0; 
ELSE DEST{j] := (SRC1[i+63:i] BITWISE AND SRC2[i+63:i] != 0)? 1 : 0; 
Fl; 
ELSE DEST{j] := 0 ; zeroing-masking only 
Fl; 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalents 


VPTESTMB __mmask64_mm512_test_epi8_mask(__m512i a,__m512i b); 
VPTESTMB __mmask64 __mm512_mask_test_epi8_mask(__mmask64, 
VPTESTMW __mmask32 __mm512_test_epi16_mask(__m512ia,__m512i b); 
VPTESTMW __mmask32 _mm512_mask_test_epi16_mask(__mmask32, 
VPTESTMD __mmask16 __mm512_test_epi32_mask(__m512i a,__m512ib); 

VPTESTMD __mmask16 __mm512_mask_test_epi32_mask(__mmask16,___m512i a, 
VPTESTMQ __mmask8 _mm512_test_epi64_mask(__m512i a, __m512i b); 

VPTESTMQ __mmask8 _mm512_mask_test_epi64_mask(__mmask8, __m512i a, 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VPTESTMD/Q: See Table 2-49, “Type E4 Class Exception Conditions”. 


m512ia,__m512ib); 


m512ia,__m512ib); 


m512i b); 


VPTESTMB/W: See Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode 
Support 
EVEX.128.F3.0F38.W0 26 /r A VIV AVX512VL Bitwise NAND of packed byte integers in xmm2 and 
VPTESTNMB k2 {k1!, xmm2, AVX512BW | xmm3/m128 and set mask k2 to reflect the zero/non-zero 
xmm3/m128 status of each element of the result, under writemask k1. 
EVEX.256.F3.0F38.W0 26 /r A VIV AVX512VL Bitwise NAND of packed byte integers in ymm2 and 
VPTESTNMB k2 {k1!, ymme2, AVX512BW | ymm3/m256 and set mask k2 to reflect the zero/non-zero 
ymm3/m256 status of each element of the result, under writemask k1. 
EVEX.512.F3.0F38.W0 26 /r A VIV AVX512F Bitwise NAND of packed byte integers in zmm2 and 
VPTESTNMB k2 {k1}!, zmm2, AVX512BW | zmm3/m512 and set mask k2 to reflect the zero/non-zero 
zmm3/m512 status of each element of the result, under writemask k1. 
EVEX.128.F3.0F38.W1 26 /r A VIV AVX512VL Bitwise NAND of packed word integers in xmm2 and 
VPTESTNMW k2 {k1}, xmme2, AVX512BW | xmm3/m128 and set mask k2 to reflect the zero/non-zero 
xmm3/m1 28 status of each element of the result, under writemask k1. 
EVEX.256.F3.0F38.W1 26 /r A VIV AVX512VL Bitwise NAND of packed word integers in ymm2 and 
VPTESTNMW k2 {k1}, ymm2, AVX512BW | ymm3/m256 and set mask k2 to reflect the zero/non-zero 
ymm3/m256 status of each element of the result, under writemask k1. 
EVEX.512.F3.0F38.W1 26 /r A VIV AVX512F Bitwise NAND of packed word integers in zmm2 and 
VPTESTNMW k2 {k1}, zmm2, AVX512BW | zmm3/m512 and set mask k2 to reflect the zero/non-zero 
zmm3/m512 status of each element of the result, under writemask k1. 
EVEX.128.F3.0F38.W0 27 /r B VIV AVX512VL Bitwise NAND of packed doubleword integers in xmm2 and 
VPTESTNMD k2 {k1}, xmm2, AVX512F xmm3/m128/m32bcst and set mask k2 to reflect the 
xmm3/m128/m32bcst zero/non-zero status of each element of the result, under 
writemask k1. 
EVEX.256.F3.0F38.W0 27 /r B VIV AVX512VL Bitwise NAND of packed doubleword integers in ymm2 and 
VPTESTNMD k2 {k1}, ymm2, AVX512F ymm3/m256/m32bcst and set mask k2 to reflect the 
ymm3/m256/m32bcst zero/non-zero status of each element of the result, under 
writemask k1. 
EVEX.512.F3.0F38.W0 27 /r B VIV AVX512F Bitwise NAND of packed doubleword integers in zmm2 and 
VPTESTNMD k2 {k1}, zmm2, zmm3/m512/m32bcst and set mask k2 to reflect the 
zmm3/m512/m32bcst zero/non-zero status of each element of the result, under 
writemask k1. 
EVEX.128.F3.0F38.W1 27 /r B VIV AVX512VL Bitwise NAND of packed quadword integers in xmm2 and 
VPTESTNMQ k2 {k1}, xmm2, AVX512F xmm3/m128/m64bcst and set mask k2 to reflect the 
xmm3/m128/m64bcst zero/non-zero status of each element of the result, under 
writemask k1. 
EVEX.256.F3.0F38.W1 27 /r B VIV AVX512VL Bitwise NAND of packed quadword integers in ymm2 and 
VPTESTNMQ k2 {k1}, ymm2, AVX512F ymm3/m256/m64bcst and set mask k2 to reflect the 
ymm3/m256/m64bcst zero/non-zero status of each element of the result, under 
writemask k1. 
EVEX.512.F3.0F38.W1 27 /r B VIV AVX512F Bitwise NAND of packed quadword integers in zmm2 and 


VPTESTNMQ k2 {k1}, zmm2, 
zmm3/m512/m64bcst 


zmm3/m512/m64bcst and set mask k2 to reflect the 
zero/non-zero status of each element of the result, under 
writemask k1. 
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Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full Mem ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
B Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical NAND operation on the byte/word/doubleword/quadword element of the first source 
operand (the second operand) with the corresponding element of the second source operand (the third operand) 
and stores the logical comparison result into each bit of the destination operand (the first operand) according to the 
writemask k1. Each bit of the result is set to 1 if the bitwise AND of the corresponding elements of the first and 


second src operands is zero; otherwise it is set to 0. 


EVEX encoded VPTESTNMD/Q: The first source operand is a ZMM/YMM/XMM registers. The second source operand 
can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted 


from a 32/64-bit memory location. The destination is updated according to the writemask. 


EVEX encoded VPTESTNMB/W: The first source operand is a ZMM/YMM/XMM registers. The second source operand 
can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location. The destination is updated according to the 


writemask. 


Operation 


VPTESTNMB 
(KL, VL) = (16, 128), (32, 256), (64, 512) 
FOR j := 0 TO KL-1 
i:=j*8 
IF MaskBit(j) OR *no writemask* 
THEN 


DEST[j] = (SRC1[i+7:i] BITWISE AND SRC2[i+7:i] == 0)? 1:0 


ELSE DEST{j] := 0; zeroing masking only 
Fl 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPTESTNMW 
(KL, VL) = (8, 128), (16, 256), (32, 512) 
FOR j := 0 TO KL-1 
i:=j*16 
IF MaskBit(j) OR *no writemask* 
THEN 


DEST[j] := (SRC1[i+15:i] BITWISE AND SRC2[i+15:i] == 0)? 1:0 


ELSE DEST{j] := 0; zeroing masking only 
Fl 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 
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VPTESTNMD 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:= j*32 
IF MaskBit(j) OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


THEN DEST[i+31:i] := (SRC1[i+31:i] BITWISE AND SRC2[31:0] == 0)? 1:0 
ELSE DEST{j] := (SRC1[i+31:i] BITWISE AND SRC2[i+31:i] == 0)? 1:0 


Fl 
ELSE DEST{[j] := 0; zeroing masking only 
Fl 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


VPTESTNMQ 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i= j*64 
IF MaskBit(j) OR *no writemask* 
THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 


THEN DEST{j] := (SRC1[i+63:i] BITWISE AND SRC2[63:0] == 0)? 1 : 0; 
ELSE DEST{j] := (SRC1[i+63:i] BITWISE AND SRC2[i+63:i] == 0)? 1 : 0; 


Fl; 
ELSE DEST{[j] := 0; zeroing masking only 
Fl 
ENDFOR 
DEST[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VPTESTNMB __mmask64 _mm512_testn_epi8_mask(__m512i a,__m512ib); 
VPTESTNMB __mmask64 _mm512_mask_testn_epi8_mask(__mmask64, __m512ia, 
VPTESTNMB __mmask32 _mm256_testn_epi8_mask(__m256i a, __ m256i b); 
VPTESTNMB __mmask32 _mm256_mask_testn_epi8_mask(__mmask32, _ m256i a, 
VPTESTNMB __mmask16 _mm_testn_epi8_mask(__m128i a, __m128i b); 


VPTESTNMB __mmask16 _mm_mask_testn_epi8_mask(__mmask16, 


VPTESTNMW __mmask32 _mm512_testn_epil16_mask(__m512ia,__m512i b); 
VPTESTNMW __mmask32 _mm512_mask_testn_epi16_mask(__mmask32,__m512ia, 
VPTESTNMW __mmask16 _mm256_testn_epi16_mask(__m256i a, __m256i b); 
VPTESTNMW __mmask16 _mm256_mask_testn_epi16_mask(__mmask16,___m256i a, 
VPTESTNMW __mmask8 _mm_testn_epi16_mask(__m128i a, ___m128i b); 


VPTESTNMW __mmask8 _mm_mask_testn_epi16_mask(__mmask8, 


VPTESTNMD __mmask16 _mm512_testn_epi32_mask(__m512i a,__m512ib); 
VPTESTNMD __mmask16 _mm512_mask_testn_epi32_mask(__mmask16, 
VPTESTNMD __mmask8 _mm256_testn_epi32_mask(__m256i a, __ m256i b); 
VPTESTNMD __mmask8 _mm256_mask_testn_epi32_mask(__mmask8, __m256i a, 
VPTESTNMD __mmask8 _mm_testn_epi32_mask(__m128i a, ___m128i b); 


VPTESTNMD __mmask8 _mm_mask_testn_epi32_mask(__mmask8, 


VPTESTNMQ __mmask8 _mm512_testn_epi64_mask(__m512i a, ___m512i b); 
VPTESTNMQ __mmask8 _mm512_mask_testn_epi64_mask(__mmask8, __m512i a, 
VPTESTNMQ __mmask8 _mm256_testn_epi64_mask(__m256i a, __m256i b); 
VPTESTNMQ __mmask8 _mm256_mask_testn_epi64_mask(__mmask8, __m256i a, 
VPTESTNMQ __mmask8 _mm_testn_epi64_mask(__m128i a, __m128i b); 
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m512ia,__m512ib); 


INSTRUCTION SET REFERENCE, V-Z 
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VPTESTNMQ __mmask8 _mm_mask_testn_epi64_mask(__mmask8, __m128i a, __m128i b); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
VPTESTNMD/VPTESTNMQ: See Table 2-49, “Type E4 Class Exception Conditions”. 
VPTESTNMB/VPTESTNMW: See Exceptions Type E4.nb in Table 2-49, “Type E4 Class Exception Conditions”. 
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VRANGEPD—Range Restriction Calculation For Packed Pairs of Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W1 50 /r ib A VV AVX512VL_ | Calculate two RANGE operation output value from 2 pairs 
VRANGEPD xmm1 {k1}{z}, xmm2, AVX512DQ_ | of double-precision floating-point values in xmm2 and 
xmm3/m128/m64bcst, imm8 xmm3/m128/m32bcst, store the results to xmm1 under 
the writemask k1.Imm8 specifies the comparison and sign 
of the range operation. 
EVEX.256.66.0F3A.W1 50 /r ib A VV AVX512VL_ | Calculate four RANGE operation output value from 4pairs 
VRANGEPD ymm1 {k1}{z}, ymm2, AVX512DQ_ | of double-precision floating-point values in ymm2 and 
ymm3/m256/m64bcst, imm8 ymm3/m256/m32bcst, store the results to ymm1 under 
the writemask k1.Imm8 specifies the comparison and sign 
of the range operation. 
EVEX.512.66.0F3A.W1 50 /r ib A VV AVX512DQ_ | Calculate eight RANGE operation output value from 8 
VRANGEPD zmm1 {k1}{z}, zmm2, pairs of double-precision floating-point values in zmm2 
zmm3/m512/m64bcst{sae}, imm8 and zmm3/m512/m32bcst, store the results to zmm1 
under the writemask k1. Imm8 specifies the comparison 
and sign of the range operation. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


This instruction calculates 2/4/8 range operation outputs from two sets of packed input double-precision FP values 
in the first source operand (the second operand) and the second source operand (the third operand). The range 
outputs are written to the destination operand (the first operand) under the writemask k1. 


Bits7:4 of imm8 byte must be zero. The range operation output is performed in two parts, each configured by a 
two-bit control field within imm8[3:0]: 


° Imm8[1:0] specifies the initial comparison operation to be one of max, min, max absolute value or min 
absolute value of the input value pair. Each comparison of two input values produces an intermediate result 
that combines with the sign selection control (Imm8[3:2]) to determine the final range operation output. 


¢ Imm8[3:2] specifies the sign of the range operation output to be one of the following: from the first input 
value, from the comparison result, set or clear. 


The encodings of Imm8[1:0] and Imm8[3:2] are shown in Figure 5-27. 


imm8 


6 5 4 


Must Be Zero 


2 1 0 


Sign Control (SC) 


Compare Operation Select 


Immg[3:2] = 00b : Select sign(SRC1) 


Imm8[3:2] = 01b : Select sign(Compare_Result) 


Imm8[3:2] = 10b : Set sign to 0 
Imm8[3:2] = 11b: Set sign to 1 


Imm8[1:0] = 00b : Select Min value 
Imm8[1:0] = 01b : Select Max value 
Imm8[1:0] = 10b : Select Min-Abs value 
Imm8[1:0] = 11b : Select Max-Abs value 


Figure 5-27. Imm8 Controls for VRANGEPD/SD/PS/SS 
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When one or more of the input value is a NAN, the comparison operation may signal invalid exception (IE). Details 
with one of more input value is NAN is listed in Table 5-10. If the comparison raises an IE, the sign select control 
(Imm8[3:2] has no effect to the range operation output, this is indicated also in Table 5-10. 


When both input values are zeros of opposite signs, the comparison operation of MIN/MAX in the range compare 
operation is slightly different from the conceptually similar FP MIN/MAX operation that are found in the instructions 
VMAXPD/VMINPD. The details of MIN/MAX/MIN_ABS/MAX_ABS operation for VRANGEPD/PS/SD/SS for magni- 
tude-0, opposite-signed input cases are listed in Table 5-11. 


Additionally, non-zero, equal-magnitude with opposite-sign input values perform MIN_ABS or MAX_ABS compar- 


ison operation with result listed in Table 5-12. 


Table 5-10. Signaling of Comparison Operation of One or More NaN Input Values and Effect of Imm8[3:2] 


Src Srce2 Result IE Signaling Due to Comparison Imm8[3:2] Effect to Range Output 

sNaN1 sNaN2 Quiet(sNaN1) Yes Ignored 

sNaN1 qNaN2 Quiet(sNaN1) Yes Ignored 

sNaN1 Norm2 Quiet(sNaN1) Yes Ignored 

qNaN1 sNaN2 Quiet(sNaN2) Yes Ignored 

qNaN1 qNaN2 qNaN1 No Applicable 

qNaN1 Norm2 Norm2 No Applicable 

Norm1 sNaN2 Quiet(sNaN2) Yes Ignored 

Norm1 qNaN2 Norm1 No Applicable 

Table 5-11. Comparison Result for Opposite-Signed Zero Cases for MIN, MIN_ABS and MAX, MAX_ABS 

MIN and MIN_ABS MAX and MAX_ABS 

Src Sre2 Result Src Src2 Result 

+0 -0 -0 +0 -0 +0 

-0 +0 -0 -0 +0 +0 


Table 5-12. Comparison Result of Equal-Magnitude Input Cases for MIN_ABS and MAX_ABS, (|a] = |b], a>0, b<O) 


MIN_ABS ([a| = |b], a>0, b<O) MAX_ABS (|a] = [b], a>0, b<0O) 
Src Src2 Result Src Srce2 Result 
a b b a b a 
b a b b a a 
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Operation 
RangeDP(SRC1[63:0], SRC2[63:0], CmpOpCti[1:0], SignSelCti[1 :0]) 
{ 

// Check if SNAN and report IE, see also Table 5-10 

IF (SRC1 = SNAN) THEN RETURN (QNAN(SRC1), set IE); 

IF (SRC2 = SNAN) THEN RETURN (QNAN(SRC2), set IE); 


Src1.exp := SRC1[62:52]; 

Src1.fraction := SRC1[51:0); 

IF ((Src1.exp = O ) and (Src1.fraction != 0)) THEN// Src1 is a denormal number 
IF DAZ THEN Src1.fraction := 0; 
ELSE IF (SRC2 <> QNAN) Set DE; FI; 

Fl; 


Sre2.exp := SRC2[62:52]; 

Src2.fraction := SRC2[51:0); 

IF ((Src2.exp = O) and (Src2.fraction !=0 )) THEN// Src2 is a denormal number 
IF DAZ THEN Src2.fraction := 0; 
ELSE IF (SRC1 <> QNAN) Set DE; FI; 

Fl; 


IF (SRC2 = QNAN) THEN{TMP[63:0] := SRC1[63:0]} 
ELSE IF(SRC1 = QNAN) THEN{TMP[63:0] := SRC2[63:0]} 
ELSE IF (Both SRC1, SRC2 are magnitude-0 and opposite-signed) TMP[63:0] := from Table 5-11 
ELSE IF (Both SRC1, SRC2 are magnitude-equal and opposite-signed and CmpOpCtl[1:0] > 01) TMP[63:0] := from Table 5-12 
ELSE 

Case(CmpOpCtl[1:0]) 

00: TMP[63:0] := (SRC1[63:0] < SRC2[63:0]) ? SRC1[63:0] : SRC2[63:0]; 

01: TMP[63:0] := (SRC1[63:0] < SRC2[63:0]) ? SRC2[63:0] : SRC1[63:0]; 

10: TMP[63:0] := (ABS(SRC1[63:0]) < ABS(SRC2[63:0])) ? SRC1[63:0] : SRC2[63:0]; 

11: TMP[63:0] := (ABS(SRC1[63:0]) < ABS(SRC2[63:0])) ? SRC2[63:0] : SRC1[63:0]; 

ESAC; 
Fl; 


Case(SignSelCtl[1:0]) 
00: dest := (SRC1[63] << 63) OR (TMP[62:0));// Preserve Src1 sign bit 
01: dest := TMP[63:0];// Preserve sign of compare result 
10: dest := (0 << 63) OR (TMP[62:0));// Zero out sign bit 
11: dest := (1 << 63) OR (TMP[62:0));// Set the sign bit 
ESAC; 
RETURN dest[63:0]; 
} 


CmpOpcCtl[1:0]= imm8[1:0]; 
SignSelCtl[1:0]=imm8[3:2]; 
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VRANGEPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] = RangeDP (SRC1[i+63:i], SRC2[63:0], CmpOpCtl[1:0], SignSelCtI[1:0)); 
ELSE DEST[i+63:i] := RangeDP (SRC1[i+63:i], SRC2[i+63:i], CmpOpCtl[1 :0], SignSelCtl[1:0}); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] = 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


The following example describes a common usage of this instruction for checking that the input operand is bound- 
ed between +1023. 


VRANGEPD zmm_dst, zmm_src, zmm_1023, 02h; 


Where: 
zmm_dst is the destination operand. 
zmm_src is the input operand to compare against £1023 (this is SRC1). 
zmm_1023 is the reference operand, contains the value of 1023 (and this is SRC2). 
IMM=02(imm8[1:0]='10) selects the Min Absolute value operation with selection of SRC1.sign. 


In case |zmm_src| < 1023 (i.e. SRC1 is smaller than 1023 in magnitude), then its value will be written into 
zmm_dst. Otherwise, the value stored in zmm_dst will get the value of 1023 (received on zmm_1i023, which is 
SRC2). 

However, the sign control (imm8[3:2]='00) instructs to select the sign of SRC1 received from zmm_src. So, even 
in the case of |Zmm_src| = 1023, the selected sign of SRC1 is kept. 

Thus, if zmm_src < -1023, the result of VRANGEPD will be the minimal value of -1023 while if zmm_src > +1023, 
the result of VRANGE will be the maximal value of +1023. 
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VRANGEPD __m512d_mm512_range_pd(__m512da, 
VRANGEPD __m512d_mm512_range_round_pd (__m512d a, 


VRANGEPD __m256d_mm256_range_pd (__m256d a, 


VRANGEPD __m128d_mm_maskz_range_pd (__mmask8 k, 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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m512d b, int imm); 

m512d b, int imm, int sae); 

VRANGEPD __m512d_mm512_mask_range_pd (__m512 ds,___mmask8 k,___m512d a,__m512d b, int imm); 
VRANGEPD __m512d_mm512_mask_range_round_pd (__m512ds, 
VRANGEPD __m512d_mm512_maskz_range_pd (__mmask8 k,___m512d a,__m512d b, int imm); 
VRANGEPD __m512d_mm512_maskz_range_round_pd (__mmask8 k, 
m256d b, int imm); 
VRANGEPD __m256d _mm256_mask_range_pd (__m256ds,__ mmask8 k,__ m256d a, 
VRANGEPD __m256d_mm256_maskz_range_pd (__mmask8 k,__ m256d a, 
VRANGEPD __m128d_mm_range_pd (__m128 a,__m128d, int imm); 
VRANGEPD __m128d_mm_mask_range_pd (__m128 s,___mmask8 k,__m128d a, ___m128d b, int imm); 
m1 28d b, int imm); 


mmask8 k,__m512da, 


m512d b, int imm, int sae); 


m256d b, int imm); 
m256d b, int imm); 


m128d a, 


INSTRUCTION SET REFERENCE, V-Z 


m512d b, int imm, int sae); 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F3A.WO 50 /r ib A VIV AVX512VL | Calculate four RANGE operation output value from 4 pairs 
VRANGEPS xmm1 {k1}{z}, xmm2, AVX512DQ_ | of single-precision floating-point values in xmm2 and 
xmm3/m128/m32bcst, imm8 xmm3/m128/m32bcst, store the results to xmm1 under 


the writemask k1.Imm8 specifies the comparison and sign 
of the range operation. 


EVEX.256.66.0F3A.WO 50 /r ib A VIV AVX512VL | Calculate eight RANGE operation output value from 8 pairs 
VRANGEPS ymm1 {k1}{z}, ymm2, AVX512DQ_ | of single-precision floating-point values in ymm2 and 
ymm3/m256/m32bcst, imm8 ymm3/m256/m32bcst, store the results to ymm1 under 


the writemask k1.Imm8 specifies the comparison and sign 
of the range operation. 


EVEX.512.66.0F3A.WO 50 /r ib A VIN AVX512DQ | Calculate 16 RANGE operation output value from 16 pairs 
VRANGEPS zmm1 {k1}{z}, zmm2, of single-precision floating-point values in zmm2 and 
zmm3/m512/m32bcst{sae}, imm8 zmm3/m512/m32bcst, store the results to zmm1 under 


the writemask k1.Imm8 specifies the comparison and sign 
of the range operation. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


This instruction calculates 4/8/16 range operation outputs from two sets of packed input single-precision FP values 
in the first source operand (the second operand) and the second source operand (the third operand). The range 
outputs are written to the destination operand (the first operand) under the writemask k1. 


Bits7:4 of imm8 byte must be zero. The range operation output is performed in two parts, each configured by a 
two-bit control field within imm8[3:0]: 
° Imm8[1:0] specifies the initial comparison operation to be one of max, min, max absolute value or min 


absolute value of the input value pair. Each comparison of two input values produces an intermediate result that 
combines with the sign selection control (Imm8[3:2]) to determine the final range operation output. 


° Imm8[3:2] specifies the sign of the range operation output to be one of the following: from the first input 
value, from the comparison result, set or clear. 

The encodings of Imm8[1:0] and Imm8[3:2] are shown in Figure 5-27. 

When one or more of the input value is a NAN, the comparison operation may signal invalid exception (IE). Details 


with one of more input value is NAN is listed in Table 5-10. If the comparison raises an IE, the sign select control 
(Imm8[3:2]) has no effect to the range operation output, this is indicated also in Table 5-10. 


When both input values are zeros of opposite signs, the comparison operation of MIN/MAX in the range compare 
operation is slightly different from the conceptually similar FP MIN/MAX operation that are found in the instructions 
VMAXPD/VMINPD. The details of MIN/MAX/MIN_ABS/MAX_ABS operation for VRANGEPD/PS/SD/SS for magni- 
tude-0, opposite-signed input cases are listed in Table 5-11. 


Additionally, non-zero, equal-magnitude with opposite-sign input values perform MIN_ABS or MAX_ABS compar- 
ison operation with result listed in Table 5-12. 
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Operation 
RangeSP(SRC1[31:0], SRC2[31:0], CmpOpCtl[1:0], SignSelCti[1:0]) 
{ 

// Check if SNAN and report IE, see also Table 5-10 

IF (SRC1=SNAN) THEN RETURN (QNAN(SRC1), set IE); 

IF (SRC2=SNAN) THEN RETURN (QNAN(SRC2), set IE); 


Src1.exp := SRC1[30:23]; 

Src1.fraction := SRC1[22:0); 

IF ((Src1.exp = O ) and (Src1.fraction != 0 )) THEN// Src1 is a denormal number 
IF DAZ THEN Src1.fraction := 0; 
ELSE IF (SRC2 <> QNAN) Set DE; FI; 

Fl; 

Src2.exp := SRC2[30:23); 

Srce2.fraction := SRC2[22:0]; 

IF ((Src2.exp = O ) and (Src2.fraction != 0 )) THEN// Src2 is a denormal number 
IF DAZ THEN Src2.fraction := 0; 
ELSE IF (SRC1 <> QNAN) Set DE; FI; 

Fl; 


IF (SRC2 = QNAN) THEN{TMP[31:0] := SRC1[31:0]} 
ELSE IF(SRC1 = QNAN) THEN{TMP[31:0] := SRC2[31:0]} 
ELSE IF (Both SRC1, SRC2 are magnitude-0 and opposite-signed) TMP[31:0] := from Table 5-11 
ELSE IF (Both SRC1, SRC2 are magnitude-equal and opposite-signed and CmpOpCtl[1:0] > 01) TMP[31:0] := from Table 5-12 
ELSE 
Case(CmpOpCtl[1:0]) 
00: TMP[31:0] := (SRC1[31:0] < SRC2[31:0]) ? SRC1[31:0] : SRC2[31:0]; 
01: TMP[31:0] := (SRC1[31:0] < SRC2[31:0]) ? SRC2[31:0] : SRC1[31:0]; 
10: TMP[31:0] := (ABS(SRC1[31:0]) < ABS(SRC2[31:0])) ? SRC1[31:0] : SRC2[3 1:0]; 
11: TMP[31:0] := (ABS(SRC1[31:0]) < ABS(SRC2[31:0])) ? SRC2[31:0] : SRC1[31:0]; 
ESAC; 
Fl; 
Case(SignSelCtl[1:0]) 
OO: dest := (SRC1[31] << 31) OR (TMP[30:0));// Preserve Src1 sign bit 
01: dest := TMP[31:0];// Preserve sign of compare result 
10: dest := (0 << 31) OR (TMP[30:0));// Zero out sign bit 
11: dest := (1 << 31) OR (TMP[30:0));// Set the sign bit 
ESAC; 
RETURN dest[31:0]; 
} 


CmpOpcCtl[1:0]= imm8[1:0]; 
SignSelCtl[1:0]=imm8[3:2]; 
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VRANGEPS 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] = RangeSP (SRC1[i+31:i], SRC2[31:0], CmpOpCtl[1:0], SignSelCtI[1:0]); 
ELSE DEST[i+31:i] := RangeSP (SRC1[i+31:i], SRC2[i+31:i], CmpOpCtl[1:0], SignSelCti[1:0}); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] = 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


The following example describes a common usage of this instruction for checking that the input operand is bound- 
ed between +150. 


VRANGEPS zmm_dst, zmm_src, zmm_1i50, 02h; 


Where: 

zmm_dst is the destination operand. 

zmm_src is the input operand to compare against +150. 

zmm_1i50 is the reference operand, contains the value of 150. 

IMM=02(imm8[1:0]="10) selects the Min Absolute value operation with selection of srci.sign. 


In case |zmm_src| < 150, then its value will be written into zmm_dst. Otherwise, the value stored in zmm_dst 
will get the value of 150 (received on zmm_i50). 


However, the sign control (imm8[3:2]=’00) instructs to select the sign of SRC1 received from zmm_src. So, even 
in the case of |Zmm_src| = 150, the selected sign of SRC1 is kept. 


Thus, if zmm_src < -150, the result of VRANGEPS will be the minimal value of -150 while if zmm_src > +150, 
the result of VRANGE will be the maximal value of +150. 
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VRANGEPS __m512_mm512_range_ps (__m512 a, 


VRANGEPS __m512_mm512_mask_range_ps (__m512s, 
VRANGEPS __m512_mm512_mask_range_round_ps (_m512s, 


VRANGEPS __m512_mm512_maskz_range_ps (__mmask16 k,__m512 a, 
VRANGEPS __m512_mm512_maskz_range_round_ps (__mmask16 k, 
m256 b, int imm); 
mmask8 k, 
VRANGEPS __m256 __mm256_maskz_range_ps (__mmask8 k,__m256 a, 
VRANGEPS __m128_mm_range_ps (__m128 a, ___m128, int imm); 

VRANGEPS __m128_mm_mask_range_ps (__m128s,__ mmask8 k,__m128 a, 
mi128 a, 


VRANGEPS __m256 _mm256_range_ps (__m256 a, 
VRANGEPS __m256 _mm256_mask_range_ps (__m256 s, 


VRANGEPS __m128_mm_maskz_range_ps (__mmask8 k, 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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m512 b, int imm); 

VRANGEPS __m512_mm512_range_round_ps (__m512 a,_m512 5, int imm, int sae); 

mmask16 k,__m512 a,__m512 b, int imm); 

m512 b, int imm, int sae); 
m512 b, int imm); 

m512 b, int imm, int sae); 


m256 b, int imm); 
m256 b, int imm); 


m128 b, int imm); 
m128 b, int imm); 
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VRANGESD—Range Restriction Calculation From a pair of Scalar Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.W1 51 /r A VIN AVX512DQ_ | Calculate a RANGE operation output value from 2 double- 
VRANGESD xmm1 {k1}{Z}, precision floating-point values in xmm2 and xmm3/m64, 
xmm2, xmm3/m64{sae}, imm8 store the output to xmm1 under writemask. Imm8 specifies 
the comparison and sign of the range operation. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


This instruction calculates a range operation output from two input double-precision FP values in the low qword 
element of the first source operand (the second operand) and second source operand (the third operand). The 
range output is written to the low qword element of the destination operand (the first operand) under the 
writemask k1. 


Bits7:4 of imm8 byte must be zero. The range operation output is performed in two parts, each configured by a 
two-bit control field within imm8[3:0]: 


° Imm8[1:0] specifies the initial comparison operation to be one of max, min, max absolute value or min 
absolute value of the input value pair. Each comparison of two input values produces an intermediate result that 
combines with the sign selection control (Imm8[3:2]) to determine the final range operation output. 

° Imm8[3:2] specifies the sign of the range operation output to be one of the following: from the first input 
value, from the comparison result, set or clear. 


The encodings of Imm8[1:0] and Imm8[3:2] are shown in Figure 5-27. 
Bits 128:63 of the destination operand are copied from the respective element of the first source operand. 


When one or more of the input value is a NAN, the comparison operation may signal invalid exception (IE). Details 
with one of more input value is NAN is listed in Table 5-10. If the comparison raises an IE, the sign select control 
(Imm8[3:2] has no effect to the range operation output, this is indicated also in Table 5-10. 


When both input values are zeros of opposite signs, the comparison operation of MIN/MAX in the range compare 
operation is slightly different from the conceptually similar FP MIN/MAX operation that are found in the instructions 
VMAXPD/VMINPD. The details of MIN/MAX/MIN_ABS/MAX_ABS operation for VRANGEPD/PS/SD/SS for magni- 
tude-0, opposite-signed input cases are listed in Table 5-11. 

Additionally, non-zero, equal-magnitude with opposite-sign input values perform MIN_ABS or MAX_ABS compar- 
ison operation with result listed in Table 5-12. 
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Operation 
RangeDP(SRC1[63:0], SRC2[63:0], CmpOpCti[1:0], SignSelCti[1 :0]) 
{ 

// Check if SNAN and report IE, see also Table 5-10 

IF (SRC1 = SNAN) THEN RETURN (QNAN(SRC1), set IE); 

IF (SRC2 = SNAN) THEN RETURN (QNAN(SRC2), set IE); 


Src1.exp := SRC1[62:52]; 

Src1.fraction := SRC1[51:0); 

IF ((Src1.exp = O ) and (Src1.fraction != 0)) THEN// Src1 is a denormal number 
IF DAZ THEN Src1.fraction := 0; 
ELSE IF (SRC2 <> QNAN) Set DE; FI; 

Fl; 


Sre2.exp := SRC2[62:52]; 

Src2.fraction := SRC2[51:0); 

IF ((Src2.exp = O) and (Src2.fraction !=0 )) THEN// Src2 is a denormal number 
IF DAZ THEN Src2.fraction := 0; 
ELSE IF (SRC1 <> QNAN) Set DE; FI; 

Fl; 


IF (SRC2 = QNAN) THEN{TMP[63:0] := SRC1[63:0]} 
ELSE IF(SRC1 = QNAN) THEN{TMP[63:0] := SRC2[63:0]} 
ELSE IF (Both SRC1, SRC2 are magnitude-0 and opposite-signed) TMP[63:0] := from Table 5-11 
ELSE IF (Both SRC1, SRC2 are magnitude-equal and opposite-signed and CmpOpCtl[1:0] > 01) TMP[63:0] := from Table 5-12 
ELSE 

Case(CmpOpCtl[1:0]) 

00: TMP[63:0] := (SRC1[63:0] < SRC2[63:0]) ? SRC1[63:0] : SRC2[63:0]; 

01: TMP[63:0] := (SRC1[63:0] < SRC2[63:0]) ? SRC2[63:0] : SRC1[63:0]; 

10: TMP[63:0] := (ABS(SRC1[63:0]) < ABS(SRC2[63:0])) ? SRC1[63:0] : SRC2[63:0]; 

11: TMP[63:0] := (ABS(SRC1[63:0]) < ABS(SRC2[63:0])) ? SRC2[63:0] : SRC1[63:0]; 

ESAC; 
Fl; 


Case(SignSelCtl[1:0]) 
00: dest := (SRC1[63] << 63) OR (TMP[62:0));// Preserve Src1 sign bit 
01: dest := TMP[63:0];// Preserve sign of compare result 
10: dest := (0 << 63) OR (TMP[62:0));// Zero out sign bit 
11: dest := (1 << 63) OR (TMP[62:0));// Set the sign bit 
ESAC; 
RETURN dest[63:0]; 
} 


CmpOpcCtl[1:0]= imm8[1:0]; 
SignSelCtl[1:0]=imm8[3:2]; 
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VRANGESD 
IF k1[0] OR *no writemask* 
THEN DEST[63:0] := RangeDP (SRC1[63:0], SRC2[63:0], CmpOpCtl[1:0], SignSelCtl[1:0]); 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] = 0 
Fl; 
Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


The following example describes a common usage of this instruction for checking that the input operand is bound- 
ed between +1023. 


VRANGESD xmm_dst, xmm_src, xmm_1023, 02h; 


Where: 

xmm_dst is the destination operand. 

xmm_src is the input operand to compare against +1023. 

xmm_1023 is the reference operand, contains the value of 1023. 

IMM=02(imm8[1:0]=’10) selects the Min Absolute value operation with selection of srci.sign. 


In case |xmm_src| < 1023, then its value will be written into xmm_dst. Otherwise, the value stored in xmm_dst 
will get the value of 1023 (received on xmm_1i023). 

However, the sign control (imm8[3:2]=’00) instructs to select the sign of SRC1 received from xmm_src. So, even 
in the case of |xmm_src| = 1023, the selected sign of SRC1 is kept. 

Thus, if xmm_src < -1023, the result of VRANGEPD will be the minimal value of -1023while if xmm_src > +1023, 
the result of VRANGE will be the maximal value of +1023. 


Intel C/C++ Compiler Intrinsic Equivalent 


VRANGESD __m128d_mm_range_sd (__m128d a, ___m128d, int imm); 

VRANGESD __m128d_mm_range_round_sd (__m128d a, ___m128d }, int imm, int sae); 

VRANGESD __m128d _mm_mask_range_sd (__m128d s,___mmask8 k,___m128d a,__m128d b, int imm); 

VRANGESD __m128d _mm_mask_range_round_sd (__m128d s,___mmask8 k,___m128d a, __m128d b, int imm, int sae); 
VRANGESD __m128d __mm_maskz_range_sd (__mmask8 k,__m128d a, ___m128db, int imm); 

VRANGESD __m128d _mm_maskz_range_round_sd (__mmask8 k, __m128d a,__m128d b, int imm, int sae); 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VRANGESS—Range Restriction Calculation From a Pair of Scalar Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.WO 51 /r A VIV AVX512DQ_ | Calculate a RANGE operation output value from 2 single- 
VRANGESS xmm1 {k1}{z}, precision floating-point values in xmm2 and xmm3/m32, 
xmm2, xmm3/m32{sae}, imm8 store the output to xmm1 under writemask. Imm8 specifies 
the comparison and sign of the range operation. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction calculates a range operation output from two input single-precision FP values in the low dword 
element of the first source operand (the second operand) and second source operand (the third operand). The 
range output is written to the low dword element of the destination operand (the first operand) under the 
writemask k1. 

Bits7:4 of imm8 byte must be zero. The range operation output is performed in two parts, each configured by a 
two-bit control field within imm8[3:0]: 


¢ Imm8[1:0] specifies the initial comparison operation to be one of max, min, max absolute value or min 
absolute value of the input value pair. Each comparison of two input values produces an intermediate result 
that combines with the sign selection control (Imm8[3:2]) to determine the final range operation output. 


¢ Imm8[3:2] specifies the sign of the range operation output to be one of the following: from the first input 
value, from the comparison result, set or clear. 

The encodings of Imm8[1:0] and Imm8[3:2] are shown in Figure 5-27. 

Bits 128:31 of the destination operand are copied from the respective elements of the first source operand. 

When one or more of the input value is a NAN, the comparison operation may signal invalid exception (IE). Details 


with one of more input value is NAN is listed in Table 5-10. If the comparison raises an IE, the sign select control 
(Imm8[3:2]) has no effect to the range operation output, this is indicated also in Table 5-10. 


When both input values are zeros of opposite signs, the comparison operation of MIN/MAX in the range compare 
operation is slightly different from the conceptually similar FP MIN/MAX operation that are found in the instructions 
VMAXPD/VMINPD. The details of MIN/MAX/MIN_ABS/MAX_ABS operation for VRANGEPD/PS/SD/SS for magni- 
tude-0, opposite-signed input cases are listed in Table 5-11. 


Additionally, non-zero, equal-magnitude with opposite-sign input values perform MIN_ABS or MAX_ABS compar- 
ison operation with result listed in Table 5-12. 
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Operation 
RangeSP(SRC1[31:0], SRC2[31:0], CmpOpCtl[1:0], SignSelCtI[1:0]) 
{ 

// Check if SNAN and report IE, see also Table 5-10 

IF (SRC1=SNAN) THEN RETURN (QNAN(SRC1), set IE); 

IF (SRC2=SNAN) THEN RETURN (QNAN(SRC2), set IE); 


Src1.exp := SRC1[30:23]; 

Src1.fraction := SRC1[22:0); 

IF ((Src1.exp = 0 ) and (Src1.fraction != 0 )) THEN// Src1 is a denormal number 
IF DAZ THEN Src1.fraction := 0; 
ELSE IF (SRC2 <> QNAN) Set DE; FI; 

Fl; 

Src2.exp := SRC2[30:23]; 

Src2.fraction := SRC2[22:0]; 

IF ((Src2.exp = 0 ) and (Src2.fraction != 0 )) THEN// Src2 is a denormal number 
IF DAZ THEN Src2.fraction := 0; 
ELSE IF (SRC1 <> QNAN) Set DE; FI; 

Fl; 


IF (SRC2 = QNAN) THEN{TMP[31:0] := SRC1[31:0]} 
ELSE IF(SRC1 = QNAN) THEN{TMP[31:0] := SRC2[31:0]} 
ELSE IF (Both SRC1, SRC2 are magnitude-0 and opposite-signed) TMP[31:0] := from Table 5-11 
ELSE IF (Both SRC1, SRC2 are magnitude-equal and opposite-signed and CmpOpCtl[1:0] > 01) TMP[31:0] := from Table 5-12 
ELSE 
Case(CmpOpCtl[1:0]) 
00: TMP[31:0] := (SRC1[31:0] < SRC2[31:0]) ? SRC1[31:0] : SRC2[31:0]; 
01: TMP[31:0] := (SRC1[31:0] < SRC2[31:0]) ? SRC2[31:0] : SRC1[31:0]; 
10: TMP[31:0] := (ABS(SRC1[31:0]) < ABS(SRC2[31:0])) ? SRC1[31:0] : SRC2[3 1:0]; 
11: TMP[31:0] := (ABS(SRC1[31:0]) < ABS(SRC2[31:0])) ? SRC2[31:0] : SRC1[31:0]; 
ESAC; 
Fl; 
Case(SignSelCtl[1:0]) 
00: dest := (SRC1[31] << 31) OR (TMP[30:0]);// Preserve Src1 sign bit 
01: dest := TMP[31:0];// Preserve sign of compare result 
10: dest := (0 << 31) OR (TMP[30:0));// Zero out sign bit 
11: dest := (1 << 31) OR (TMP[30:0));// Set the sign bit 
ESACG; 
RETURN dest[31:0]; 
} 


CmpOpcCtl[1:0]= imm8[1:0]; 
SignSelCtl[1:0]=imm8[3:2]; 
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VRANGESS 
IF k1[0] OR *no writemask* 
THEN DEST[31:0] := RangeSP (SRC1[31:0], SRC2[31:0], CmpOpCtl[1:0], SignSelCti[1:0)); 
ELSE 
IF *merging-masking* ;Merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] = 0 
Fl; 
Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


The following example describes a common usage of this instruction for checking that the input operand is 
bounded between +150. 


VRANGESS zmm_dst, zmm_src, zmm_150, 02h; 


Where: 

xmm_dst is the destination operand. 

xmm_src is the input operand to compare against +150. 

xmm_150 is the reference operand, contains the value of 150. 

IMM=02(imm8[1:0]="10) selects the Min Absolute value operation with selection of srci.sign. 


In case |xmm_src] < 150, then its value will be written into zmm_dst. Otherwise, the value stored in xmm_dst 
will get the value of 150 (received on zmm_1i50). 

However, the sign control (imm8[3:2]='00) instructs to select the sign of SRC1 received from xmm_src. So, even 
in the case of |xmm_src| = 150, the selected sign of SRC1 is kept. 

Thus, if xmm_src < -150, the result of VRANGESS will be the minimal value of -150 while if xmm_src > +150, 
the result of VRANGE will be the maximal value of +150. 


Intel C/C++ Compiler Intrinsic Equivalent 


VRANGESS __m128_mm_range_ss (__m128 a, ___m128 b, int imm); 

VRANGESS __m128_mm_range_round_ss (__m128 a,_m128, int imm, int sae); 

VRANGESS __m128_mm_mask_range_ss (__m128 s,___mmask8 k,__m128 a,__m128 b, int imm); 
VRANGESS __m128 _mm_mask_range_round_ss (__m128 s,___mmask8 k,__m128 a,__m128 b, int imm, int sae); 
VRANGESS __m128_mm_maskz_range_ss (__mmask8 k, __m128 a, ___m128 b, int imm); 

VRANGESS __m128_mm_maskz_range_round_ss (__mmask8 k,__m128 a,__m128 b, int imm, int sae); 


SIMD Floating-Point Exceptions 


Invalid, Denormal 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VRCP14PD—Compute Approximate Reciprocals of Packed Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 4C /r A VN AVX512VL_ | Computes the approximate reciprocals of the packed double- 
VRCP14PD xmm1 {k1}{z}, AVX512F precision floating-point values in xmm2/m128/m64bcst and 
xmm2/m128/m64bcst stores the results in xmm1. Under writemask. 
EVEX.256.66.0F38.W1 4C /r A VN AVX512VL_ | Computes the approximate reciprocals of the packed double- 
VRCP14PD ymm1 {k1}{z}, AVX512F precision floating-point values in ymm2/m256/m64bcst and 
ymm2/m256/m64bcst stores the results in ymm1. Under writemask. 
EVEX.512.66.0F38.W1 4C /r A VIV AVX512F Computes the approximate reciprocals of the packed double- 
VRCP14PD zmm1 {k1}{z}, precision floating-point values in zmm2/m512/m64bcst and 
zmm2/m512/m64bcst stores the results in zmm1. Under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocals of eight/four/two packed double- 
precision floating-point values in the source operand (the second operand) and stores the packed double-precision 
floating-point results in the destination operand. The maximum relative error for this approximation is less than 27 
14 


The source operand can be a ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 64- 
bit memory location. The destination operand is a ZMM register conditionally updated according to the writemask. 


The VRCP14PD instruction is not affected by the rounding control bits in the MXCSR register. When a source value 
is a 0.0, an ~ with the sign of the source value is returned. A denormal source value will be treated as zero only in 
case of DAZ bit set in MXCSR. Otherwise it is treated correctly (i.e. not as a 0.0). Underflow results are flushed to 
zero only in case of FTZ bit set in MXCSR. Otherwise it will be treated correctly (i.e. correct underflow result is 
written) with the sign of the operand. When a source value is a SNaN or QNaN, the SNaN is converted to a QNaN or 
the source QNaN is returned. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 


Table 5-13. VRCP14PD/VRCP14SD Special Cases 


Input value Result value Comments 

0<x< 271024 INF Very small denormal 

-2°1024 <x <9 -INF Very small denormal 

X > 21022 Underflow Up to 18 bits of fractions are returned* 
X < -21022 -Underflow Up to 18 bits of fractions are returned* 
X=2n 2 

X=-27 -2" 


* in this case the mantissa is shifted right by one or two bits 


A numerically exact implementation of VRCP14xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 
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Operation 


VRCP14PD ((EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+63:i] := APPROXIMATE(1.0/SRC[63:0]); 
ELSE DEST[i+63:i] := APPROXIMATE(1.0/SRC[i+63:i]); 


Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] :-= 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VRCP14PD __m512d_mm512_rcp14_pd(__m512d a); 
VRCP14PD __m512d_mm512_mask_rcp14_pd(__m512ds, 
VRCP14PD __m512d_mm512_maskz_rcp14_pd(__mmask8 k, 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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mmask8 k, 
m512d a); 
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VRCP14SD—Compute Approximate Reciprocal of Scalar Float64 Value 


Opcode/ Op | 64/32 CPUID Description 
Instruction /En | bitMode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.W1 4D /r A VIV AVX512F | Computes the approximate reciprocal of the scalar double- 
VRCP14SD xmm1 {k1}{z}, xmm2, precision floating-point value in xmm3/m64 and stores the 
xmm3/m64 result in xmm1 using writemask k1. Also, upper double- 
precision floating-point value (bits[127:64]) from xmm_2 is 
copied to xmm1[127:64]. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocal of the low double-precision floating- 
point value in the second source operand (the third operand) stores the result in the low quadword element of the 
destination operand (the first operand) according to the writemask k1. Bits (127:64) of the XMM register destina- 
tion are copied from corresponding bits in the first source operand (the second operand). The maximum relative 
error for this approximation is less than 2"!4. The source operand can be an XMM register or a 64-bit memory loca- 


tion. The destination operand is an XMM register. 


The VRCP14SD instruction is not affected by the rounding control bits in the MXCSR register. When a source value 
is a 0.0, an ~ with the sign of the source value is returned. A denormal source value will be treated as zero only in 
case of DAZ bit set in MXCSR. Otherwise it is treated correctly (i.e. not as a 0.0). Underflow results are flushed to 
zero only in case of FTZ bit set in MXCSR. Otherwise it will be treated correctly (i.e. correct underflow result is 
written) with the sign of the operand. When a source value is a SNaN or QNaN, the SNaN is converted to a QNaN or 
the source QNaN is returned. See Table 5-13 for special-case input values. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 


A numerically exact implementation of VRCP14xx can be found at: 


https://software.intel.com/en-us/articles/reference-implementations-for-IA-approximation-instructions-vrcp14- 


vrsgrti4-vrcp28-vrsqrt28-vexp2. 


Operation 


VRCP14SD (EVEX version) 
IF k1[0] OR *no writemask* 


THEN DEST[63:0] := APPROXIMATE(1.0/SRC2[63:0)); 


ELSE 
IF *merging-masking* 


ELSE 
DEST[63:0] := 0 
Fl; 
Fl; 
DEST[1 27:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 
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; merging-masking 
THEN *DEST[63:0] remains unchanged* 
; zeroing-masking 


VRCP14SD—Compute Approximate Reciprocal of Scalar Float64 Value 


Intel C/C++ Compiler Intrinsic Equivalent 

VRCP14SD __m128d_mm_rcp14_sd(__m128da,__m128d b); 

VRCP14SD __m128d_mm_mask_rcp14_sd(__m128ds,__ mmask8 k,__ m128d a, 
VRCP14SD __m128d _mm_maskz_rcp14_sd(__mmask8 k,___m128d a,_m128d b); 


m128d b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-51, “Type E5 Class Exception Conditions”. 
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VRCP14PS—Compute Approximate Reciprocals of Packed Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 4C /r A VIV AVX512VL_ | Computes the approximate reciprocals of the packed single- 
VRCP14PS xmm1 {k1}{z}, AVX512F precision floating-point values in xmm2/m128/m32bcst and 
xmm2/m128/m32bcst stores the results in xmm1. Under writemask. 
EVEX.256.66.0F38.W0 4C /r A VV AVX512VL_ | Computes the approximate reciprocals of the packed single- 
VRCP14PS ymm1 {k1}{z}, AVX512F precision floating-point values in ymm2/m256/m32bcst and 
ymm2/m256/m32bcst stores the results in ymm1. Under writemask. 
EVEX.512.66.0F38.W0O 4C /r A VV AVX512F Computes the approximate reciprocals of the packed single- 
VRCP14PS zmm1 {k1}{Z}, precision floating-point values in zmm2/m512/m32bcst and 
zmm2/m512/m32bcst stores the results in zmm1. Under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocals of the packed single-precision 
floating-point values in the source operand (the second operand) and stores the packed single-precision floating- 
point results in the destination operand (the first operand). The maximum relative error for this approximation is 
less than 2714, 


The source operand can be a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 32- 
bit memory location. The destination operand is a ZMM register conditionally updated according to the writemask. 


The VRCP14PS instruction is not affected by the rounding control bits in the MXCSR register. When a source value 
is a 0.0, an -~ with the sign of the source value is returned. A denormal source value will be treated as zero only in 
case of DAZ bit set in MXCSR. Otherwise it is treated correctly (i.e. not as a 0.0). Underflow results are flushed to 
zero only in case of FTZ bit set in MXCSR. Otherwise it will be treated correctly (i.e. correct underflow result is 
written) with the sign of the operand. When a source value is a SNaN or QNaN, the SNaN is converted to a QNaN or 
the source QNaN is returned. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 


Table 5-14. VRCP14PS/VRCP14SS Special Cases 


Input value Result value Comments 

O<X<2128 INF Very small denormal 

2128 x ¢-0 -INF Very small denormal 

X > 2126 Underflow Up to 18 bits of fractions are returned* 
X < -2126 -Underflow Up to 18 bits of fractions are returned* 
X=2n 2" 

X=-27 -2" 


* in this case the mantissa is shifted right by one or two bits 


A numerically exact implementation of VRCP14xx can be found at: 


https://software.intel.com/en-us/articles/reference-implementations-for-IA-approximation-instructions-vrcp14- 
vrsqrti4-vrcp28-vrsqrt28-vexp2. 


5-532 Vol. 2C VRCP14PS—Compute Approximate Reciprocals of Packed Float32 Values 


Operation 


VRCP14PS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory’) 
THEN DEST[i+31:i] = APPROXIMATE(1.0/SRC[31:0]); 
ELSE DEST[i+31:i] := APPROXIMATE(1.0/SRC[i+31:i]); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRCP14PS___m512_mm512_rcp14_ps(__m512 a); 
VRCP14PS___m512_mm512_mask_rcp14_ps(__m512s, 


VRCP14PS __m256_mm256_rcp14_ps(__m256 a); 
VRCP14PS___m256 __mm512_mask_rcp14_ps(__m256 s, 


mmask8 k, 


VRCP14PS __m256 __mm512_maskz_rcp14_ps(__ mmask8 k, __m256 a); 


VRCP14PS __m128_mm_rcp14_ps(__m128 a); 
VRCP14PS __m128_mm_mask_rcp14_ps(__m128 s,__mmask8 k, 
VRCP14PS __m128_mm_maskz_rcp14_ps(__mmask8 k, __m128 a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-49, “Type E4 Class Exception Conditions”. 
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mmask16 k, 
VRCP14PS __m512_mm512_maskz_rcp14_ps(__ mmask16 k,___m512 a); 


m128 a); 
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VRCP14SS—Compute Approximate Reciprocal of Scalar Float32 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support Flag 
EVEX.LLIG.66.0F38.W0 4D /r A VV AVX512F | Computes the approximate reciprocal of the scalar single- 
VRCP14SS xmm1 {k1}{z}, xmm2, precision floating-point value in xmm3/m32 and stores the 
xmm3/m32 results in xmm1 using writemask k1. Also, upper double- 
precision floating-point value (bits[127:32]) from xmm2 is 
copied to xmm1[1 27:32]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocal of the low single-precision floating- 
point value in the second source operand (the third operand) and stores the result in the low quadword element of 
the destination operand (the first operand) according to the writemask k1. Bits (127:32) of the XMM register desti- 
nation are copied from corresponding bits in the first source operand (the second operand). The maximum relative 
error for this approximation is less than 27!4. The source operand can be an XMM register or a 32-bit memory loca- 
tion. The destination operand is an XMM register. 


The VRCP14SS instruction is not affected by the rounding control bits in the MXCSR register. When a source value 
is a 0.0, an ~ with the sign of the source value is returned. A denormal source value will be treated as zero only in 
case of DAZ bit set in MXCSR. Otherwise it is treated correctly (i.e. not as a 0.0). Underflow results are flushed to 
zero only in case of FTZ bit set in MXCSR. Otherwise it will be treated correctly (i.e. correct underflow result is 
written) with the sign of the operand. When a source value is a SNaN or QNaN, the SNaN is converted to a QNaN or 
the source QNaN is returned. See Table 5-14 for special-case input values. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 


A numerically exact implementation of VRCP14xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 
VRCP14SS (EVEX version) 
IF k1[0] OR *no writemask* 
THEN DEST[31:0] := APPROXIMATE(1.0/SRC2[31:0)); 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl; 
Fl; 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VRCP14SS___m128_mm_rcp14_ss(__m128a,__m128 b); 

VRCP14SS_ __m128 _mm_mask_rcp14_ss(__m128s,__mmask8 k,__m128 a,__m128 b); 
VRCP14SS __m128 _mm_maskz_rcp14_ss(__mmask8 k,__m128 a,__m128 b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-51, “Type E5 Class Exception Conditions”. 
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VREDUCEPD—Perform Reduction Transformation on Packed Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W156/rib | A VV AVX512VL_ | Perform reduction transformation on packed double-precision 
VREDUCEPD xmm1 {k1}{z}, AVX512DQ_ | floating point values in xmm2/m128/m32bcst by subtracting 
xmm2/m128/m64bcst, imm8 a number of fraction bits specified by the immé8 field. Stores 
the result in xmm1 register under writemask k1. 
EVEX.256.66.0F3A.W156/rib | A VV AVX512VL_ | Perform reduction transformation on packed double-precision 
VREDUCEPD ymm1 {k1}{z}, AVX512DQ_ | floating point values in ymm2/m256/m32bcst by subtracting 
ymm2/m256/m64bcst, imm8 a number of fraction bits specified by the immé8 field. Stores 
the result in ymm1 register under writemask k1. 
EVEX.512.66.0F3A.W1 56 /rib | A VV AVX512DQ_ | Perform reduction transformation on double-precision floating 
VREDUCEPD zmm1 {k1}{Z}, point values in zmm2/m512/m32bcst by subtracting a 
zmm2/m512/m64bcst{sae}, number of fraction bits specified by the imm8 field. Stores the 
imm8 result in zmm1 register under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8 NA 
Description 


Perform reduction transformation of the packed binary encoded double-precision FP values in the source operand 
(the second operand) and store the reduced results in binary FP format to the destination operand (the first 
operand) under the writemask k1. 


The reduction transformation subtracts the integer part and the leading M fractional bits from the binary FP source 
value, where M is a unsigned integer specified by imm8[7:4], see Figure 5-28. Specifically, the reduction transfor- 
mation can be expressed as: 


dest = src —- (ROUND(2™*src))*2™: 


where “Round()” treats “src”, “2”, and their product as binary FP numbers with normalized significand and bi- 
ased exponents. 


The magnitude of the reduced result can be expressed by considering src= 2P*man2, 
where ‘manz2’ is the normalized significand and ‘p’ is the unbiased exponent 

Then if RC = RNE: 0<=|Reduced Result|<=2?"™-1 

Then if RC # RNE: 0<=|Reduced Result|<2?-™ 


This instruction might end up with a precision exception set. However, in case of SPE set (i.e. Suppress Precision 
Exception, which is imm8[3]=1), no precision exception is reported. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


7 6 5 4 3 2 1 0 


imm8 Fixed point length SPE RS Round Control Override 


Suppress Precision Exception: Imm8[3] Imm8[1:0] = 00b : Round nearest even 
Imm8[3] = Ob : Use MXCSR exception mask — Round Select: Imm8[2] Imm8[1:0] = 01b : Round down 
Imm8[3] = 1b : Suppress Imm8[2] = Ob : Use Imm8[1:0] Imm8{[1:0] = 10b : Round up 

Immé[2] = 1b: Use MXCSR Imm8[1:0] = 11b : Truncate 


Imm8[7:4] : Number of fixed points to subtract 


Figure 5-28. Imm8 Controls for VREDUCEPD/SD/PS/SS 
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Handling of special case of input values are listed in Table 5-15. 


Table 5-15. VREDUCEPD/SD/PS/SS Special Cases 


Round Mode Returned value 
\Srel|<2™! RNE Srcl 
RPI, Src1 > O Round (Src1-2"") * 
RPI, Src1 < O Src 
RNI, Src1 2 0 Src 
|Srel] <2™ RNI, Src1 < O Round (Src1+2™) * 
eee NOT RNI +0.0 
Dest = £0 (Srcl!=INF) RNI -0.0 
Srcl = +INF any +0.0 
Src l= +NAN n/a QNaN(Src1) 


* Round control = (imm8.MS1)? MXCSR.RC: imm8.RC 


Operation 


ReduceArgumentDP(SRC[63:0], imm8[7:0]) 
{ 
// Check for NaN 
IF (SRC [63:0] = NAN) THEN 
RETURN (Convert SRC[63:0] to QNaN); FI; 
M := imm8[7:4]; // Number of fraction bits of the normalized significand to be subtracted 
RC := imm8[1:0];// Round Control for ROUND() operation 
RC source := imm[2]; 
SPE := imm[3];// Suppress Precision Exception 
TMP[63:0] := 2™ {ROUND(2™*SRC[63:0], SPE, RC_source, RC)}; // ROUND() treats SRC and 2" as standard binary FP values 
TMP[63:0] := SRC[63:0] - TMP[63:0]; // subtraction under the same RC,SPE controls 
RETURN TMP[63:0]; // binary encoded FP with biased exponent and normalized significand 
} 


VREDUCEPD 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC *is memory’) 
THEN DEST[i+63:i] = ReduceArgumentDP(SRC[63:0], imm8[7:0]); 
ELSE DEST[i+63:i] := ReduceArgumentDP(SRC[i+63:i], imm8[7:0]); 


Fl; 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] = 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VREDUCEPD __m512d_mm512_mask_reduce_pd( 


VREDUCEPD __m512d_mm512_mask_reduce_pd( 


VREDUCEPD __m512d_mm512_maskz_reduce_pd( 


VREDUCEPD __m256d __mm256_mask_reduce_pd( 
VREDUCEPD __m256d __mm256_mask_reduce_pd( 


VREDUCEPD __m256d __mm256_maskz_reduce_pd( 


m512d a, int imm, int sae) 

m512ds,__mmask8 k,__m512d a, int imm, int sae) 
mmask8 k,__m512d a, int imm, int sae) 

m256d a, int imm) 

m256d s,__ mmask8 k,___m256d a, int imm) 


m256d a, int imm) 


VREDUCEPD __m128d_mm_mask_reduce_pd(__m128d a, int imm) 


VREDUCEPD __m128d_mm_mask_reduce_pd(__m128d s, 
VREDUCEPD __m128d __mm_maskz_reduce_pd(__mmask8 k, 


SIMD Floating-Point Exceptions 


Invalid, Precision 


mmask8 k, 
m128d a, int imm) 


m128d a, int imm) 


If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 


#UD If EVEX.vvvv != 1111B. 
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VREDUCESD—Perform a Reduction Transformation on a Scalar Float64 Value 


Opcode/ Op/ | 64/32bit | CPUID Description 
Instruction En Mode Feature 

Support Flag 
EVEX.LLIG.66.0F3A.W1 57 A VIV AVX512D | Performa reduction transformation ona scalar double-precision 
VREDUCESD xmm1 {k1}{z}, Q floating point value in xmm3/m64 by subtracting a number of 
xmm_2, xmm3/m64{sae}, fraction bits specified by the imm8 field. Also, upper double 
imm8/r precision floating-point value (bits[127:64]) from xmm2 are 

copied to xmm1[127:64]. Stores the result in xmm1 register. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Perform a reduction transformation of the binary encoded double-precision FP value in the low qword element of 
the second source operand (the third operand) and store the reduced result in binary FP format to the low qword 
element of the destination operand (the first operand) under the writemask k1. Bits 127:64 of the destination 
operand are copied from respective qword elements of the first source operand (the second operand). 

The reduction transformation subtracts the integer part and the leading M fractional bits from the binary FP source 
value, where M is a unsigned integer specified by imm8[7:4], see Figure 5-28. Specifically, the reduction transfor- 
mation can be expressed as: 

dest = src - (ROUND(2™*src))*2™; 

where “Round()” treats “src”, “2™”, and their product as binary FP numbers with normalized significand and bi- 
ased exponents. 


The magnitude of the reduced result can be expressed by considering src= 2?*manz2, 

where ‘man2’ is the normalized significand and ‘p’ is the unbiased exponent 

Then if RC = RNE: 0<=|Reduced Result|<=2?°™-1 

Then if RC # RNE: 0<=|Reduced Result|<2?-™ 

This instruction might end up with a precision exception set. However, in case of SPE set (i.e. Suppress Precision 
Exception, which is imm8[3]=1), no precision exception is reported. 

The operation is write masked. 

Handling of special case of input values are listed in Table 5-15. 


Operation 
ReduceArgumentDP(SRC[63:0], imm8[7:0]) 
{ 
// Check for NaN 
IF (SRC [63:0] = NAN) THEN 
RETURN (Convert SRC[63:0] to QNaN); FI; 
M := imm8[7:4]; // Number of fraction bits of the normalized significand to be subtracted 
RC := imm8[1:0];// Round Control for ROUND() operation 
RC source := imm[2]; 
SPE := imm[3];// Suppress Precision Exception 
TMP[63:0] := 2™ *{ROUND(2*SRC[63:0], SPE, RC_source, RC)}; // ROUND() treats SRC and 2" as standard binary FP values 
TMP[63:0] := SRC[63:0] - TMP[63:0]; // subtraction under the same RC,SPE controls 
RETURN TMP[63:0]; // binary encoded FP with biased exponent and normalized significand 
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VREDUCESD 
IF k1[0] or *no writemask* 
THEN  DEST[63:0] := ReduceArgumentDP(SRC2[63:0], imm8[7:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] = 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VREDUCESD __m128d_mm_mask_reduce_sd(__m128da,__m128d, int imm, int sae) 


VREDUCESD __m128d _mm_mask_reduce_sd(__m128d s,___ mmask16 k,__m128d a,_m128d, int imm, int sae) 
VREDUCESD __m128d _mm_maskz_reduce_sd(__mmask16 k,__m128d a,__m128d, int imm, int sae) 


SIMD Floating-Point Exceptions 
Invalid, Precision 
If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 


5-540 Vol. 2C VREDUCESD—Perform a Reduction Transformation on a Scalar Float64 Value 


INSTRUCTION SET REFERENCE, V-Z 


VREDUCEPS—Perform Reduction Transformation on Packed Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 56 /r ib A VIV AVX512VL Perform reduction transformation on packed single-precision 
VREDUCEPS xmm1 {k1}{z}, AVX512DQ_ | floating point values in xmm2/m1 28/m32bcst by subtracting 
xmm2/m128/m32bcst, imm8 a number of fraction bits specified by the immé8 field. Stores 
the result in xmm1 register under writemask k1. 
EVEX.256.66.0F3A.WO 56 /r ib A VIV AVX512VL Perform reduction transformation on packed single-precision 
VREDUCEPS ymm1 {k1}{z}, AVX512DQ_ | floating point values in ymm2/m256/m3 2bcst by subtracting 
ymm2/m256/m32bcst, imm8 a number of fraction bits specified by the immé8 field. Stores 
the result in ymm1 register under writemask k1. 
EVEX.512.66.0F3A.W0 56 /rib | A VIN AVX512DQ_ | Perform reduction transformation on packed single-precision 
VREDUCEPS zmm1 {k1}{Z}, floating point values in zmm2/m512/m32bcst by subtracting 
zmm2/m512/m32bcst{sae}, a number of fraction bits specified by the immé8 field. Stores 
imm8 the result in zmm1 register under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8 NA 
Description 


Perform reduction transformation of the packed binary encoded single-precision FP values in the source operand 
(the second operand) and store the reduced results in binary FP format to the destination operand (the first 
operand) under the writemask k1. 


The reduction transformation subtracts the integer part and the leading M fractional bits from the binary FP source 
value, where M is a unsigned integer specified by imm8[7:4], see Figure 5-28. Specifically, the reduction transfor- 
mation can be expressed as: 

dest = src - (ROUND(2™*src))*2™; 

where “Round()” treats “sre”, “2™”, and their product as binary FP numbers with normalized significand and bi- 
ased exponents. 

The magnitude of the reduced result can be expressed by considering src= 2P*man2, 

where ‘man2’ is the normalized significand and ‘p’ is the unbiased exponent 

Then if RC = RNE: 0<=|Reduced Result|<=2?°™-1 


Then if RC # RNE: 0<=|Reduced Result|<2?-™ 


This instruction might end up with a precision exception set. However, in case of SPE set (i.e. Suppress Precision 
Exception, which is imm8[3]=1), no precision exception is reported. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 
Handling of special case of input values are listed in Table 5-15. 
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Operation 


ReduceArgumentSP(SRC[3 1:0], imm8[7:0]) 
{ 

// Check for NaN 

IF (SRC [31:0] = NAN) THEN 

RETURN (Convert SRC[31:0] to QNaN); FI 

M := imm8[7:4]; // Number of fraction bits of the normalized significand to be subtracted 

RC := imm8[1:0];// Round Control for ROUND() operation 

RC source := imm[2]; 

SPE := imm{[3];// Suppress Precision Exception 

TMP[31:0] := 2™ *{ROUND(2"*SRC[31:0], SPE, RC_source, RC)}; // ROUND() treats SRC and 2" as standard binary FP values 

TMP[3 1:0] := SRC[31:0] - TMP[31:0]; // subtraction under the same RC,SPE controls 
RETURN TMP[31:0]; // binary encoded FP with biased exponent and normalized significand 
} 


VREDUCEPS 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC *is memory”) 
THEN DEST[i+31:i] = ReduceArgumentSP(SRC[31:0], imm8[7:0)); 
ELSE DEST[i+31:i] := ReduceArgumentSP(SRC[i+31 :i], imm8[7:0)); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] = 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VREDUCEPS _ m512_mm512_mask_reduce_ps(__m512 a, int imm, int sae) 

VREDUCEPS _ m512 _mm512_mask_reduce_ps(__m512 s,__ mmask16 k,__m512 a, int imm, int sae) 
VREDUCEPS _ _m512 __mm512_maskz_reduce_ps(__mmask16 k,__m512 a, int imm, int sae) 
VREDUCEPS __m256 _mm256_mask_reduce_ps(_m256 a, int imm) 

VREDUCEPS __m256 _mm256_mask_reduce_ps(__m256 s,___ mmask8 k,__ m256 a, int imm) 
VREDUCEPS __m256 __mm256_maskz_reduce_ps(__mmask8 k,___m256 a, int imm) 

VREDUCEPS __m128 __mm_mask_reduce_ps(_m128 a, int imm) 

VREDUCEPS __m128 __mm_mask_reduce_ps(__m128s,___mmask8 k,__m128 a, int imm) 
VREDUCEPS __m128 __mm_maskz_reduce_ps(__mmask8 k,___m128 a, int imm) 


SIMD Floating-Point Exceptions 

Invalid, Precision 

If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 
Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”; additionally: 
#UD If EVEX.vvvv != 1111B. 
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VREDUCESS—Perform a Reduction Transformation on a Scalar Float32 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.LLIG.66.0F3A.WO 57 /r A VIN AVX512DQ_ | Performa reduction transformation on a scalar single-precision 
/ib floating point value in xmm3/m32 by subtracting a number of 
VREDUCESS xmm1 {k1}{Z}, fraction bits specified by the immé8 field. Also, upper single 
xmm2, xmm3/m32{sae}, precision floating-point values (bits[127:32]) from xmm2 are 
imm8 copied to xmm1[127:32]. Stores the result in xmm1 register. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Perform a reduction transformation of the binary encoded single-precision FP value in the low dword element of the 
second source operand (the third operand) and store the reduced result in binary FP format to the low dword 
element of the destination operand (the first operand) under the writemask k1. Bits 127:32 of the destination 
operand are copied from respective dword elements of the first source operand (the second operand). 

The reduction transformation subtracts the integer part and the leading M fractional bits from the binary FP source 
value, where M is a unsigned integer specified by imm8[7:4], see Figure 5-28. Specifically, the reduction transfor- 
mation can be expressed as: 

dest = src - (ROUND(2™*src))*2™; 

where “Round()” treats “src”, “2™”, and their product as binary FP numbers with normalized significand and bi- 
ased exponents. 

The magnitude of the reduced result can be expressed by considering src= 2?*manz2, 


where ‘man2’ is the normalized significand and ‘p’ is the unbiased exponent 
Then if RC = RNE: 0<=|Reduced Result|<=2?°™-1 
Then if RC # RNE: 0<=|Reduced Result|<2?"™ 


This instruction might end up with a precision exception set. However, in case of SPE set (i.e. Suppress Precision 
Exception, which is imm8[3]=1), no precision exception is reported. 


Handling of special case of input values are listed in Table 5-15. 


Operation 
ReduceArgumentSP(SRC[3 1:0], imm8[7:0]) 
{ 
// Check for NaN 
IF (SRC [31:0] = NAN) THEN 
RETURN (Convert SRC[31:0] to QNaN); FI 
M := imm8[7:4]; // Number of fraction bits of the normalized significand to be subtracted 
RC := imm8[1:0];// Round Control for ROUND() operation 
RC source := imm[2]; 
SPE := imm[3];// Suppress Precision Exception 
TMP[31:0] := 2™ *{ROUND(2"*SRC[31:0], SPE, RC_source, RC)}; // ROUND() treats SRC and 2" as standard binary FP values 
TMP[31:0] := SRC[31:0] - TMP[31:0]; // subtraction under the same RC,SPE controls 
RETURN TMP[31:0]; // binary encoded FP with biased exponent and normalized significand 
} 
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VREDUCESS 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := ReduceArgumentSP(SRC2[31:0], imm8[7:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] = 0 
Fl; 


Fl; 
DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VREDUCESS __m128 _mm_mask_reduce_ss(__m128 a,__m128 b, int imm, int sae) 


VREDUCESS __m128_mm_mask_reduce_ss(__m128s,__mmask16k,__m128 a, 
VREDUCESS __m128 _mm_maskz_reduce_ss(__mmask16 k,__m128 a, 


m128 b, int imm, int sae) 
m128 b, int imm, int sae) 


SIMD Floating-Point Exceptions 
Invalid, Precision 


If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VRNDSCALEPD—Round Packed Float64 Values To Include A Given Number Of Fraction Bits 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.W1 09 /r ib A VIV AVX512VL | Rounds packed double-precision floating point values in 
VRNDSCALEPD xmm1 {k1}{Z}, AVX512F xmm2/m128/m64bcst to a number of fraction bits 
xmme2/m128/m64bcst, imm8 specified by the immé® field. Stores the result in xmm1 
register. Under writemask. 
EVEX.256.66.0F3A.W1 09 /r ib A VIV AVX512VL | Rounds packed double-precision floating point values in 
VRNDSCALEPD ymm1 {k1}{z}, AVX512F ymm2/m256/m64bcst to a number of fraction bits 
ymm2/m256/m64bcst, imm8 specified by the immé® field. Stores the result in ymm1 
register. Under writemask. 
EVEX.512.66.0F3A.W1 09 /r ib A VIV AVX512F Rounds packed double-precision floating-point values in 
VRNDSCALEPD zmm1 {k1}{Z}, zmm2/m512/m64bcst to a number of fraction bits 
zmm2/m512/m64bcst{sae}, imm8 specified by the immé® field. Stores the result in zmm1 
register using writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8s NA 
Description 


Round the double-precision floating-point values in the source operand by the rounding mode specified in the 
immediate operand (see Figure 5-29) and places the result in the destination operand. 


The destination operand (the first operand) is a ZMM/YMM/XMM register conditionally updated according to the 
writemask. The source operand (the second operand) can be a ZMM/YMM/XMM register, a 512/256/128-bit 
memory location, or a 512/256/128-bit vector broadcasted from a 64-bit memory location. 


The rounding process rounds the input to an integral value, plus number bits of fraction that are specified by 
imm8[7:4] (to be included in the result) and returns the result as a double-precision floating-point value. 


It should be noticed that no overflow is induced while executing this instruction (although the source is scaled by 
the imm8[7:4] value). 


The immediate operand also specifies control fields for the rounding operation, three bit fields are defined and 
shown in the “Immediate Control Description” figure below. Bit 3 of the immediate byte controls the processor 
behavior for a precision exception, bit 2 selects the source of rounding mode control. Bits 1:0 specify a non-sticky 
rounding-mode value (Immediate control table below lists the encoded values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


The sign of the result of this instruction is preserved, including the sign of zero. 
The formula of the operation on each data element for VRNDSCALEPD is 
ROUND(x) = 2™*Round_to_INT(x*2™, round_ctrl), 
round_ctrl = imm[3:0]; 
M=imm[7:4]; 
The operation of x*2™ is computed as if the exponent range is unlimited (i.e. no overflow ever occurs). 
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VRNDSCALEPD is a more general form of the VEX-encoded VROUNDPD instruction. In VROUNDPD, the formula of 
the operation on each element is 


ROUND(x) = Round_to_INT(x, round_ctrl), 
round_ctrl = imm[3:0]; 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


7 6 5 4 3 2 1 0 


imm8 Fixed point length SPE RS Round Control Override 


Suppress Precision Exception: Imm8[3] Immef1 0] = 00b : Round nearest even 


Imm8[7:4] : Number of fixed points to preserve Imm8[3] = Ob : Use MXCSR exception mask —_ Round Select: Imm8[2] Imm8[1:0] = 01b : Round down 
Imm8[3] = 1b : Suppress Imm8[2] = Ob : Use Imm8[1:0] Imm8[1:0] = 10b : Round up 
imme[2)=:1bs Use MACSR Imm8[1:0] = 11b: Truncate 


Figure 5-29. Imm8 Controls for VRNDSCALEPD/SD/PS/SS 


Handling of special case of input values are listed in Table 5-16. 


Table 5-16. VRNDSCALEPD/SD/PS/SS Special Cases 


Returned value 
Src1=+inf Src 
Src1=+NAN Src1 converted to QNAN 
Src1=+0 Src 
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Operation 


RoundTolntegerDP(SRC[63:0], imm8[7:0)) { 
if (imm8[2] = 1) 


rounding_direction := MXCSR:RC ; get round control from MXCSR 
else 

rounding_direction := imm8[1:0] ; get round control from imm8[1:0] 
Fl 
M := imm8[7:4] ; get the scaling factor 


case (rounding_direction) 

00: TMP[63:0] := round_to_nearest_even integer(2*SRC[63:0]) 
01: TMP[63:0] := round_to_equal_or_smaller. integer(2™*SRC[63:0]) 
10: TMP[63:0] := round_to_equal_or_larger. integer(2"*SRC[63:0]) 


11: TMP[63:0] := round_to_nearest_smallest. magnitude_integer(2™*SRC[63:0]) 


ESAC 
Dest[63:0] := 2""* TMP[63:0] : scale down back to 2™ 


if (imm8[3] = 0) Then ; check SPE 
if (SRC[63:0] != Dest[63:0]) Then ; check precision lost 
set_precision() ; set #PE 
Fl; 
Fl; 
return(Dest[63:0]) 
} 


VRNDSCALEPD (EVEX encoded versions) 

(KL, VL) = (2, 128), (4, 256), (8, 512) 

IF *src is a memory operand* 
THEN TMP_SRC := BROADCAST64(SRC, VL, k1) 
ELSE TMP_SRC := SRC 

Fl; 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = RoundTolntegerDP((TMP_SRC[i+63:i], imm8[7:0]) 
ELSE 


IF *merging-masking* ; mMerging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VRNDSCALEPD 


m512d 


mm512_roundscale_pd(__m512d a, int imm); 


VRNDSCALEPD 


m512d 


mm512_roundscale_round_pd(__m512d a, int imm, int sae); 


VRNDSCALEPD 


m512d 


mm512_mask_roundscale_pd(__m512ds,__mmask8 k,__m512d a, int imm); 


VRNDSCALEPD 


m512d 


VRNDSCALEPD 


m512d 


mm512_mask_roundscale_round_pd(__m512ds,__mmask8 k,__m512d a, int imm, int sae); 
mm512_maskz_roundscale_pd(__mmask8 k,___m512d a, int imm); 


VRNDSCALEPD 


m512d 


mm512_maskz_roundscale_round_pd(__mmask8 k,___m512d a, int imm, int sae); 


VRNDSCALEPD 


m256d 


mm256_roundscale_pd(__m256d a, int imm); 


VRNDSCALEPD 


m256d 


mm256_mask_roundscale_pd(__m256d s,__ mmask8 k,__ m256d a, int imm); 


VRNDSCALEPD 


m256d 


mm256_maskz_roundscale_pd(__mmask8 k, __ m256d a, int imm); 


VRNDSCALEPD __ 


m128d 


mm_roundscale_pd(__m128d a, int imm); 


VRNDSCALEPD __m128d _mm_mask_roundscale_pd(__m128d s,___ mmask8 k,___m128d a, int imm); 
VRNDSCALEPD __m128d _mm_maskz_roundscale_pd(__mmask8 k, __m128d a, int imm); 


SIMD Floating-Point Exceptions 


Invalid, Precision 


If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”. 
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VRNDSCALESD—Round Scalar Float64 Value To Include A Given Number Of Fraction Bits 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
EVEX.LLIG.66.0F3A.W1 OB /r ib A VV AVX512F | Rounds scalar double-precision floating-point value in 
VRNDSCALESD xmm1 {k1}{z}, xmm2, xmm3/m64 to a number of fraction bits specified by the 
xmm3/m64{sae}, imm8 immé field. Stores the result in xmm1 register. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) Imm8s 
Description 


Rounds a double-precision floating-point value in the low quadword (see Figure 5-29) element of the second 
source operand (the third operand) by the rounding mode specified in the immediate operand and places the result 
in the corresponding element of the destination operand (the first operand) according to the writemask. The quad- 
word element at bits 127:64 of the destination is copied from the first source operand (the second operand). 


The destination and first source operands are XMM registers, the 2nd source operand can be an XMM register or 
memory location. Bits MAXVL-1:128 of the destination register are cleared. 


The rounding process rounds the input to an integral value, plus number bits of fraction that are specified by 
imm8[7:4] (to be included in the result) and returns the result as a double-precision floating-point value. 


It should be noticed that no overflow is induced while executing this instruction (although the source is scaled by 
the imm8[7:4] value). 


The immediate operand also specifies control fields for the rounding operation, three bit fields are defined and 
shown in the “Immediate Control Description” figure below. Bit 3 of the immediate byte controls the processor 
behavior for a precision exception, bit 2 selects the source of rounding mode control. Bits 1:0 specify a non-sticky 
rounding-mode value (Immediate control table below lists the encoded values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


The sign of the result of this instruction is preserved, including the sign of zero. 


The formula of the operation for VRNDSCALESD is 
ROUND(x) = 2™*Round_to_INT(x*2™, round_ctrl), 
round_ctrl = imm[3:0]; 
M=imm[7:4]; 
The operation of x*2™ is computed as if the exponent range is unlimited (i.e. no overflow ever occurs). 


VRNDSCALESD is a more general form of the VEX-encoded VROUNDSD instruction. In VROUNDSD, the formula of 
the operation is 


ROUND(x) = Round_to_INT(x, round_ctrl), 
round_ctrl = imm[3:0]; 


EVEX encoded version: The source operand is a XMM register or a 64-bit memory location. The destination operand 


is a XMM register. 
Handling of special case of input values are listed in Table 5-16. 
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Operation 


RoundTolntegerDP(SRC[63:0], imm8[7:0)) { 
if (imm8[2] = 1) 


rounding_direction := MXCSR:RC ; get round control from MXCSR 
else 

rounding_direction := imm8[1:0] ; get round control from imm8[1:0] 
Fl 
M := imm8[7:4] ; get the scaling factor 


case (rounding_direction) 

00: TMP[63:0] := round_to_nearest_even integer(2*SRC[63:0]) 

01: TMP[63:0] := round_to_equal_or_smaller. integer(2"*SRC[63:0]) 

10: TMP[63:0] := round_to_equal_or_larger. integer(2*SRC[63:0]) 

11: TMP[63:0] := round_to_nearest_smallest magnitude_integer(2™*SRC[63:0]) 
ESAC 


Dest[63:0] := 2""* TMP[63:0] : scale down back to 2™ 


if (imm8[3] = 0) Then; check SPE 
if (SRC[63:0] != Dest[63:0]) Then ; check precision lost 
set_precision() ; set #PE 
Fl; 
Fl; 
return(Dest[63:0]) 
} 


VRNDSCALESD (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN  DEST[63:0] := RoundTolntegerDP(SRC2[63:0], Zero_upper_imm[7:0]) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRNDSCALESD __m128d_mm_roundscale_sd (__m128d a,__m128d b, int imm); 

VRNDSCALESD __m128d _mm_roundscale_round_sd (__m128d a,__m128d, int imm, int sae); 

VRNDSCALESD __m128d __mm_mask_roundscale_sd (__m128d s,___ mmask8 k,__m128d a,_m128d b, int imm); 
VRNDSCALESD __m128d __mm_mask_roundscale_round_sd (__m128ds,__ mmask8 k,__m128da,__m128d b, int imm, int sae); 
VRNDSCALESD __m128d _mm_maskz_roundscale_sd (__mmask8 k,__m128da,__m128d, int imm); 

VRNDSCALESD __m128d __mm_maskz_roundscale_round_sd (__mmask8 k,__m128d a,_m128d b, int imm, int sae); 


SIMD Floating-Point Exceptions 
Invalid, Precision 


If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VRNDSCALEPS—Round Packed Float32 Values To Include A Given Number Of Fraction Bits 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F3A.WO 08 /r ib A VIV AVX512VL | Rounds packed single-precision floating point values in 
VRNDSCALEPS xmm1 {k1}{Z}, AVX512F xmm2/m128/m32bcst to a number of fraction bits 
xmme2/m128/m32bcst, imm8 specified by the immé8 field. Stores the result in xmm1 
register. Under writemask. 
EVEX.256.66.0F3A.WO 08 /r ib A VIV AVX512VL | Rounds packed single-precision floating point values in 
VRNDSCALEPS ymm1 {k1}{Z}, AVX512F ymm2/m256/m32bcst to a number of fraction bits 
ymm2/m256/m32bcst, imm8 specified by the immé& field. Stores the result in ymm1 
register. Under writemask. 
EVEX.512.66.0F3A.WO 08 /r ib A VIV AVX512F Rounds packed single-precision floating-point values in 
VRNDSCALEPS zmm1 {k1}{z}, zmm2/m512/m32bcst to a number of fraction bits 
zmm2/m512/m32bcst{sae}, imm8 specified by the immé® field. Stores the result in zmm1 
register using writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) Imm8 NA 
Description 


Round the single-precision floating-point values in the source operand by the rounding mode specified in the 
immediate operand (see Figure 5-29) and places the result in the destination operand. 


The destination operand (the first operand) is a ZMM register conditionally updated according to the writemask. 
The source operand (the second operand) can be a ZMM register, a 512-bit memory location, or a 512-bit vector 
broadcasted from a 32-bit memory location. 


The rounding process rounds the input to an integral value, plus number bits of fraction that are specified by 
imm8[7:4] (to be included in the result) and returns the result as a single-precision floating-point value. 


It should be noticed that no overflow is induced while executing this instruction (although the source is scaled by 
the imm8[7:4] value). 


The immediate operand also specifies control fields for the rounding operation, three bit fields are defined and 
shown in the “Immediate Control Description” figure below. Bit 3 of the immediate byte controls the processor 
behavior for a precision exception, bit 2 selects the source of rounding mode control. Bits 1:0 specify a non-sticky 
rounding-mode value (Immediate control table below lists the encoded values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


The sign of the result of this instruction is preserved, including the sign of zero. 


The formula of the operation on each data element for VRNDSCALEPS is 
ROUND(x) = 2™*Round_to_INT(x*2™, round_ctrl), 
round_ctrl = imm[3:0]; 
M=imm[7:4]; 
The operation of x*2™ is computed as if the exponent range is unlimited (i.e. no overflow ever occurs). 


VRNDSCALEPS is a more general form of the VEX-encoded VROUNDPS instruction. In VROUNDPS, the formula of 
the operation on each element is 


ROUND(x) = Round_to_INT(x, round_ctrl), 
round_ctrl = imm[3:0]; 


VRNDSCALEPS—Round Packed Float32 Values To Include A Given Number Of Fraction Bits Vol.2C 5-551 


INSTRUCTION SET REFERENCE, V-Z 


Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


Handling of special case of input values are listed in Table 5-16. 


Operation 


RoundTolntegerSP(SRC[3 1:0], imm8[7:0]) { 
if (imm8[2] = 1) 


rounding_direction := MXCSR:RC ; get round control from MXCSR 
else 

rounding_direction := imm8[1:0] ; get round control from imm8[1:0] 
Fl 
M := imm8[7:4] ; get the scaling factor 


case (rounding_direction) 

00: TMP[31:0] := round_to_nearest_even integer(2*SRC[31:0]) 
01: TMP[31:0] := round_to_equal_or_smaller integer(2™*SRC[31:0]) 
10: TMP[31:0] := round_to_equal_or_larger. integer(2*SRC[31:0]) 
11: TMP[31:0] := round_to_nearest_smallest magnitude_integer(2™*SRC[31:0]) 
ESAC; 


Dest[31:0] := 2"* TMP[31:0] : scale down back to 2™ 
if (imm8[3] = 0) Then ; check SPE 
if (SRC[31:0] != Dest[31:0]) Then ; check precision lost 
set_precision() ; set #PE 
Fl; 
Fl; 
return(Dest[3 1:0]) 
} 


VRNDSCALEPS (EVEX encoded versions) 

(KL, VL) = (4, 128), (8, 256), (16, 512) 

IF *src is a memory operand* 
THEN TMP_SRC := BROADCAST32(SRC, VL, k1) 
ELSE TMP_SRC := SRC 

Fl; 


FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] := RoundTolntegerSP(TMP_SRC[i+31:i]), imm8[7:0]) 
ELSE 


IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VRNDSCALEPS __m512_mm512_roundscale_ps(__m512 a, int imm); 
VRNDSCALEPS __m512_mm512_roundscale_round_ps(__m512 a, int imm, int sae); 


VRNDSCALEPS __m512_mm512_mask_roundscale_ps(__m512 s,__ mmask16 k,__m512 a, int imm); 
m512 a, int imm, int sae); 


VRNDSCALEPS __m512_mm512_mask_roundscale_round_ps(__m512 s,__mmask16 k, 
VRNDSCALEPS __m512_mm512_maskz_roundscale_ps(__mmask16 k,__m512 a, int imm); 
VRNDSCALEPS __m512_mm512_maskz_roundscale_round_ps(__mmask16 k, 
VRNDSCALEPS __m256 __mm256_roundscale_ps(__m256 a, int imm); 
VRNDSCALEPS __m256 __mm256_mask_roundscale_ps(__m256 s,__ mmask8 k,___m256 a, int imm); 
VRNDSCALEPS __m256 _mm256_maskz_roundscale_ps(__mmask8 k, __m256 a, int imm); 
VRNDSCALEPS __m128_mm_roundscale_ps(_m256 a, int imm); 

VRNDSCALEPS __m128_mm_mask_roundscale_ps(__m128s, __ mmask8 k,__m128 a, int imm); 
VRNDSCALEPS __m128_mm_maskz_roundscale_ps(__mmask8 k,___m128 a, int imm); 


SIMD Floating-Point Exceptions 


Invalid, Precision 


If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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m512 a, int imm, int sae); 
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VRNDSCALESS—Round Scalar Float32 Value To Include A Given Number Of Fraction Bits 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.WO OA /r ib A VIV AVX512F | Rounds scalar single-precision floating-point value in 
VRNDSCALESS xmm1 {k1}{z}, xmm2, xmm3/m32 to a number of fraction bits specified by the 
xmm3/m32{sae}, imm8 imm8 field. Stores the result in xmm1 register under 
writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Rounds the single-precision floating-point value in the low doubleword element of the second source operand (the 
third operand) by the rounding mode specified in the immediate operand (see Figure 5-29) and places the result in 
the corresponding element of the destination operand (the first operand) according to the writemask. The double- 
word elements at bits 127:32 of the destination are copied from the first source operand (the second operand). 


The destination and first source operands are XMM registers, the 2nd source operand can be an XMM register or 
memory location. Bits MAXVL-1:128 of the destination register are cleared. 


The rounding process rounds the input to an integral value, plus number bits of fraction that are specified by 
imm8[7:4] (to be included in the result) and returns the result as a single-precision floating-point value. 


It should be noticed that no overflow is induced while executing this instruction (although the source is scaled by 
the imm8[7:4] value). 


The immediate operand also specifies control fields for the rounding operation, three bit fields are defined and 
shown in the “Immediate Control Description” figure below. Bit 3 of the immediate byte controls the processor 
behavior for a precision exception, bit 2 selects the source of rounding mode control. Bits 1:0 specify a non-sticky 
rounding-mode value (Immediate control tables below lists the encoded values for rounding-mode field). 


The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an 
SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before 
rounding. 


The sign of the result of this instruction is preserved, including the sign of zero. 


The formula of the operation for VRNDSCALESS is 
ROUND(x) = 2™*Round_to_INT(x*2™, round_ctrl), 
round_ctrl = imm[3:0]; 
M=imm[7:4]; 
The operation of x*2™ is computed as if the exponent range is unlimited (i.e. no overflow ever occurs). 


VRNDSCALESS is a more general form of the VEX-encoded VROUNDSS instruction. In VROUNDSS, the formula of 
the operation on each element is 


ROUND(x) = Round_to_INT(x, round_ctrl), 
round_ctrl = imm[3:0]; 


EVEX encoded version: The source operand is a XMM register or a 32-bit memory location. The destination operand 
is a XMM register. 


Handling of special case of input values are listed in Table 5-16. 
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Operation 


RoundTolntegerSP(SRC[3 1:0], imm8[7:0]) { 
if (imm8[2] = 1) 


rounding_direction := MXCSR:RC ; get round control from MXCSR 
else 

rounding_direction := imm8[1:0] ; get round control from imm8[1:0] 
Fl 
M := imm8[7:4] ; get the scaling factor 


case (rounding_direction) 

00: TMP[31:0] := round_to_nearest_even integer(2*SRC[31:0]) 

01: TMP[31:0] := round_to_equal_or_smaller. integer(2™*SRC[31:0]) 

10: TMP[31:0] := round_to_equal_or_larger. integer(2"*SRC[31:0]) 

11: TMP[31:0] := round_to_nearest_smallest. magnitude_integer(2™*SRC[31:0]) 
ESAC; 


Dest[31:0] := 2"* TMP[31:0] : scale down back to 2™ 
if (imm8[3] = 0) Then ; check SPE 
if (SRC[31:0] != Dest[31:0]) Then ; check precision lost 
set_precision() ; set #PE 
Fl; 
Fl; 
return(Dest[31:0]) 
} 


VRNDSCALESS (EVEX encoded version) 
IF k1[0] or *no writemask* 
THEN = DEST[31:0] := RoundTolntegerSP(SRC2[31:0], Zero_upper_imm[7:0]) 


ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRNDSCALESS __m128 _mm_roundscale_ss (__m128 a,__m128b, int imm); 

VRNDSCALESS __m128 _mm_roundscale_round_ss (__m128 a,__m128, int imm, int sae); 

VRNDSCALESS __m128 __mm_mask_roundscale_ss (__m128s,__ mmask8 k,___m128 a,__m128, int imm); 
VRNDSCALESS __m128 _mm_mask_roundscale_round_ss (__m128 s,__mmask8 k,__m128 a,__m128 b, int imm, int sae); 
VRNDSCALESS __m128 _mm_maskz_roundscale_ss (__mmask8 k,__m128 a,__m128 b, int imm); 

VRNDSCALESS __m128 _mm_maskz_roundscale_round_ss (__mmask8 k,__m128 a,__m128 b, int imm, int sae); 


SIMD Floating-Point Exceptions 
Invalid, Precision 
If SPE is enabled, precision exception is not reported (regardless of MXCSR exception mask). 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VRSQRT14PD—Compute Approximate Reciprocals of Square Roots of Packed Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.128.66.0F38.W1 4€ /r A VIV AVX512VL | Computes the approximate reciprocal square roots of the 
VRSQRT14PD xmm1 {k1}{2Z}, AVX512F packed double-precision floating-point values in 
xmm2/m128/m64bcst xmm2/m128/m64bcst and stores the results in xmm1. 
Under writemask. 
EVEX.256.66.0F38.W1 4€ /r A VV AVX512VL | Computes the approximate reciprocal square roots of the 
VRSQRT14PD ymm1 {k1}{2}, AVX512F packed double-precision floating-point values in 
ymm2/m256/m64bcst ymm2/m256/m64bcst and stores the results in ymm1. 
Under writemask. 
EVEX.512.66.0F38.W1 4€ /r A VIV AVX512F Computes the approximate reciprocal square roots of the 
VRSQRT14PD zmm1 {k1}{Z}, packed double-precision floating-point values in 
zmm2/m512/m64bcst zmm2/m512/m64bcst and stores the results in zmm1 
under writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocals of the square roots of the eight 
packed double-precision floating-point values in the source operand (the second operand) and stores the packed 
double-precision floating-point results in the destination operand (the first operand) according to the writemask. 
The maximum relative error for this approximation is less than 2714, 


EVEX.512 encoded version: The source operand can be a ZMM register, a 512-bit memory location, or a 512-bit 
vector broadcasted from a 64-bit memory location. The destination operand is a ZMM register, conditionally 
updated using writemask k1. 


EVEX.256 encoded version: The source operand is a YMM register, a 256-bit memory location, or a 256-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a YMM register, conditionally updated using 
writemask k1. 


EVEX.128 encoded version: The source operand is a XMM register, a 128-bit memory location, or a 128-bit vector 
broadcasted from a 64-bit memory location. The destination operand is a XMM register, conditionally updated using 
writemask k1. 


The VRSQRT14PD instruction is not affected by the rounding control bits in the MXCSR register. When a source 
value is a 0.0, an ~ with the sign of the source value is returned. When the source operand is an + then +ZERO 
value is returned. A denormal source value is treated as zero only if DAZ bit is set in MXCSR. Otherwise it is treated 
correctly and performs the approximation with the specified masked response. When a source value is a negative 
value (other than 0.0) a floating-point QNaN_indefinite is returned. When a source value is an SNaN or QNaN, the 
SNaN is converted to a QNaN or the source QNaN is returned. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 
Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


A numerically exact implementation of VRSQRT14xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 
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Operation 


VRSQRT14PD (EVEX encoded versions) 


(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 

i:=j* 64 

IF k1[j] OR *no writemask* THEN 


IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+63:i] = APPROXIMATE(1.0/ SORT(SRC[63:0])); 
ELSE DEST[i+63:i] = APPROXIMATE(1.0/ SORT(SRC[i+63:i])); 


Fl; 
ELSE 
IF *merging-masking* 


; merging-masking 


THEN *DEST{[i+63:i] remains unchanged* 


ELSE 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


; zeroing-masking 


Table 5-17. VRSQRT14PD Special Cases 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


Input value Result value Comments 

Any denormal Normal Cannot generate overflow 
X= 2-en Qn 

X<0 QNaN_Indefinite | Including -INF 

X=-0 -INF 

X=+0 +INF 

X = +INF +0 


VRSQRT14PD __m512d_mm512_rsqrt14_pd(__m512d a); 

VRSQRT14PD __m512d __mm512_mask_rsqrt14_pd(__m512ds,___mmask8 k,__m512d a); 
VRSQRT14PD __m512d __mm512_maskz_rsqrt14_pd(___mmask8 k, __m512d a); 
VRSQRT14PD __m256d __mm256_rsqrt14_pd(__m256d a); 

VRSQRT14PD __m256d _mm512_mask_rsqrt14_pd(__m256d s, __ mmask8 k, __m256d a); 
VRSQRT14PD __m256d _mm512_maskz_rsqrt14_pd(___mmask8 k, __m256d a); 
VRSQRT14PD __m128d _mm_rsqrt14_pd(__m128d a); 

VRSQRT14PD __m128d _mm_mask_rsqrt14_pd(__m128d s, __mmask8 k, __m128d a); 
VRSQRT14PD __m128d _mm_maskz_rsqrt14_pd(__mmask8 k, __m128d a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Table 2-49, “Type E4 Class Exception Conditions”. 
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Vol.2C 5-557 


INSTRUCTION SET REFERENCE, V-Z 


VRSQRT14SD—Compute Approximate Reciprocal of Square Root of Scalar Float64 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.W1 4F /r A VIV AVX512F | Computes the approximate reciprocal square root of the 
VRSQRT14SD xmm1 {k1}{z}, scalar double-precision floating-point value in xmm3/m64 
xmm2, xmm3/m64 and stores the result in the low quadword element of xmm1 
using writemask k1. Bits[127:64] of xmmz is copied to 
xmm1[127:64]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the approximate reciprocal of the square roots of the scalar double-precision floating-point value in the 
low quadword element of the source operand (the second operand) and stores the result in the low quadword 
element of the destination operand (the first operand) according to the writemask. The maximum relative error for 
this approximation is less than 2°!4. The source operand can be an XMM register or a 32-bit memory location. The 
destination operand is an XMM register. 


Bits (127:64) of the XMM register destination are copied from corresponding bits in the first source operand. Bits 
(MAXVL-1:128) of the destination register are zeroed. 


The VRSQRT14SD instruction is not affected by the rounding control bits in the MXCSR register. When a source 
value is a 0.0, an - with the sign of the source value is returned. When the source operand is an + then +ZERO 
value is returned. A denormal source value is treated as zero only if DAZ bit is set in MXCSR. Otherwise it is treated 
correctly and performs the approximation with the specified masked response. When a source value is a negative 
value (other than 0.0) a floating-point QNaN_indefinite is returned. When a source value is an SNaN or QNaN, the 
SNaN is converted to a QNaN or the source QNaN is returned. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 
A nee tically € exact IPI Smien talon of pie cet ener can a found at hetps: Lisoftware, intel. com/en- usfartie 
| | t : 


Operation 
VRSQRT14SD (EVEX version) 
IF k1[0] or *no writemask* 
THEN DEST[63:0] := APPROXIMATE(1.0/ SQRT(SRC2[63:0])) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[63:0] := 0 
Fl; 


Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 
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INSTRUCTION SET REFERENCE, V-Z 


Table 5-18. VRSQRT14SD Special Cases 


Input value Result value Comments 

Any denormal Normal Cannot generate overflow 
X= 2-en 2n 

xX<0 QNaN_Indefinite | Including -INF 

X=-0 -INF 

X=+0 +INF 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 

VRSQRT14SD __m128d_mm_rsqrt14_sd(_m128d a, __m128d b); 

VRSQRT14SD __m128d _mm_mask_rsqrt14_sd(__m128d s, __ mmask8 k,___m128d a, __m128d b); 
VRSQRT14SD __m128d __mm_maskz_rsqrt14_sd(__mmask8d m, __m128d a, ___m128d b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-51, “Type E5 Class Exception Conditions”. 


VRSQRT14SD—Compute Approximate Reciprocal of Square Root of Scalar Float64 Value 


Vol. 2C 5-559 


INSTRUCTION SET REFERENCE, V-Z 


VRSQRT14PS—Compute Approximate Reciprocals of Square Roots of Packed Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.128.66.0F38.W0O 4€ /r A VV AVX512VL_ | Computes the approximate reciprocal square roots of the 
VRSQRT14PS xmm1 {k1}{Z}, AVX512F packed single-precision floating-point values in 
xmm2/m128/m32bcst xmm2/m128/m32bcst and stores the results in xmm1. 
Under writemask. 
EVEX.256.66.0F38.W0O 4€ /r A VIV AVX512VL_ | Computes the approximate reciprocal square roots of the 
VRSQRT14PS ymm1 {k1}{2Z}, AVX512F packed single-precision floating-point values in 
ymm2/m256/m32bcst ymm2/m256/m32bcst and stores the results in ymm1. 
Under writemask. 
EVEX.512.66.0F38.W0 4€ /r A VV AVX512F Computes the approximate reciprocal square roots of the 
VRSQRT14PS zmm1 {k1}{Z}, packed single-precision floating-point values in 
zmm2/m512/m32bcst zmm2/m512/m32bcst and stores the results in zmm1. Under 
writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


This instruction performs a SIMD computation of the approximate reciprocals of the square roots of 16 packed 
single-precision floating-point values in the source operand (the second operand) and stores the packed single- 
precision floating-point results in the destination operand (the first operand) according to the writemask. The 
maximum relative error for this approximation is less than 2744. 


EVEX.512 encoded version: The source operand can be a ZMM register, a 512-bit memory location or a 512-bit 
vector broadcasted from a 32-bit memory location. The destination operand is a ZMM register, conditionally 
updated using writemask k1. 


EVEX.256 encoded version: The source operand is a YMM register, a 256-bit memory location, or a 256-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a YMM register, conditionally updated using 
writemask k1. 


EVEX.128 encoded version: The source operand is a XMM register, a 128-bit memory location, or a 128-bit vector 
broadcasted from a 32-bit memory location. The destination operand is a XMM register, conditionally updated using 
writemask k1. 


The VRSQRT14PS instruction is not affected by the rounding control bits in the MXCSR register. When a source 
value is a 0.0, an ~ with the sign of the source value is returned. When the source operand is an +o then +ZERO 
value is returned. A denormal source value is treated as zero only if DAZ bit is set in MXCSR. Otherwise it is treated 
correctly and performs the approximation with the specified masked response. When a source value is a negative 
value (other than 0.0) a floating-point QNaN_indefinite is returned. When a source value is an SNaN or QNaN, the 
SNaN is converted to a QNaN or the source QNaN is returned. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 
Note: EVEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 


A numerically exact implementation of VRSQRT14xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 
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Operation 


VRSQRT14PS (EVEX encoded versions) 


(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 

i:=j* 32 

IF k1[j] OR *no writemask* THEN 


IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+31:i] = APPROXIMATE(1.0/ SORT(SRC[31:0])); 
ELSE DEST[i+31:i] = APPROXIMATE(1.0/ SORT(SRC[i+3 1 :i])) 


Fl; 
ELSE 
IF *merging-masking* 


; merging-masking 


THEN *DEST{[i+31:i] remains unchanged* 


ELSE 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 
DEST[MAXVL-1:VL] := 0 


; zeroing-masking 


Table 5-19. VRSQRT14PS Special Cases 


INSTRUCTION SET REFERENCE, V-Z 


Input value Result value Comments 
Any denormal Normal Cannot generate overflow 
X=2en a 
xX<0 QNaN_Indefinite | Including -INF 
X=-0 -INF 
X=+0 +INF 
X = +INF +0 
Intel C/C++ Compiler Intrinsic Equivalent 
VRSQRT14PS __m512 _mm512_rsqrt14_ps(_m512 a); 


VRSQRT14PS __m512 _mm512_mask_rsqrt14_ps(__m512s, 


mmask16 k,__m512 a); 


mmask16 k, 


VRSQRT14PS __m512 _mm512_maskz_rsqrt14_ps( 
VRSQRT14PS __m256 _mm256_rsqrt14_ps( 


m512 a); 
m256 a); 


VRSQRT14PS __m256 _mm256_mask_rsqrt14_ps(__m256 s, 


mmask8 k,___m256 a); 


VRSQRT14PS __m256 __mm256_maskz_rsqrt14_ps( 


mmask8 k, __m256 a); 


VRSQRT14PS __m128 _mm_rsqrt14_ps( 


m128 a); 


VRSQRT14PS __m128 _mm_mask_rsqrt14_ps(__m128 s,___mmask8 k, __m128 a); 


VRSQRT14PS __m128 _mm_maskz_rsqrt14_ps( 


mmask8 k,___m128 a); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 


See Table 2-21, “Type 4 Class Exception Conditions”. 
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Vol.2C 5-561 


INSTRUCTION SET REFERENCE, V-Z 


VRSQRT14SS—Compute Approximate Reciprocal of Square Root of Scalar Float32 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.WO 4F /r A VIV AVX512F | Computes the approximate reciprocal square root of the 
VRSQRT14SS xmm1 {k1}{z}, scalar single-precision floating-point value in xmm3/m32 
xmm2, xmm3/m32 and stores the result in the low doubleword element of 
xmm1 using writemask k1. Bits[127:32] of xmmz is copied 
to xmm1[127:32]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes of the approximate reciprocal of the square root of the scalar single-precision floating-point value in the 
low doubleword element of the source operand (the second operand) and stores the result in the low doubleword 
element of the destination operand (the first operand) according to the writemask. The maximum relative error for 
this approximation is less than 2°!4. The source operand can be an XMM register or a 32-bit memory location. The 
destination operand is an XMM register. 


Bits (127:32) of the XMM register destination are copied from corresponding bits in the first source operand. Bits 
(MAXVL-1:128) of the destination register are zeroed. 


The VRSQRT14SS instruction is not affected by the rounding control bits in the MXCSR register. When a source 
value is a 0.0, an - with the sign of the source value is returned. When the source operand is an ~, zero with the 
sign of the source value is returned. A denormal source value is treated as zero only if DAZ bit is set in MXCSR. 
Otherwise it is treated correctly and performs the approximation with the specified masked response. When a 
source value is a negative value (other than 0.0) a floating-point indefinite is returned. When a source value is an 
SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN is returned. 


MXCSR exception flags are not affected by this instruction and floating-point exceptions are not reported. 
A aeime tically € exact IPI Sn entation of pee emery can i found at hetps: Lisoftware. intel. com/en- usfartie 
| | t : 


Operation 


VRSQRT14SS (EVEX version) 
IF k1[0] or *no writemask* 
THEN DEST[31:0] := APPROXIMATE(1.0/ SQRT(SRC2[31:0])) 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
THEN DEST[31:0] := 0 
Fl; 


Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 
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Table 5-20. VRSQRT14SS Special Cases 


INSTRUCTION SET REFERENCE, V-Z 


Input value Result value Comments 

Any denormal Normal Cannot generate overflow 
X= 2-en 2n 

xX<0 QNaN_Indefinite | Including -INF 

X=-0 -INF 

X=+0 +INF 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 

VRSQRT14SS __m128 _mm_rsqrt14_ss(__m128 a, ___m128 b); 
VRSQRT14SS __m128 _mm_mask_rsqrt14_ss(__m128 s, __mmask8 k, 
VRSQRT14SS __m128 _mm_maskz_rsqrt14_ss(__mmask8 k,__m128 a, 


m128 a, 
m128 b); 


m128 b); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-51, “Type E5 Class Exception Conditions”. 


VRSQRT14SS—Compute Approximate Reciprocal of Square Root of Scalar Float32 Value 


Vol. 2C 5-563 


INSTRUCTION SET REFERENCE, V-Z 


VSCALEFPD—Scale Packed Float64 Values With Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.W1 2C /r A VIV AVX512VL | Scale the packed double-precision floating-point values in 
VSCALEFPD xmm1 {k1}{z}, xmm2, AVX512F xmmcz using values from xmm3/m128/m64bcst. Under 
xmm3/m128/m64bcst writemask k1. 
EVEX.256.66.0F38.W1 2C /r A VIV AVX512VL | Scale the packed double-precision floating-point values in 
VSCALEFPD ymm1 {k1}{z}, ymm2, AVX512F ymmcz using values from ymm3/m256/m64bcst. Under 
ymm3/m256/m64bcst writemask k1. 
EVEX.512.66.0F38.W1 2C /r A VIV AVX512F Scale the packed double-precision floating-point values in 
VSCALEFPD zmm1 {k1}{z}, zmm2, zmm_2 using values from zmm3/m512/m64bcst. Under 
zmm3/m512/m64bcst{er} writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a floating-point scale of the packed double-precision floating-point values in the first source operand by 
multiplying it by 2 power of the double-precision floating-point values in second source operand. 


The equation of this operation is given by: 
zmm1 := zmm2*2"loor(zmm3)_ 
Floor(zmm3) means maximum integer value < zmm3. 


If the result cannot be represented in double precision, then the proper overflow response (for positive scaling 
operand), or the proper underflow response (for negative scaling operand) is issued. The overflow and underflow 
responses are dependent on the rounding mode (for IEEE-compliant rounding), as well as on other settings in 
MXCSR (exception mask bits, FTZ bit), and on the SAE bit. 


The first source operand is a ZMM/YMM/XMM register. The second source operand is a ZMM/YMM/XMM register, a 
512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a 64-bit memory location. The 
destination operand is a ZMM/YMM/XMM register conditionally updated with writemask k1. 


Handling of special-case input values are listed in Table 5-21 and Table 5-22. 


Table 5-21. VSCALEFPD/SD/PS/SS Special Cases 


Srce2 Set IE 
+NaN +inf -Inf 0/Denorm/Norm 
Src1_ | +QNaN QNaN(Src1) +INF +0 QNaN(Src1) IF either source is SNAN 
+SNaN QNaN(Src1) QNaN(Src1) QNaN(Src1) QNaN(Src1) YES 
+Inf QNaN(Src2) Src QNaN_Indefinite | Src1 IF Src2 is SNAN or -INF 
+0 QNaN(Src2) QNaN_Indefinite | Src1 Src IF Src2 is SNAN or +INF 
Denorm/Norm | QNaN(Src2) +INF (Src1 sign) +0 (Src sign) Compute Result IF Src2 is SNAN 
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Table 5-22. Additional VSCALEFPD/SD Special Cases 


INSTRUCTION SET REFERENCE, V-Z 


Special Case Returned value Faults 
|result| < 271074 +0 or +Min-Denormal (Src1 sign) Underflow 
result] > 21024 +INF (Src1 sign) or +Max-normal (Src1 sign) Overflow 
Operation 
SCALE(SRC1, SRC2) 


{ 

TMP_SRC2 := SRC2 

TMP_SRC1 := SRC1 

IF (SRC2 is denormal AND MXCSR.DAZ) THEN TMP_SRC2=0 

IF (SRC1 is denormal AND MXCSR.DAZ) THEN TMP_SRC1=0 

/* SRC2 is a 64 bits floating-point value */ 

DEST[63:0] := TMP_SRC1[63:0] * POW(2, Floor(TMP_SRC2[63:0])) 


} 
VSCALEFPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND (SRC2 *is register*) 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory”) 
THEN DEST[i+63:i] = SCALE(SRC1[i+63:i], SRC2[63:0)); 
ELSE DEST[i+63:i] := SCALE(SRC1[i+63:i], SRC2[i+63:i]); 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 


VSCALEFPD—Scale Packed Float64 Values With Float64 Values 


Vol.2C 5-565 


INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VSCALEFPD __m512d_mm512_scalef_round_pd(__m512d a, 
VSCALEFPD __m512d_mm512_mask_scalef_round_pd(__m512ds, 


VSCALEFPD __m512d_mm512_scalef_pd(__m512da,__m512d b); 


m512d b, int rounding); 
mmask8 k, 
VSCALEFPD __m512d_mm512_maskz_scalef_round_pd(__mmask8 k,__m512d a, 


m512da,__m512d, int rounding); 
m512d b, int rounding); 


VSCALEFPD __m512d_mm512_mask_scalef_pd(__m512ds,__mmask8 k,__m512da,__m512d b); 


VSCALEFPD __m512d_mm512_maskz_scalef_pd(__mmask8 k, 
VSCALEFPD __m256d_mm256_scalef_pd(__m256d a,__ m256d b); 
VSCALEFPD __m256d _mm256_mask_scalef_pd(__m256d s, 
VSCALEFPD __m256d __mm256_maskz_scalef_pd(__mmask8 k, 
VSCALEFPD __m128d _mm_scalef_pd(__m128d a, __m128d b); 


mmask8 k,__m256d a, 
m256d a,__m256d b); 


m512da,__m512d b); 


m256d b); 


VSCALEFPD __m128d __mm_mask_scalef_pd(__m128ds,__ mmask8 k,__m128d a,___m128d b); 


VSCALEFPD __m128d __mm_maskz_scalef_pd(__mmask8 k, 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal (for Src1). 


Denormal is not reported for Src2. 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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m128d a,__m128d b); 


VSCALEFPD—Scale Packed Float64 Values With Float64 Values 
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VSCALEFSD—Scale Scalar Float64 Values With Float64 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.LLIG.66.0F38.W1 2D /r A VIV AVX512F | Scale the scalar double-precision floating-point values in 
VSCALEFSD xmm1 {k1}{z}, xmm_2, xmmz using the value from xmm3/m64. Under writemask 
xmm3/m64{er} k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a floating-point scale of the packed double-precision floating-point value in the first source operand by 
multiplying it by 2 power of the double-precision floating-point value in second source operand. 


The equation of this operation is given by: 

xmm1 := xmm2*2floor(xmm3)_ 

Floor(xmm3) means maximum integer value < xmm3. 

If the result cannot be represented in double precision, then the proper overflow response (for positive scaling 
operand), or the proper underflow response (for negative scaling operand) is issued. The overflow and underflow 


responses are dependent on the rounding mode (for IEEE-compliant rounding), as well as on other settings in 
MXCSR (exception mask bits, FTZ bit), and on the SAE bit. 


EVEX encoded version: The first source operand is an XMM register. The second source operand is an XMM register 
or a memory location. The destination operand is an XMM register conditionally updated with writemask k1. 


Handling of special-case input values are listed in Table 5-21 and Table 5-22. 


Operation 


SCALE(SRC1, SRC2) 
{ 
; Check for denormal operands 
TMP_SRC2 := SRC2 
TMP_SRC1 := SRC1 
IF (SRC2 is denormal AND MXCSR.DAZ) THEN TMP_SRC2=0 
IF (SRC1 is denormal AND MXCSR.DAZ) THEN TMP_SRC1=0 
/* SRC2 is a 64 bits floating-point value */ 
DEST[63:0] := TMP_SRC1[63:0] * POW(2, Floor(TMP_SRC2[63:0])) 
} 
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VSCALEFSD (EVEX encoded version) 
IF (EVEX.b= 1) and SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] OR *no writemask* 
THEN DEST[63:0] := SCALE(SRC1[63:0], SRC2[63:0]) 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63:0] := 0 
Fl 
Fl; 
DEST[127:64] := SRC1[127:64] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 

VSCALEFSD __m128d_mm_scalef_round_sd(__m128d a,__m128d b, int); 

VSCALEFSD __m128d __mm_mask_scalef_round_sd(__m128d s,___mmask8 k,__m128d a,__m128d , int); 
VSCALEFSD __m128d __mm_maskz_scalef_round_sd(__mmask8 k,___m128d a,__m128d b, int); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal (for Src1). 
Denormal is not reported for Src2. 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 
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VSCALEFPS—Scale Packed Float32 Values With Float32 Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
EVEX.128.66.0F38.WO 2C /r A VIV AVX512VL | Scale the packed single-precision floating-point values in 
VSCALEFPS xmm1 {k1}{z}, xmm2, AVX512F xmmz using values from xmm3/m128/m32bcst. Under 
xmm3/m128/m32bcst writemask k1. 
EVEX.256.66.0F38.WO 2C /r A VIV AVX512VL | Scale the packed single-precision values in ymm2 using 
VSCALEFPS ymm1 {k1}{z}, ymm2, AVX512F floating point values from ymm3/m256/m32bcst. Under 
ymm3/m256/m32bcst writemask k1. 
EVEX.512.66.0F38.W0O 2C /r A VIV AVX512F Scale the packed single-precision floating-point values in 
VSCALEFPS zmm1 {k1}{z}, zmm2, zmm_2 using floating-point values from 
zmm3/m51 2/m32bcst{er} zmm3/m51 2/m32bcst. Under writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a floating-point scale of the packed single-precision floating-point values in the first source operand by 
multiplying it by 2 power of the float32 values in second source operand. 


The equation of this operation is given by: 


zmm1 := zmm2*2‘loor(zmms3) 
Floor(zmm3) means maximum integer value < zmm3. 


If the result cannot be represented in single precision, then the proper overflow response (for positive scaling 
operand), or the proper underflow response (for negative scaling operand) is issued. The overflow and underflow 
responses are dependent on the rounding mode (for IEEE-compliant rounding), as well as on other settings in 
MXCSR (exception mask bits, FTZ bit), and on the SAE bit. 

EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand is a ZMM 
register, a 512-bit memory location or a 512-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a ZMM register conditionally updated with writemask k1. 

EVEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM 
register, a 256-bit memory location, or a 256-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a YMM register, conditionally updated using writemask k1. 

EVEX.128 encoded version: The first source operand is an XMM register. The second source operand is a XMM 
register, a 128-bit memory location, or a 128-bit vector broadcasted from a 32-bit memory location. The destina- 
tion operand is a XMM register, conditionally updated using writemask k1. 


Handling of special-case input values are listed in Table 5-21 and Table 5-23. 


Table 5-23. Additional VSCALEFPS/SS Special Cases 


Special Case Returned value Faults 
|result| < 27149 +0 or +Min-Denormal (Src1 sign) Underflow 
result] 2 2128 +INF (Src1 sign) or +Max-normal (Src1 sign) Overflow 
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Operation 


SCALE(SRC1, SRC2) 
; Check for denormal operands 
TMP_SRC2 := SRC2 
TMP_SRC1 := SRC1 
IF (SRC2 is denormal AND MXCSR.DAZ) THEN TMP_SRC2=0 
IF (SRC1 is denormal AND MXCSR.DAZ) THEN TMP_SRC1=0 
/* SRC2 is a 32 bits floating-point value */ 
DEST[31:0] := TMP_SRC1[31:0] * POW(2, Floor(TMP_SRC2[31:0])) 
} 


VSCALEFPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
IF (VL = 512) AND (EVEX.b = 1) AND (SRC2 *is register*) 


THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 
Fl; 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN DEST{[i+31:i] = SCALE(SRC1[i+31:i], SRC2[31:0)); 
ELSE DEST[i+31:i] := SCALE(SRC1[i+31:i], SRC2[i+31:i]); 
Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0; 


Intel C/C++ Compiler Intrinsic Equivalent 


VSCALEFPS __m512_mm512_scalef_round_ps(__m512 a,__m512 b, int rounding); 
VSCALEFPS __m512 _mm512_mask_scalef_round_ps(__m512 s,__ mmask16 k, 
VSCALEFPS __m512 _mm512_maskz_scalef_round_ps(__mmask16 k,__m512 a, 
VSCALEFPS __m512_mm512_scalef_ps(__m512 a,__m512 b); 

VSCALEFPS __m512_mm512_mask_scalef_ps(__m512s,__mmask16 k,__m512 a,__m512 b); 
VSCALEFPS __m512 _mm512_maskz_scalef_ps(__mmask16 k,__m512 a,__m512 b); 
VSCALEFPS __m256 _mm256_scalef_ps(__m256 a,__m256 b); 

VSCALEFPS __m256 __mm256_mask_scalef_ps(__m256 s,__ mmask8 k,__m256 a,__m256 b); 
VSCALEFPS __m256 _mm256_maskz_scalef_ps(__mmask8 k,__m256 a,__m256 b); 
VSCALEFPS __m128 _mm_scalef_ps(__m128 a,__m128 b); 

VSCALEFPS __m128 _mm_mask_scalef_ps(__m128s,__mmask8k,__m128 a,__m128 b); 
VSCALEFPS __m128 _mm_maskz_scalef_ps(__mmask8 k,__m128 a,__m128 b); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal (for Src1). 
Denormal is not reported for Src2. 


m512 a,__m512 5, int rounding); 
m512 b, int rounding); 
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Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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VSCALEFSS—Scale Scalar Float32 Value With Float32 Value 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 

EVEX.LLIG.66.0F38.W0 2D /r A VIV AVX512F | Scale the scalar single-precision floating-point value in 
VSCALEFSS xmm1 {k1}{z}, xmm2, xmmcz using floating-point value from xmm3/m32. Under 
xmm3/m32{er} writemask k1. 

Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 

A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 


Description 


Performs a floating-point scale of the scalar single-precision floating-point value in the first source operand by 
multiplying it by 2 power of the float32 value in second source operand. 


The equation of this operation is given by: 
xmm1 := xmm2*2floor(xmm3) | 
Floor(xmm3) means maximum integer value < xmm3. 


If the result cannot be represented in single precision, then the proper overflow response (for positive scaling 
operand), or the proper underflow response (for negative scaling operand) is issued. The overflow and underflow 
responses are dependent on the rounding mode (for IEEE-compliant rounding), as well as on other settings in 


MXCSR (exception mask bits, FTZ bit), and on the SAE bit. 


EVEX encoded version: The first source operand is an XMM register. The second source operand is an XMM register 
or a memory location. The destination operand is an XMM register conditionally updated with writemask k1. 


Handling of special-case input values are listed in Table 5-21 and Table 5-23. 
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Operation 


SCALE(SRC1, SRC2) 
{ 
; Check for denormal operands 
TMP_SRC2 := SRC2 
TMP_SRC1 := SRC1 
IF (SRC2 is denormal AND MXCSR.DAZ) THEN TMP_SRC2=0 
IF (SRC1 is denormal AND MXCSR.DAZ) THEN TMP_SRC1=0 
/* SRC2 is a 32 bits floating-point value */ 
DEST[31:0] := TMP_SRC1[31:0] * POW(2, Floor(TMP_SRC2[31:0])) 
} 


VSCALEFSS (EVEX encoded version) 
IF (EVEX.b= 1) and SRC2 *is a register* 
THEN 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC); 
ELSE 
SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC); 


Fl; 
IF k1[0] OR *no writemask* 
THEN DEST[31:0] := SCALE(SRC1[31:0], SRC2[31:0]) 
ELSE 
IF *merging-masking* ;merging-masking 
THEN *DEST[31:0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31:0] := 0 
Fl 
Fl; 
DEST[1 27:32] := SRC1[127:32] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VSCALEFSS __m128_mm_scalef_round_ss(__m128 a,__m128 b, int); 


VSCALEFSS __m128 _mm_mask_scalef_round_ss(__m128 s,__mmask8 k,__m128 a,__m128 }, int); 
VSCALEFSS __m128 _mm_maskz_scalef_round_ss(__mmask8 k,__m128 a,__m128 }, int); 


SIMD Floating-Point Exceptions 


Overflow, Underflow, Invalid, Precision, Denormal (for Src1). 
Denormal is not reported for Src2. 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions”. 


VSCALEFSS—Scale Scalar Float32 Value With Float32 Value Vol.2C 5-573 


INSTRUCTION SET REFERENCE, V-Z 


VSCATTERDPS/VSCATTERDPD/VSCATTERQPS/VSCATTERQPD—Scatter Packed Single, Packed 
Double with Signed Dword and Qword Indices 


Opcode/ Op/E | 64/32 CPUID Description 
Instruction n bit Mode | Feature 

Support | Flag 
EVEX.128.66.0F38.W0 A2 /vsib A VIV AVX512VL | Using signed dword indices, scatter single-precision 
VSCATTERDPS vm3ex {k1}, xmm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.256.66.0F38.W0 A2 /vsib A VIV AVX512VL | Using signed dword indices, scatter single-precision 
VSCATTERDPS vm32y {k1}, ymm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.512.66.0F38.W0 A2 /vsib A VIV AVX512F Using signed dword indices, scatter single-precision 
VSCATTERDPS vm32z {k1}, zmm1 floating-point values to memory using writemask k1. 
EVEX.128.66.0F38.W1 A2 /vsib A VIV AVX512VL | Using signed dword indices, scatter double-precision 
VSCATTERDPD vm32x {k1}, xmm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.256.66.0F38.W1 A2 /vsib A VIV AVX512VL | Using signed dword indices, scatter double-precision 
VSCATTERDPD vm32x {k1}, ymm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.512.66.0F38.W1 A2 /vsib A VIV AVX512F Using signed dword indices, scatter double-precision 
VSCATTERDPD vm32y {k1}, zmm1 floating-point values to memory using writemask k1. 
EVEX.128.66.0F38.W0 A3 /vsib A VIV AVX512VL | Using signed qword indices, scatter single-precision 
VSCATTERQPS vm64x {k1}, xmm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.256.66.0F38.W0 A3 /vsib A VIV AVX512VL | Using signed qword indices, scatter single-precision 
VSCATTERQPS vm64y {k1}, xmm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.512.66.0F38.W0 A3 /vsib A VIV AVX512F Using signed qword indices, scatter single-precision 
VSCATTERQPS vm64z {k1}, ymm1 floating-point values to memory using writemask k1. 
EVEX.128.66.0F38.W1 A3 /vsib A VIV AVX512VL | Using signed qword indices, scatter double-precision 
VSCATTERQPD vm64x {k1}, xmm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.256.66.0F38.W1 A3 /vsib A VIV AVX512VL | Using signed qword indices, scatter double-precision 
VSCATTERQPD vm64y {k1}, ymm1 AVX512F floating-point values to memory using writemask k1. 
EVEX.512.66.0F38.W1 A3 /vsib A VIV AVX512F Using signed qword indices, scatter double-precision 
VSCATTERQPD vm64z {k1}, zmm1 floating-point values to memory using writemask k1. 


Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


BaseReg (R): VSIB:base, 
VectorReg(R): VSIB:index 


A Tuple1 Scalar ModRM:reg (r) NA NA 


Description 


Stores up to 16 elements (or 8 elements) in doubleword/quadword vector zmm1i to the memory locations pointed 
by base address BASE_ADDR and index vector VINDEX, with scale SCALE. The elements are specified via the VSIB 
(i.e., the index register is a vector register, holding packed indices). Elements will only be stored if their corre- 
sponding mask bit is one. The entire mask register will be set to zero by this instruction unless it triggers an excep- 
tion. 


This instruction can be suspended by an exception if at least one element is already scattered (i.e., if the exception 
is triggered by an element other than the rightmost one with its mask bit set). When this happens, the destination 
register and the mask register (ki) are partially updated. If any traps or interrupts are pending from already scat- 
tered elements, they will be delivered in lieu of the exception; in this case, EFLAG.RF is set to one so an instruction 
breakpoint is not re-triggered when the instruction is continued. 


Note that: 


* Only writes to overlapping vector indices are guaranteed to be ordered with respect to each other (from LSB to 
MSB of the source registers). Note that this also include partially overlapping vector indices. Writes that are not 
overlapped may happen in any order. Memory ordering with other instructions follows the Intel-64 memory 
ordering model. Note that this does not account for non-overlapping indices that map into the same physical 
address locations. 
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¢ If two or more destination indices completely overlap, the “earlier” write(s) may be skipped. 

¢ Faults are delivered in a right-to-left manner. That is, if a fault is triggered by an element and delivered, all 
elements closer to the LSB of the destination zmm will be completed (and non-faulting). Individual elements 
closer to the MSB may or may not be completed. If a given element triggers multiple faults, they are delivered 
in the conventional order. 


¢ Elements may be scattered in any order, but faults must be delivered in a right-to left order; thus, elements to 
the left of a faulting one may be scattered before the fault is delivered. A given implementation of this 
instruction is repeatable - given the same input values and architectural state, the same set of elements to the 
left of the faulting one will be scattered. 


¢ This instruction does not perform AC checks, and so will never deliver an AC fault. 
° Not valid with 16-bit effective addresses. Will deliver a #UD fault. 


¢ If this instruction overwrites itself and then takes a fault, only a subset of elements may be completed before 
the fault is delivered (as described above). If the fault handler completes and attempts to re-execute this 
instruction, the new instruction will be executed, and the scatter will not complete. 

Note that the presence of VSIB byte is enforced in this instruction. Hence, the instruction will #UD fault if 

ModRM.rm is different than 100b. 


This instruction has special disp8*N and alignment rules. N is considered to be the size of a single vector element. 
The scaled index may require more bits to represent than the address bits used by the processor (e.g., in 32-bit 
mode, if the scale is greater than one). In this case, the most significant bits beyond the number of address bits are 
ignored. 


The instruction will #UD fault if the kO mask register is specified. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 
VINDEX stands for the memory operand vector of indices (a ZMM register) 
SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1 or 4 byte displacement 


VSCATTERDPS (EVEX encoded versions) 
(KL, VL)= (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
j:=j* 32 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR +SignExtend(VINDEX[i+31:i]) * SCALE + DISP] := 
SRC[i+3 1:1] 
k1{j] := 0 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


VSCATTERDPD (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR +SignExtend(VINDEX[k+31 :k]) * SCALE + DISP] := 
SRC[i+63:i] 
k1{j] := 0 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 
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VSCATTERQPS (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
k:=j* 64 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR + (VINDEX[k+63:k]) * SCALE + DISP] := 
SRC[i+31:i] 
k1[j] :=0 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


VSCATTERQPD (EVEX encoded versions) 
(KL, VL)= (2, 128), (4, 256), (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN MEM[BASE_ADDR + (VINDEX[i+63:i]) * SCALE + DISP] := 
SRC[i+63:i] 
k1[j] :=0 
Fl; 
ENDFOR 
k1[MAX_KL-1:KL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VSCATTERDPD void __mm512_i32scatter_pd(void * base, _ m256i vdx,__m512d a, int scale); 
VSCATTERDPD void __mm512_mask_i32scatter_pd(void * base, __ mmask8 k, __m256i vdx, 
VSCATTERDPS void __mm512_i32scatter_ps(void * base,__m512i vdx,__m512 a, int scale); 

VSCATTERDPS void __mm512_mask_i32scatter_ps(void * base,__ mmask16 k,__m512i vdx,_m512 a, int scale); 
VSCATTERQPD void __mm512_i64scatter_pd(void * base, ___m512i vdx,__m512d a, int scale); 

VSCATTERQPD void __mm512_mask_i64scatter_pd(void * base, __mmask8 k, __m512i vdx, 
VSCATTEROPS void __mm512_i64scatter_ps(void * base, __m512i vdx, __m256 a, int scale); 
VSCATTEROPS void _mm512_mask_i64scatter_ps(void * base, __mmask8 k, __m512i vdx, 
VSCATTERDPD void _mm256_i32scatter_pd(void * base, ___m128i vdx,___m256d a, int scale); 
VSCATTERDPD void _mm256_mask_i32scatter_pd(void * base, __ mmask8 k, __m128i vdx, 
VSCATTERDPS void _mm256_i32scatter_ps(void * base,__ m256i vdx,___m256 a, int scale); 

VSCATTERDPS void _mm256_mask_i32scatter_ps(void * base, __ mmask8 k,___ m256i vdx,___m256 a, int scale); 
VSCATTERQPD void __mm256_i64scatter_pd(void * base, __ m256i vdx, __m256d a, int scale); 

VSCATTERQPD void _mm256_mask_i64scatter_pd(void * base, __mmask8 k, __m256i vdx, 
VSCATTEROPS void __mm256_i64scatter_ps(void * base, __m256i vdx, __m128 a, int scale); 
VSCATTEROPS void _mm256_mask_i64scatter_ps(void * base, __mmask8 k, __m256i vdx, 
VSCATTERDPD void _mm_i32scatter_pd(void * base, __m128i vdx,___m128d a, int scale); 
VSCATTERDPD void _mm_mask_i32scatter_pd(void * base, __ mmask8 k,___m128i vdx,___m128d a, int scale); 
VSCATTERDPS void _mm_i32scatter_ps(void * base,__m128i vdx,__m128 a, int scale); 

VSCATTERDPS void _mm_mask_i32scatter_ps(void * base, __ mmask8 k,___m128i vdx, 
VSCATTERQPD void _mm_i64scatter_pd(void * base, __m128i vdx, __m128d a, int scale); 
VSCATTERQPD void _mm_mask_i64scatter_pd(void * base, __mmask8 k, __m128i vdx, 
VSCATTEROPS void __mm_i64scatter_ps(void * base, __m128i vdx,___m128 a, int scale); 
VSCATTEROPS void _mm_mask_i64scatter_ps(void * base, __mmask8 k, __m128i vdx, 


m512d a, int scale); 


m512d a, int scale); 


m256 a, int scale); 


m256d a, int scale); 


m256d a, int scale); 


m128 a, int scale); 


m128 a, int scale); 


m128d a, int scale); 


m128 a, int scale); 
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INSTRUCTION SET REFERENCE, V-Z 


SIMD Floating-Point Exceptions 
Invalid, Overflow, Underflow, Precision, Denormal 


Other Exceptions 
See Table 2-61, “Type E12 Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE, V-Z 


VSHUFF32x4/VSHUFF64x2/VSHUFI32x4/VSHUFI64x2—Shuffle Packed Values at 128-bit 


Granularity 
Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.256.66.0F3A.WO 23 /r ib A VIV AVX512VL_ | Shuffle 128-bit packed single-precision floating-point 
VSHUFF32X4 ymm1{k1}{z}, ymm2, AVX512F values selected by imm8 from ymm2 and 
ymm3/m256/m32bcst, imm8 ymm3/m256/m32bcst and place results in ymm1 
subject to writemask k1. 
EVEX.512.66.0F3A.WO 23 /r ib A VIV AVX512F Shuffle 128-bit packed single-precision floating-point 
VSHUFF32x4 zmm1{k1}{z}, zmm2, values selected by imm8 from zmm2 and 
zmm3/m512/m32bcst, imm8 zmm3/m512/m32bcst and place results in zmm1 
subject to writemask k1. 
EVEX.256.66.0F3A.W1 23 /r ib A VIV AVX512VL_ | Shuffle 128-bit packed double-precision floating-point 
VSHUFF64X2 ymm1{k1}{z}, ymm2, AVX512F values selected by imm8 from ymm2 and 
ymm3/m256/m64bcst, imm8 ymm3/m256/m64bcst and place results in ymm1 
subject to writemask k1. 
EVEX.512.66.0F3A.W1 23 /r ib A VIV AVX512F Shuffle 128-bit packed double-precision floating-point 
VSHUFF64x2 zmm1{k1}{z}, zmm2, values selected by imm8 from zmm2 and 
zmm3/m512/m64bcst, imm8 zmm3/m512/m64bcst and place results in zmm1 
subject to writemask k1. 
EVEX.256.66.0F3A.WO 43 /r ib A VIV AVX512VL_ | Shuffle 128-bit packed double-word values selected by 
VSHUFI32X4 ymm1{k1}{z}, ymm2, AVX512F imm8 from ymm2 and ymm3/m256/m32bcst and place 
ymm3/m256/m32bcst, imm8 results in ymm1 subject to writemask k1. 
EVEX.512.66.0F3A.WO 43 /r ib A VIV AVX512F Shuffle 128-bit packed double-word values selected by 
VSHUFI32x4 zmm1{k1}{z}, zmm2, imm8 from zmm2 and zmm3/m512/m32bcst and place 
zmm3/m512/m32bcst, imm8 results in zmm1 subject to writemask k1. 
EVEX.256.66.0F3A.W1 43 /r ib A VIV AVX512VL_ | Shuffle 128-bit packed quad-word values selected by 
VSHUFI64X2 ymm1{k1}{z}, ymm2, AVX512F imm8 from ymm2 and ymm3/m256/m64bcst and place 
ymm3/m256/m64bcst, imm8 results in ymm1 subject to writemask k1. 
EVEX.512.66.0F3A.W1 43 /r ib A VIV AVX512F Shuffle 128-bit packed quad-word values selected by 
VSHUFI64x2 zmm1{k1}{z}, zmm2, imm8 from zmm2 and zmm3/m512/m64bcst and place 
zmm3/m512/m64bcst, imm8 results in zmm1 subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


256-bit Version: Moves one of the two 128-bit packed single-precision floating-point values from the first source 

operand (second operand) into the low 128-bit of the destination operand (first operand); moves one of the two 

packed 128-bit floating-point values from the second source operand (third operand) into the high 128-bit of the 
destination operand. The selector operand (third operand) determines which values are moved to the destination 
operand. 


512-bit Version: Moves two of the four 128-bit packed single-precision floating-point values from the first source 
operand (second operand) into the low 256-bit of each double qword of the destination operand (first operand); 
moves two of the four packed 128-bit floating-point values from the second source operand (third operand) into 
the high 256-bit of the destination operand. The selector operand (third operand) determines which values are 
moved to the destination operand. 


The first source operand is a vector register. The second source operand can be a ZMM register, a 512-bit memory 
location or a 512-bit vector broadcasted from a 32/64-bit memory location. The destination operand is a vector 
register. 


The writemask updates the destination operand with the granularity of 32/64-bit data elements. 
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Operation 


Select2(SRC, control) { 
CASE (control[0]) OF 
O: TMP := SRC[127:0]; 
1: TMP := SRC[255:128); 
ESAC; 
RETURN TMP 
} 


Select4(SRC, control) { 
CASE (control[1:0]) OF 
O: TMP := SRC[127:0]; 
1: TMP := SRC[255:128); 
2: TMP := SRC[383:256]; 
3: TMP := SRC[511:384]; 
ESAC; 
RETURN TMP 
} 


VSHUFF32x4 (EVEX versions) 
(KL, VL) = (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] = SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL = 256 
TMP_DEST[127:0] := Select2(SRC1[255:0], imm8[0}); 
TMP_DEST[255:1 28] := Select2(SRC2[255:0], imm8[1]); 
Fl; 
IF VL= 512 
TMP_DEST[127:0] := Select4(SRC1[51 1:0], imm8[1:0}); 
TMP_DEST[255:1 28] := Select4(SRC1[51 1:0], imm8[3:2]); 
TMP_DEST[383:256] := Select4(TMP_SRC2[51 1:0], imm8[5:4}); 
TMP_DEST[51 1:384] := Select4(TMP_SRC2[51 1:0], imm8[7:6]); 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
THEN DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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INSTRUCTION SET REFERENCE, V-Z 
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INSTRUCTION SET REFERENCE, V-Z 


VSHUFF64x2 (EVEX 512-bit version) 
(KL, VL) = (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN TMP_SRC2[i+63:i] = SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL = 256 
TMP_DEST[127:0] := Select2(SRC1[255:0], imm8[0}); 
TMP_DEST[255:1 28] := Select2(SRC2[255:0], imm8[1]); 
Fl; 
IF VL=512 
TMP_DEST[127:0] := Select4(SRC1[51 1:0], imm8[1:0}); 
TMP_DEST[255:1 28] := Select4(SRC1[51 1:0], imm8[3:2]); 
TMP_DEST[383:256] := Select4(TMP_SRC2[51 1:0], imm8[5:4}); 
TMP_DEST[51 1:384] := Select4(TMP_SRC2[51 1:0], imm8[7:6]); 


Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSHUFI32x4 (EVEX 512-bit version) 
(KL, VL) = (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF (EVEX.b = 1) AND (SRC2 *is memory’) 
THEN TMP_SRC2[i+31:i] = SRC2[31:0] 
ELSE TMP_SRC2[i+31:i] := SRC2[i+31:i] 
Fl; 
ENDFOR; 
IF VL = 256 
TMP_DEST[127:0] := Select2(SRC1[255:0], imm8[0}); 
TMP_DEST[255:1 28] := Select2(SRC2[255:0], imm8[1]); 
Fl; 
IF VL=512 
TMP_DEST[127:0] := Select4(SRC1[51 1:0], imm8[1:0}); 
TMP_DEST[255:1 28] := Select4(SRC1[51 1:0], imm8[3:2]); 
TMP_DEST[383:256] := Select4(TMP_SRC2[51 1:0], imm8[5:4}); 
TMP_DEST[51 1:384] := Select4(TMP_SRC2[51 1:0], imm8[7:6]); 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 32 
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IF k1[j] OR *no writemask* 
THEN DEST[i+31:i] = TMP_DEST[i+31:i] 


ELSE 

IF *merging-masking* ;merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

THEN DEST[i+31:i] := 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VSHUFI64x2 (EVEX 512-bit version) 
(KL, VL) = (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF (EVEX.b = 1) AND (SRC2 *is memory*) 
THEN TMP_SRC2[i+63:i] = SRC2[63:0] 
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i] 
Fl; 
ENDFOR; 
IF VL = 256 
TMP_DEST[127:0] := Select2(SRC1[255:0], imm8[0}); 
TMP_DEST[255:1 28] := Select2(SRC2[255:0], imm8[1]); 
Fl; 
IF VL=512 
TMP_DEST[127:0] := Select4(SRC1[51 1:0], imm8[1:0)); 
TMP_DEST[255:1 28] := Select4(SRC1[51 1:0], imm8[3:2]); 
TMP_DEST[383:256] := Select4(TMP_SRC2[51 1:0], imm8[5:4}); 
TMP_DEST[51 1:384] := Select4(TMP_SRC2[51 1:0], imm8[7:6]); 
Fl; 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* 
THEN DEST[i+63:i] = TMP_DEST[i+63:i] 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 
THEN DEST[i+63:i] := 0 
Fl 
Fl; 
ENDFOR 
DEST[MAXVL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 


VSHUFI32x4 __m512i_mm512_shuffle_i32x4(__m512ia,__m512i b, int imm); 

VSHUFI32x4 __m512i_mm512_mask_shuffle_i32x4(__m512is,__mmask16 k,__m512ia,__m512i b, int imm); 
VSHUFI32x4 __m512i_mm512_maskz_shuffle_i32x4(__mmask16 k,__m512ia,__m512i b, int imm); 
VSHUFI32x4 __m256i__mm256_shuffle_i32x4(__m256i a,__ m256i b, int imm); 

VSHUFI32x4 __m256i__mm256_mask_shuffle_i32x4(__m256i s,___mmask8 k,__ m256i a, __ m256i b, int imm); 
VSHUFI32x4 __m256i__mm256_maskz_shuffle_i32x4(__mmask8 k,__ m256i a,___m256i b, int imm); 
VSHUFF32x4 ___m512 _mm512_shuffle_f32x4(__m512 a,__m512 b, int imm); 

VSHUFF32x4 __m512 _mm512_mask_shuffle_f32x4(__m512 s,__ mmask16 k,__m512 a,__m512 b, int imm); 
VSHUFF32x4 __m512 _mm512_maskz_shuffle_f32x4(__mmask16 k,__m512 a,__m512 b, int imm); 
VSHUFI64x2 __ m512i_mm512_shuffle_i64x2(__m512ia,__m512i b, int imm); 

VSHUFI64x2 _ m512i_mm512_mask_shuffle_i64x2(__m512is,__mmask8 k,__m512i b,___m512i b, int imm); 
VSHUFI64x2 __m512i_mm512_maskz_shuffle_i64x2(__mmask8 k,__m512i a,__m512ib, int imm); 
VSHUFF64x2 _ m512d_mm512_shuffle_f64x2(__m512d a,__m512db, int imm); 

VSHUFF64x2 __m512d_mm512_mask_shuffle_f64x2(__m512ds,__mmask8 k,__m512da,__m512db, int imm); 
VSHUFF64x2 _ m512d_mm512_maskz_shuffle_f64x2(__ mmask8 k,__m512d a,__m512db, int imm); 


SIMD Floating-Point Exceptions 


None 


Other Exceptions 
See Table 2-50, “Type E4NF Class Exception Conditions”; additionally: 


#UD 
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INSTRUCTION SET REFERENCE, V-Z 


VTESTPD/VTESTPS—Packed Bit Test 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 

VEX.128.66.0F38.WO OE /r RM |V/V AVX Set ZF and CF depending on sign bit AND and 

VTESTPS xmm1, xmm2/m128 ANDN of packed single-precision floating-point 
SOUIces. 

VEX.256.66.0F38.WO OE /r RM |V/V AVX Set ZF and CF depending on sign bit AND and 

VTESTPS ymm17, ymm2/m256 ANDN of packed single-precision floating-point 
SOUIces. 

VEX.128.66.0F38.WO OF /r RM |V/V AVX Set ZF and CF depending on sign bit AND and 

VTESTPD xmm1, xmm2/m128 ANDN of packed double-precision floating-point 
SOUICeS. 

VEX.256.66.0F38.WO OF /r RM |V/V AVX Set ZF and CF depending on sign bit AND and 

VTESTPD ymm1, ymm2/m256 ANDN of packed double-precision floating-point 
SOUICeS. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RM ModRM:reg (r) ModRM:r/m (r) NA NA 
Description 


VTESTPS performs a bitwise comparison of all the sign bits of the packed single-precision elements in the first 
source operation and corresponding sign bits in the second source operand. If the AND of the source sign bits with 
the dest sign bits produces all zeros, the ZF is set else the ZF is clear. If the AND of the source sign bits with the 
inverted dest sign bits produces all zeros the CF is set else the CF is clear. An attempt to execute VTESTPS with 
VEX.W=1 will cause #UD. 


VTESTPD performs a bitwise comparison of all the sign bits of the double-precision elements in the first source 
operation and corresponding sign bits in the second source operand. If the AND of the source sign bits with the dest 
sign bits produces all zeros, the ZF is set else the ZF is clear. If the AND the source sign bits with the inverted dest 
sign bits produces all zeros the CF is set else the CF is clear. An attempt to execute VTESTPS with VEX.W=1 will 
cause #UD. 

The first source register is specified by the ModR/M reg field. 

128-bit version: The first source register is an XMM register. The second source register can be an XMM register or 
a 128-bit memory location. The destination register is not modified. 

VEX.256 encoded version: The first source register is a YMM register. The second source register can be a YMM 
register or a 256-bit memory location. The destination register is not modified. 


Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. 
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INSTRUCTION SET REFERENCE, V-Z 


Operation 


VTESTPS (128-bit version) 

TEMP[1 27:0] := SRC[127:0] AND DEST[127:0] 

IF (TEMP[31] = TEMP[63] = TEMP[95] = TEMP[127] = 0) 
THEN ZF := 1; 
ELSE ZF := 0; 


TEMP[1 27:0] := SRC[127:0] AND NOT DEST[127:0] 

IF (TEMP[31] = TEMP[63] = TEMP[95] = TEMP[127] = 0) 
THEN CF := 1; 
ELSE CF := 0; 

DEST (unmodified) 

AF := OF := PF := SF := 0; 


VTESTPS (VEX.256 encoded version) 

TEMP[255:0] := SRC[255:0] AND DEST[255:0] 

IF (TEMP[31] = TEMP[63] = TEMP[95] = TEMP[127]= TEMP[160] =TEMP[191] = TEMP[224] = TEMP[255] = 0) 
THEN ZF := 1; 
ELSE ZF := 0; 


TEMP[255:0] := SRC[255:0] AND NOT DEST[255:0] 

IF (TEMP[31] = TEMP[63] = TEMP[95] = TEMP[127]= TEMP[160] =TEMP[191] = TEMP[224] = TEMP[255] = 0) 
THEN CF := 1; 
ELSE CF := 0; 

DEST (unmodified) 

AF := OF := PF := SF := 0; 


VTESTPD (128-bit version) 
TEMP[1 27:0] := SRC[127:0] AND DEST[127:0] 
IF ( TEMP[63] = TEMP[127] = 0) 

THEN ZF := 1; 

ELSE ZF := 0; 


TEMP[1 27:0] := SRC[127:0] AND NOT DEST[127:0] 
IF ( TEMP[63] = TEMP[127] = 0) 
THEN CF := 1; 
ELSE CF := 0; 
DEST (unmodified) 
AF := OF := PF := SF := 0; 


VTESTPD (VEX.256 encoded version) 

TEMP[255:0] := SRC[255:0] AND DEST[255:0] 

IF (TEMP[63] = TEMP[1 27] = TEMP[191] = TEMP[255] = 0) 
THEN ZF := 1; 
ELSE ZF := 0; 


TEMP[255:0] := SRC[255:0] AND NOT DEST[255:0] 

IF (TEMP[63] = TEMP[1 27] = TEMP[191] = TEMP[255] = 0) 
THEN CF := 1; 
ELSE CF := 0; 

DEST (unmodified) 

AF := OF := PF := SF := 0; 
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INSTRUCTION SET REFERENCE, V-Z 


Intel C/C++ Compiler Intrinsic Equivalent 


VTESTPS 
int_mm256_testz_ps (_m256 s1,__m256 s2); 
int__mm256_testc_ps (_m256 s1,__m256 s2); 
m128 s2); 
int__mm_testz_ps (_m128s1,__m128 s2); 


int_mm256_testnzc_ps (__m256 s1, 


int__mm_testc_ps (__m128s1,__m128s2); 


int__mm_testnzc_ps (_m128s1,__m128 s2); 


VTESTPD 
int_mm256_testz_pd (__m256ds1,__m256d s2); 
int_mm256_testc_pd (__m256d s1,__m256d s2); 
int__mm256_testnzc_pd (__m256d s1,__m256d s2); 
m128d s2); 
m128d s2); 
m128d s2); 


int__mm_testz_pd (__m128d s1, 


int__mm_testc_pd (__m128d s1, 


int__mm_testnzc_pd (__m128d s1, 


Flags Affected 
The OF, AF, PF, SF flags are cleared and the ZF, CF flags are set according to the operation. 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 
See Table 2-21, “Type 4 Class Exception Conditions”; additionally: 
#UD If VEX.vvvv # 1111B. 

If VEX.W = 1 for VTESTPS or VTESTPD. 
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VZEROALL—Zero XMM, YMM and ZMM Registers 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
VEX.256.0F.WIG 77 ZO |V/IV AVX Zero some of the XMM, YMM and ZMM 
VZEROALL registers. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


In 64-bit mode, the instruction zeroes XMMO-XMM15, YMMO-YMM15, and ZMMO-ZMM15. Outside 64-bit mode, it 
zeroes only XMMO-XMM7, YMMO-YMM7, and ZMMO-ZMM7. VZEROALL does not modify ZMM16-ZMM31. 


Note: VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. In Compatibility and legacy 32-bit 
mode only the lower 8 registers are modified. 


Operation 

simd_reg_file[][] is a two dimensional array representing the SIMD register file containing all the overlapping xmm, ymm and zmm 
registers present in that implementation. The major dimension is the register number: O for xmmO, ymmO and zmm0O; 1 for xmm1, 
ymm1, and zmm1; etc. The minor dimension size is the width of the implemented SIMD state measured in bits. On a machine 
supporting Intel AVX-512, the width is 512. 


VZEROALL (VEX.256 encoded version) 
IF (64-bit mode) 
limit :=15 
ELSE 
limit := 7 
FOR i in O.. limit: 
simd_reg_file[iJ[MAXVL-1:0] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VZEROALL: _mm256_zeroall() 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


" 


See Table 2-25, “Type 8 Class Exception Conditions”. 
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VZEROUPPER—Zero Upper Bits of YMM and ZMM Registers 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
VEX.128.0F.WIG 77 ZO |V/V AVX Zero bits in positions 128 and higher of some 
VZEROUPPER YMM and ZMM registers. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


In 64-bit mode, the instruction zeroes the bits in positions 128 and higher in YMMO-YMM15 and ZMMO-ZMM15. 
Outside 64-bit mode, it zeroes those bits only in YMMO-YMM7 and ZMMO-ZMM7. VZEROUPPER does not modify the 
lower 128 bits of these registers and it does not modify ZMM16-ZMM31. 

This instruction is recommended when transitioning between AVX and legacy SSE code; it will eliminate perfor- 
mance penalties caused by false dependencies. 

Note: VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. In Compatibility and legacy 32-bit 
mode only the lower 8 registers are modified. 


Operation 

simd_reg_file[][] is a two dimensional array representing the SIMD register file containing all the overlapping xmm, ymm and zmm 
registers present in that implementation. The major dimension is the register number: O for xmmO, ymmO and zmm0O; 1 for xmm1, 
ymm1, and zmm1; etc. The minor dimension size is the width of the implemented SIMD state measured in bits. 


VZEROUPPER 

IF (64-bit mode) 
limit :=15 

ELSE 
limit := 7 

FOR iin O.. limit: 
simd_reg_file[i][/MAXVL-1:1 28] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VZEROUPPER: _mm256_zeroupper() 


SIMD Floating-Point Exceptions 


None. 


Other Exceptions 


" 


See Table 2-25, “Type 8 Class Exception Conditions”. 
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WAIT/FWAIT—Wait 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
9B WAIT ZO | Valid Valid Check pending unmasked floating-point 
exceptions. 
9B FWAIT ZO | Valid Valid Check pending unmasked floating-point 
exceptions. 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Causes the processor to check for and handle pending, unmasked, floating-point exceptions before proceeding. 
(FWAIT is an alternate mnemonic for WAIT.) 


This instruction is useful for synchronizing exceptions in critical sections of code. Coding a WAIT instruction after a 
floating-point instruction ensures that any unmasked floating-point exceptions the instruction may raise are 
handled before the processor can modify the instruction’s results. See the section titled “Floating-Point Exception 
Synchronization” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, 


for more information on using the WAIT/FWAIT instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


CheckForPendingUnmaskedFloatingPointExceptions; 


FPU Flags Affected 
The CO, C1, C2, and C3 flags are undefined. 


Floating-Point Exceptions 


None. 


Protected Mode Exceptions 
If CRO.MP[bit 1] = 1 and CRO.TS[bit 3] = 1. 
If the LOCK prefix is used. 


#NM 
#UD 


Real-Address Mode Exceptions 


Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 


Same exceptions as in protected mode. 


Compatibility Mode Exceptions 


Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


Same exceptions as in protected mode. 
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WBINVD—Write Back and Invalidate Cache 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 09 WBINVD ZO ‘| Valid Valid Write back and flush Internal caches; initiate 
writing-back and flushing of external caches. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Writes back all modified cache lines in the processor’s internal cache to main memory and invalidates (flushes) the 
internal caches. The instruction then issues a special-function bus cycle that directs external caches to also write 
back modified data and another bus cycle to indicate that the external caches should be invalidated. 


After executing this instruction, the processor does not wait for the external caches to complete their write-back 
and flushing operations before proceeding with instruction execution. It is the responsibility of hardware to respond 
to the cache write-back and flush signals. The amount of time or cycles for WBINVD to complete will vary due to 
size and other factors of different cache hierarchies. As a consequence, the use of the WBINVD instruction can have 
an impact on logical processor interrupt/event response time. Additional information of WBINVD behavior in a 
cache hierarchy with hierarchical sharing topology can be found in Chapter 2 of the Inte/® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volume 3A. 


The WBINVD instruction is a privileged instruction. When the processor is running in protected mode, the CPL of a 
program or procedure must be 0 to execute this instruction. This instruction is also a serializing instruction (see 
“Serializing Instructions” in Chapter 8 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A). 


In situations where cache coherency with main memory is not a concern, software can use the INVD instruction. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 


The WBINVD instruction is implementation dependent, and its function may be implemented differently on future 
Intel 64 and IA-32 processors. The instruction is not supported on IA-32 processors earlier than the Intel486 
processor. 


Operation 


WriteBack(InternalCaches); 
Flush(InternalCaches); 
SignalWriteBack(ExternalCaches); 
SignalFlush(ExternalCaches); 
Continue; (* Continue execution *) 


Intel C/C++ Compiler Intrinsic Equivalent 
WBINVD void _wbinvd(void); 


Flags Affected 
None. 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD If the LOCK prefix is used. 


WBINVD—Write Back and Invalidate Cache Vol.2C 5-589 


INSTRUCTION SET REFERENCE, V-Z 
Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) WBINVD cannot be executed at the virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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WBNOINVD—Write Back and Do Not Invalidate Cache 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
F3 OF 09 ZO |V/V WBNOINVD | Write back and do not flush internal caches; 
WBNOINVD initiate writing-back without flushing of external 
caches. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA NA 
Description 


The WBNOINVD instruction writes back all modified cache lines in the processor’s internal cache to main memory 
but does not invalidate (flush) the internal caches. 


After executing this instruction, the processor does not wait for the external caches to complete their write-back 
operation before proceeding with instruction execution. It is the responsibility of hardware to respond to the cache 
write-back signal. The amount of time or cycles for WBNOINVD to complete will vary due to size and other factors 
of different cache hierarchies. As a consequence, the use of the WBNOINVD instruction can have an impact on 
logical processor interrupt/event response time. 


The WBNOINVD instruction is a privileged instruction. When the processor is running in protected mode, the CPL of 
a program or procedure must be 0 to execute this instruction. This instruction is also a serializing instruction (see 
“Serializing Instructions” in Chapter 8 of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A). 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


Operation 


WriteBack(InternalCaches); 
Continue; (* Continue execution *) 


Intel C/C++ Compiler Intrinsic Equivalent 
WBNOINVD void _wbnoinvd(void); 


Flags Affected 
None. 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) WBNOINVD cannot be executed at the virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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WRFSBASE/WRGSBASE—Write FS/GS Segment Base 


Opcode/ Op/ |64/32- | CPUID Fea- | Description 
Instruction En bit ture Flag 

Mode 
F3 OF AE/2 M V/I FSGSBASE | Load the FS base address with the 32-bit value in 
WRFSBASE r32 the source register. 
F3 REX.W OF AE /2 M V/I FSGSBASE | Load the FS base address with the 64-bit value in 
WRFSBASE r64 the source register. 
F3 OF AE /3 M V/I FSGSBASE | Load the GS base address with the 32-bit value in 
WRGSBASE r32 the source register. 
F3 REX.W OF AE /3 M VAI FSGSBASE | Load the GS base address with the 64-bit value in 
WRGSBASE r64 the source register. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Loads the FS or GS segment base address with the general-purpose register indicated by the modR/M:r/m field. 


The source operand may be either a 32-bit or a 64-bit general-purpose register. The REX.W prefix indicates the 
operand size is 64 bits. If no REX.W prefix is used, the operand size is 32 bits; the upper 32 bits of the source 
register are ignored and upper 32 bits of the base address (for FS or GS) are cleared. 


This instruction is supported only in 64-bit mode. 


Operation 
FS/GS segment base address := SRC; 


Flags Affected 
None 


C/C++ Compiler Intrinsic Equivalent 


WRFSBASE: void _writefsbase_u32( unsigned int ); 

WRFSBASE: _writefsbase_u64( unsigned __int64 ); 
WRGSBASE: void _writegsbase_u32( unsigned int ); 
WRGSBASE: _writegsbase_u64( unsigned __int64 ); 


Protected Mode Exceptions 
#UD The WRFSBASE and WRGSBASE instructions are not recognized in protected mode. 


Real-Address Mode Exceptions 
#UD The WRFSBASE and WRGSBASE instructions are not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The WRFSBASE and WRGSBASE instructions are not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
#UD The WRFSBASE and WRGSBASE instructions are not recognized in compatibility mode. 
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64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
If CR4.FSGSBASE[bit 16] = 0. 
If CPUID.0O7H.OH: EBX.FSGSBASE[bit 0] = 0 
#GP(0) If the source register contains a non-canonical address. 
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WRMSR—Write to Model Specific Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 30 WRMSR ZO | Valid Valid Write the value in EDX:EAX to MSR specified 
by ECX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Writes the contents of registers EDX:EAX into the 64-bit model specific register (MSR) specified in the ECX register. 
(On processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The contents of 
the EDX register are copied to high-order 32 bits of the selected MSR and the contents of the EAX register are 
copied to low-order 32 bits of the MSR. (On processors that support the Intel 64 architecture, the high-order 32 
bits of each of RAX and RDX are ignored.) Undefined or reserved bits in an MSR should be set to values previously 
read. 


This instruction must be executed at privilege level 0 or in real-address mode; otherwise, a general protection 
exception #GP(0) is generated. Specifying a reserved or unimplemented MSR address in ECX will also cause a 
general protection exception. The processor will also generate a general protection exception if software attempts 
to write to bits in a reserved MSR. 


When the WRMSR instruction is used to write to an MTRR, the TLBs are invalidated. This includes global entries 
(see “Translation Lookaside Buffers (TLBs)” in Chapter 3 of the Inte/® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 3A). 


MSRs control functions for testability, execution tracing, performance-monitoring and machine check errors. 
Chapter 2, “Model-Specific Registers (MSRs)” of the Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 4, lists all MSRs that can be written with this instruction and their addresses. Note that each 
processor family has its own set of MSRs. 


The WRMSR instruction is a serializing instruction (see “Serializing Instructions” in Chapter 8 of the Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 3A). Note that WRMSR to the IA32_TSC_DEADLINE 
MSR (MSR index 6E0H) and the X2APIC MSRs (MSR indices 802H to 83FH) are not serializing. 


The CPUID instruction should be used to determine whether MSRs are supported (CPUID.01H:EDX[5] =1) before 
using this instruction. 
IA-32 Architecture Compatibility 


The MSRs and the ability to read them with the WRMSR instruction were introduced into the IA-32 architecture with 
the Pentium processor. Execution of this instruction by an IA-32 processor earlier than the Pentium processor 
results in an invalid opcode exception #UD. 


Operation 
MSR[ECX] := EDX:EAX; 


Flags Affected 
None. 
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Protected Mode Exceptions 


#GP(0) 


#UD 


If the current privilege level is not 0. 
If the value in ECX specifies a reserved or unimplemented MSR address. 
If the value in EDX:EAX sets bits that are reserved in the MSR specified by ECX. 


If the source register contains a non-canonical address and ECX specifies one of the following 
MSRs: IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE, IA32_KERNEL_GS_ BASE, 
IA32_LSTAR, IA32_SYSENTER_EIP, IA32_SYSENTER_ESP. 


If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 


#UD 


If the value in ECX specifies a reserved or unimplemented MSR address. 
If the value in EDX:EAX sets bits that are reserved in the MSR specified by ECX. 


If the source register contains a non-canonical address and ECX specifies one of the following 
MSRs: IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE, IA32_KERNEL_GS_ BASE, 
IA32_LSTAR, IA32_SYSENTER_EIP, IA32_SYSENTER_ESP. 


If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) 


The WRMSR instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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Opcode/ Op/ |64/32bit | CPUID Description 
Instruction En |Mode Feature 
Support | Flag 
NP OF 01 EF ZO |VV OSPKE Writes EAX into PKRU. 
WRPKRU 
Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Writes the value of EAX into PKRU. ECX and EDX must be 0 when WRPKRU is executed; otherwise, a general- 


protection exception (#GP) occurs. 


WRPKRU can be executed only if CR4.PKE = 1; otherwise, an invalid-opcode exception (#UD) occurs. Software can 
discover the value of CR4.PKE by examining CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4]. 


On processors that support the Intel 64 Architecture, the high-order 32-bits of RCX, RDX and RAX are ignored. 


WRPKRU will never execute speculatively. Memory accesses affected by PKRU register will not execute (even spec- 
ulatively) until all prior executions of WRPKRU have completed execution and updated the PKRU register. 


Operation 


IF (ECX = 0 AND EDX = 0) 
THEN PKRU := EAX; 
ELSE #GP(0); 

Fl; 


Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 


WRPKRU: void _wrpkru(uint32_t); 


Protected Mode Exceptions 


#GP(0) If ECX # 0. 
If EDX # 0. 

#UD If the LOCK prefix is used 
If CR4.PKE = 0. 


Real-Address Mode Exceptions 
Same exceptions as in protected mode. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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WRSSD/WRSSQ—Write to Shadow Stack 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
OF 38 F6 MR | V/V CET_SS Write 4 bytes to shadow stack. 
WRSSD r/m32, r32 
REX.W OF 38 F6 MR | V/N.E. CET_SS Write 8 bytes to shadow stack. 
WRSSQ r/m64, r64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Writes bytes in register source to the shadow stack. 


Operation 
IF CPL = 3 
IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0 
THEN #UD; FI; 
IF (IA32_U_CET.WR_SHSTK_EN) = 0 
THEN #UD; Fl; 


ELSE 
IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0 
THEN #UD; Fl; 
IF (IA32_S_CET.WR_SHSTK_EN) = 0 
THEN #UD; Fl; 


Fl; 
DEST_LA = Linear_Address(mem operand) 
IF (operand size is 64 bit) 
THEN 
(* Destination not 8B aligned *) 
IF DEST_LA[2:0] 
THEN GP(0); FI; 
Shadow_stack_store 8 bytes of SRC to DEST_LA; 
ELSE 
(* Destination not 4B aligned *) 
IF DEST_LA[1:0] 
THEN GP(0); Fl; 
Shadow_stack_store 4 bytes of SRC[31:0] to DEST_LA; 
Fl; 


Flags Affected 


None. 


C/C++ Compiler Intrinsic Equivalent 
WRSSD void _wrssd(__int32, void *); 
WRSSQ void __wrssq(__int64, void *); 
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Protected Mode Exceptions 


#UD 


#GP(0) 


#SS(0) 
#PF(fault-code) 


If the LOCK prefix is used. 

If CR4.CET = 0. 

If CPL = 3 and JA32_U_CET.SH_STK_EN = 0. 

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0. 

If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If destination is located in a non-writeable segment. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If linear address of destination is not 4 byte aligned. 
If a memory operand effective address is outside the SS segment limit. 


If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor 
shadow stack when CPL < 3. 


Other terminal and non-terminal faults. 


Real-Address Mode Exceptions 


#UD 


The WRSS instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD 


The WRSS instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 


#UD 


#PF(fault-code) 


If the LOCK prefix is used. 

If CR4.CET = 0. 

If CPL = 3 and JA32_U_CET.SH_STK_EN = 0. 

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0. 
If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0. 


If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor 
shadow stack when CPL < 3. 


Other terminal and non-terminal faults. 


64-Bit Mode Exceptions 


#UD 


#GP(0) 


#PF(fault-code) 
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If the LOCK prefix is used. 

If CR4.CET = 0. 

If CPL = 3 and JA32_U_CET.SH_STK_EN = 0. 

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0. 

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0. 

If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0. 

If a memory address is in a non-canonical form. 

If linear address of destination is not 4 byte aligned. 


If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor 
shadow stack when CPL < 3. 


Other terminal and non-terminal faults. 
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Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 

Support | Flag 
66 OF 38F5 MR | V/V CET_SS Write 4 bytes to shadow stack. 
WRUSSD r/m32, r32 
66 REX.W OF 38 F5 MR | V/N.E. CET_SS Write 8 bytes to shadow stack. 
WRUSSQ r/m64, r64 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (w) ModRM:reg (r) NA NA 
Description 


Writes bytes in register source to a user shadow stack page. The WRUSS instruction can be executed only if CPL = 
0, however the processor treats its shadow-stack accesses as user accesses. 


Operation 
IF CR4.CET = 0 
THEN #UD; Fl: 
IF CPL >0O 
THEN #GP(0); Fl; 
DEST_LA = Linear_Address(mem operand) 
IF (operand size is 64 bit) 
THEN 
(* Destination not 8B aligned *) 
IF DEST_LA[2:0] 
THEN GP(0); Fl; 


Shadow_stack_store 8 bytes of SRC to DEST_LA as user-mode access; 


ELSE 
(* Destination not 4B aligned *) 
IF DEST_LA[1:0] 
THEN GP(0); Fl; 


Shadow_stack_store 4 bytes of SRC[31:0] to DEST_LA as user-mode access; 


Fl; 


Flags Affected 


None. 


C/C++ Compiler Intrinsic Equivalent 


WRUSSD — void _wrussd(__int32, void *); 
WRUSSQ void __wrussq(__int64, void *); 
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Protected Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 


If destination is located in a non-writeable segment. 


If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment 
selector. 


If linear address of destination is not 4 byte aligned. 

If CPL is not O. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 
#PF(fault-code) If destination is not a user shadow stack. 

Other terminal and non-terminal faults. 


Real-Address Mode Exceptions 
#UD The WRUSS instruction is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 
#UD The WRUSS instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
#GP(0) If a memory address is in a non-canonical form. 


If linear address of destination is not 4 byte aligned. 

If CPL is not 0. 
#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#PF(fault-code) If destination is not a user shadow stack. 

Other terminal and non-terminal faults. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 
If CR4.CET = 0. 
#GP(0) If a memory address is in a non-canonical form. 


If linear address of destination is not 4 byte aligned. 
If CPL is not 0. 

#PF(fault-code) If destination is not a user shadow stack. 
Other terminal and non-terminal faults. 
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XACQUIRE/XRELEASE — Hardware Lock Elision Prefix Hints 


Opcode/Instruction 64/32bit | CPUID Description 
Mode Feature 
Support | Flag 
Fe VIN HLE! A hint used with an “XACQUIRE-enabled” instruction to start lock 
XACQUIRE elision on the instruction memory operand address. 
F3 VIN HLE A hint used with an “XRELEASE-enabled” instruction to end lock 
XRELEASE elision on the instruction memory operand address. 
NOTES: 


1. Software is not required to check the HLE feature flag to use XACQUIRE or XRELEASE, as they are treated as regular prefix if HLE 
feature flag reports 0. 


Description 


The XACQUIRE prefix is a hint to start lock elision on the memory address specified by the instruction and the 
XRELEASE prefix is a hint to end lock elision on the memory address specified by the instruction. 


The XACQUIRE prefix hint can only be used with the following instructions (these instructions are also referred to 

as XACQUIRE-enabled when used with the XACQUIRE prefix): 

¢ Instructions with an explicit LOCK prefix (FOH) prepended to forms of the instruction where the destination 
operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCHG8B, DEC, INC, NEG, NOT, 
OR, SBB, SUB, XOR, XADD, and XCHG. 

¢ The XCHG instruction either with or without the presence of the LOCK prefix. 


The XRELEASE prefix hint can only be used with the following instructions (also referred to as XRELEASE-enabled 
when used with the XRELEASE prefix): 


¢ Instructions with an explicit LOCK prefix (FOH) prepended to forms of the instruction where the destination 
operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCHG8B, DEC, INC, NEG, NOT, 
OR, SBB, SUB, XOR, XADD, and XCHG. 

¢ The XCHG instruction either with or without the presence of the LOCK prefix. 


¢ The “MOV mem, reg” (Opcode 88H/89H) and “MOV mem, imm” (Opcode C6H/C7H) instructions. In these 
cases, the XRELEASE is recognized without the presence of the LOCK prefix. 


The lock variables must satisfy the guidelines described in Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1, Section 16.3.3, for elision to be successful, otherwise an HLE abort may be signaled. 


If an encoded byte sequence that meets XACQUIRE/XRELEASE requirements includes both prefixes, then the HLE 
semantic is determined by the prefix byte that is placed closest to the instruction opcode. For example, an F3F2C6 
will not be treated as a XRELEASE-enabled instruction since the F2H (XACQUIRE) is closest to the instruction 
opcode C6. Similarly, an F2F3F0 prefixed instruction will be treated as a XRELEASE-enabled instruction since F3H 
(XRELEASE) is closest to the instruction opcode. 
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Intel 64 and IA-32 Compatibility 
The effect of the XACQUIRE/XRELEASE prefix hint is the same in non-64-bit modes and in 64-bit mode. 


For instructions that do not support the XACQUIRE hint, the presence of the F2H prefix behaves the same way as 
prior hardware, according to 


¢ REPNE/REPNZ semantics for string instructions, 

¢ Serve as SIMD prefix for legacy SIMD instructions operating on XMM register 
* Cause #UD if prepending the VEX prefix. 

¢ Undefined for non-string instructions or other situations. 


For instructions that do not support the XRELEASE hint, the presence of the F3H prefix behaves the same way as in 
prior hardware, according to 


® REP/REPE/REPZ semantics for string instructions, 

¢ Serve as SIMD prefix for legacy SIMD instructions operating on XMM register 
* Cause #UD if prepending the VEX prefix. 

¢ Undefined for non-string instructions or other situations. 


Operation 
XACQUIRE 
IF XACQUIRE-enabled instruction 
THEN 
IF (HLE_NEST_COUNT < MAX_HLE_NEST_COUNT) THEN 
HLE_NEST_COUNT++ 
IF (HLE_NEST_COUNT = 1) THEN 
HLE_ACTIVE := 1 
IF 64-bit mode 
THEN 
restartRIP := instruction pointer of the XACQUIRE-enabled instruction 
ELSE 
restartElP := instruction pointer of the XACQUIRE-enabled instruction 
Fl; 
Enter HLE Execution (* record register state, start tracking memory state *) 
Fl; (* HLE_NEST_COUNT = 1%) 
IF ElisionBufferAvailable 
THEN 
Allocate elision buffer 
Record address and data for forwarding and commit checking 
Perform elision 
ELSE 
Perform lock acquire operation transactionally but without elision 
Fl; 
ELSE (* HLE_NEST_COUNT = MAX_HLE_NEST_COUNT *) 
GOTO HLE_ABORT_PROCESSING 
Fl; 
ELSE 
Treat instruction as non-XACQUIRE F2H prefixed legacy instruction 
Fl; 
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XRELEASE 


IF XRELEASE-enabled instruction 
THEN 
IF (HLE_LNEST_COUNT > 0) 
THEN 
HLE_NEST_COUNT-- 
IF lock address matches in elision buffer THEN 
IF lock satisfies address and value requirements THEN 
Deallocate elision buffer 
ELSE 
GOTO HLE_ABORT_PROCESSING 
Fl; 
Fl; 
IF (HLE_LNEST_COUNT = 0) 
THEN 
IF NoAllocatedElisionBuffer 
THEN 
Try to commit transactional execution 
IF fail to commit transactional execution 
THEN 
GOTO HLE_ABORT_PROCESSING; 
ELSE (* commit success *) 
HLE_ACTIVE := 0 
Fl; 
ELSE 
GOTO HLE_ABORT_PROCESSING 
Fl; 
Fl; 
Fl; (* HLE_NEST_COUNT > 0 *) 
ELSE 
Treat instruction as non-XRELEASE F3H prefixed legacy instruction 
Fl; 


(* For any HLE abort condition encountered during HLE execution *) 
HLE_ABORT_PROCESSING: 
HLE_ACTIVE := 0 
HLE_NEST_COUNT := 0 
Restore architectural register state 
Discard memory updates performed in transaction 
Free any allocated lock elision buffers 
IF 64-bit mode 
THEN 
RIP := restartRIP 
ELSE 
EIP := restartElP 
Fl; 
Execute and retire instruction at RIP (or EIP) and ignore any HLE hint 
END 
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INSTRUCTION SET REFERENCE, V-Z 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
#GP(0) If the use of prefix causes instruction length to exceed 15 bytes. 
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XABORT — Transactional Abort 


Opcode/Instruction Op/ | 64/32bit | CPUID Description 
En Mode Feature 
Support | Flag 
C6 F8 ib A VIV RTM Causes an RTM abort if in RTM execution 
XABORT imm8 


Instruction Operand Encoding 


Op/En Operand 1 Operand2 Operand3 Operand4 
A imm8 NA NA NA 
Description 


XABORT forces an RTM abort. Following an RTM abort, the logical processor resumes execution at the fallback 
address computed through the outermost XBEGIN instruction. The EAX register is updated to reflect an XABORT 
instruction caused the abort, and the imm8 argument will be provided in bits 31:24 of EAX. 


Operation 
XABORT 
IF RTM_ACTIVE = 0 
THEN 
Treat as NOP; 
ELSE 
GOTO RTM_ABORT_PROCESSING; 
Fl; 


(* For any RTM abort condition encountered during RTM execution *) 
RTM_ABORT_PROCESSING: 
Restore architectural register state; 
Discard memory updates performed in transaction; 
Update EAX with status and XABORT argument; 
RTM_NEST_COUNT:= 0; 
RTM_ACTIVE:= 0; 
IF 64-bit Mode 
THEN 
RIP:= fallbackRIP; 
ELSE 
EIP := fallbackEIP; 
Fl; 
END 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 
XABORT: void _xabort( unsigned int); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11] = 0. 
If LOCK prefix is used. 
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XADD—€xchange and Add 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 

En |Mode Leg Mode 
OF CO /r XADD r/m8&, r8 MR | Valid Valid Exchange r8 and r/m8&; load sum into r/m8. 
REX + OF CO /r XADD r/m8*, r8* MR | Valid N.E. Exchange r8 and r/m8; load sum into r/m8. 
OF C1 /r XADD r/m16, r16 MR | Valid Valid Exchange r76 and r/m16; load sum into r/m76. 
OF C1 /r XADD r/m32, r32 MR | Valid Valid Exchange r32 and r/m32,; load sum into r/m32. 
REX.W + OF C1 /r XADD r/m64, r64 MR | Valid N.E. Exchange r64 and r/m64; load sum into r/m64. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
MR ModRM:r/m (r, w) ModRM:reg (r, w) NA NA 
Description 


Exchanges the first operand (destination operand) with the second operand (source operand), then loads the sum 
of the two values into the destination operand. The destination operand can be a register or a memory location; the 
source operand is a register. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 


IA-32 Architecture Compatibility 


IA-32 processors earlier than the Intel486 processor do not recognize this instruction. If this instruction is used, 
you should provide an equivalent code sequence that runs on earlier processors. 


Operation 


TEMP := SRC + DEST; 
SRC := DEST; 
DEST := TEMP; 


Flags Affected 


The CF, PF, AF, SF, ZF, and OF flags are set according to the result of the addition, which is stored in the destination 
operand. 


Protected Mode Exceptions 

#GP(0) If the destination is located in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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Opcode/Instruction Op/ | 64/32bit | CPUID Description 
En Mode Feature 
Support | Flag 

C7 F8 A VIN RTM Specifies the start of an RTM region. Provides a 16-bit relative 
XBEGIN rel16 offset to compute the address of the fallback instruction address at 

which execution resumes following an RTM abort. 
C7 F8 A VIV RTM Specifies the start of an RTM region. Provides a 32-bit relative 
XBEGIN rel32 offset to compute the address of the fallback instruction address at 

which execution resumes following an RTM abort. 

Instruction Operand Encoding 
Op/En Operand 1 Operand2 Operand3 Operand4 
A Offset NA NA NA 
Description 


The XBEGIN instruction specifies the start of an RTM code region. If the logical processor was not already in trans- 
actional execution, then the XBEGIN instruction causes the logical processor to transition into transactional execu- 
tion. The XBEGIN instruction that transitions the logical processor into transactional execution is referred to as the 
outermost XBEGIN instruction. The instruction also specifies a relative offset to compute the address of the fallback 
code path following a transactional abort. (Use of the 16-bit operand size does not cause this address to be trun- 


cated to 16 bits, unlike a near jump to a relative offset.) 


On an RTM abort, the logical processor discards all architectural register and memory updates performed during 
the RTM execution and restores architectural state to that corresponding to the outermost XBEGIN instruction. The 


fallback address following an abort is computed from the outermost XBEGIN instruction. 


Operation 
XBEGIN 
IF RTM_NEST_COUNT < MAX_RTM_NEST_COUNT 
THEN 
RTM_NEST_COUNT++ 
IF RTM_NEST_COUNT = 1 THEN 
IF 64-bit Mode 
THEN 
IF OperandSize = 16 
THEN fallbackRIP := RIP + SignExtend64(rel1 6); 
ELSE fallbackRIP := RIP + SignExtend64(rel32); 


Fl; 
IF fallbackRIP is not canonical 
THEN #GP(0); 
Fl; 
ELSE 


IF OperandSize = 16 
THEN fallbackEIP := EIP + Sign€xtend32(rel16); 
ELSE fallbackElP := EIP + rel32; 


Fl; 
IF fallbackEIP outside code segment limit 
THEN #GP(0); 
Fl; 
Fl; 
RTM_ACTIVE := 1 


Enter RTM Execution (* record register state, start tracking memory state*) 
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Fl; (* RTM_NEST_COUNT = 1 *) 
ELSE (* RTM_NEST_COUNT = MAX_RTM_NEST_COUNT *) 
GOTO RTM_ABORT_PROCESSING 
Fl; 


(* For any RTM abort condition encountered during RTM execution *) 
RTM_ABORT_PROCESSING: 
Restore architectural register state 
Discard memory updates performed in transaction 
Update EAX with status 
RTM_NEST_COUNT := 0 
RTM_ACTIVE := 0 
IF 64-bit mode 
THEN 
RIP := fallbackRIP 
ELSE 
EIP := fallbackEIP 
Fl; 
END 


Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 
XBEGIN: — unsigned int __xbegin( void ); 


SIMD Floating-Point Exceptions 
None 


Protected Mode Exceptions 


#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0. 
If LOCK prefix is used. 
#GP(0) If the fallback address is outside the CS segment. 


Real-Address Mode Exceptions 
#GP(0) If the fallback address is outside the address space OOOOH and FFFFH. 
#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0. 

If LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) If the fallback address is outside the address space OOOOH and FFFFH. 
#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0. 

If LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 
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64-bit Mode Exceptions 


#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11] = 0. 
If LOCK prefix is used. 
#GP(0) If the fallback address is non-canonical. 
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XCHG—Exchange Register/Memory with Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

90+rw XCHG AX, r16 6) Valid Valid Exchange r76 with AX. 

90+rw XCHG r16, AX 6) Valid Valid Exchange AX with r76. 

90+rd XCHG EAX, r32 6) Valid Valid Exchange r32 with EAX. 

REX.W + 90+rd XCHG RAX, r64 6) Valid N.E. Exchange r64 with RAX. 

90+rd XCHG r32, EAX 6) Valid Valid Exchange EAX with r32. 

REX.W + 90+rd XCHG r64, RAX ¢) Valid N.E. Exchange RAX with r64. 

86 /r XCHG r/m8, r8 MR | Valid Valid Exchange r& (byte register) with byte from 
r/m8. 

REX + 86 /r XCHG r/m8&*, r8* MR | Valid N.E. Exchange r& (byte register) with byte from 
r/mé. 

86 /r XCHG r8, r/m8 RM _ | Valid Valid Exchange byte from r/m8 with r8 (byte 
register). 

REX + 86 /r XCHG r8*, r/m8* RM | Valid N.E. Exchange byte from r/m8 with r8 (byte 
register). 

87 /r XCHG r/m16, r16 MR | Valid Valid Exchange r76 with word from r/m16. 

87 /r XCHG 16, r/m16 RM | Valid Valid Exchange word from r/m176 with r76. 

87 /r XCHG r/m32, r32 MR | Valid Valid Exchange r32 with doubleword from r/m32. 

[REXW+87/r ~—~—s*«(|XCHGr/m64,r64——itsé«<*STMRRs«*| Walid «= (NE. ~—_| Exchange r64 with quadword from r/m64._—i 
87 /r XCHG r32, r/m32 RM | Valid Valid Exchange doubleword from r/m32 with r32. 
[REXW+87/r ——S«(|XCHGr64,r/m64——(tsé«**RM«Sd( Valid «= (NE. ~—_| Exchange quadword from r/m64 with 64. _—| 
NOTES: 


* |n 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
6) AX/EAX/RAX (r, w) opcode + rd (r, w) NA NA 
6) opcode + rd (r, w) AX/EAX/RAX (r, w) NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
RM ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Exchanges the contents of the destination (first) and source (second) operands. The operands can be two general- 
purpose registers or a register and a memory location. If a memory operand is referenced, the processor’s locking 
protocol is automatically implemented for the duration of the exchange operation, regardless of the presence or 
absence of the LOCK prefix or of the value of the IOPL. (See the LOCK prefix description in this chapter for more 
information on the locking protocol.) 


This instruction is useful for implementing semaphores or similar data structures for process synchronization. (See 
“Bus Locking” in Chapter 8 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for 
more information on bus locking.) 


The XCHG instruction can also be used instead of the BSWAP instruction for 16-bit operands. 


In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits 
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See 
the summary chart at the beginning of this section for encoding data and limits. 
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NOTE 


XCHG (E)AX, (E)AX (encoded instruction byte is 90H) is an alias for NOP regardless of data size 
prefixes, including REX.W. 


Operation 


TEMP := DEST; 
DEST := SRC; 
SRC := TEMP; 


Flags Affected 
None. 


Protected Mode Exceptions 

#GP(0) If either operand is in a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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XEND — Transactional End 


Opcode/Instruction Op/ | 64/32bit | CPUID Description 
En Mode Feature 
Support | Flag 
NP OF 01 D5 A VN RTM Specifies the end of an RTM code region. 
XEND 


Instruction Operand Encoding 


Op/En Operand 1 Operand2 Operand3 Operand4 
A NA NA NA NA 
Description 


The instruction marks the end of an RTM code region. If this corresponds to the outermost scope (that is, including 
this XEND instruction, the number of XBEGIN instructions is the same as number of XEND instructions), the logical 
processor will attempt to commit the logical processor state atomically. If the commit fails, the logical processor will 
rollback all architectural register and memory updates performed during the RTM execution. The logical processor 
will resume execution at the fallback address computed from the outermost XBEGIN instruction. The EAX register 
is updated to reflect RTM abort information. 


XEND executed outside a transactional region will cause a #GP (General Protection Fault). 


Operation 
XEND 
IF (RTM_ACTIVE = 0) THEN 
SIGNAL #GP 
ELSE 
RTM_NEST_COUNT-- 
IF (RTM_NEST_COUNT = 0) THEN 
Try to commit transaction 
IF fail to commit transactional execution 
THEN 
GOTO RTM_ABORT_PROCESSING; 
ELSE (* commit success *) 
RTM_ACTIVE := 0 
Fl; 
Fl; 
Fl; 


(* For any RTM abort condition encountered during RTM execution *) 
RTM_ABORT_PROCESSING: 
Restore architectural register state 
Discard memory updates performed in transaction 
Update EAX with status 
RTM_NEST_COUNT := 0 
RTM_ACTIVE := 0 
IF 64-bit Mode 
THEN 
RIP := fallbackRIP 
ELSE 
EIP := fallbackElP 
Fl; 
END 
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Flags Affected 
None 


Intel C/C++ Compiler Intrinsic Equivalent 
XEND: void _xend( void ); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


#UD CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11] = 0. 
If LOCK prefix is used. 
#GP(0) If RTM_ACTIVE = 0. 
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XGETBV—Get Value of Extended Control Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
NP OF 01 DO XGETBV ZO | Valid Valid Reads an XCR specified by ECX into EDX:EAX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Reads the contents of the extended control register (XCR) specified in the ECX register into registers EDX:EAX. (On 
processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The EDX register is 
loaded with the high-order 32 bits of the XCR and the EAX register is loaded with the low-order 32 bits. (On proces- 
sors that support the Intel 64 architecture, the high-order 32 bits of each of RAX and RDX are cleared.) If fewer 
than 64 bits are implemented in the XCR being read, the values returned to EDX:EAX in unimplemented bit loca- 
tions are undefined. 


XCRO is supported on any processor that supports the XGETBV instruction. If 
CPUID.(EAX=0DH,ECX=1):EAX.XG1[bit 2] = 1, executing XGETBV with ECX = 1 returns in EDX:EAX the logical- 
AND of XCRO and the current value of the XINUSE state-component bitmap. This allows software to discover the 
state of the init optimization used by XSAVEOPT and XSAVES. See Chapter 13, “Managing State Using the XSAVE 
Feature Set,” in Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1. 


Use of any other value for ECX results in a general-protection (#GP) exception. 


Operation 
EDX:EAX := XCR[ECX]; 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XGETBV: unsigned __int64 _xgetbv( unsigned int); 


Protected Mode Exceptions 


#GP(0) If an invalid XCR is specified in ECX (includes ECX = 1 if 
CPUID.(EAX=0DH,ECX=1):EAX.XGi[bit 2] = 0). 
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) If an invalid XCR is specified in ECX (includes ECX = 1 if 
CPUID.(EAX=0DH,ECX=1):EAX.XGi[bit 2] = 0). 
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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XLAT/XLATB—Table Look-up Translation 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 

D7 XLAT m8 ZO | Valid Valid Set AL to memory byte DS:[(€)BX + unsigned 
AL]. 

D7 XLATB ZO | Valid Valid Set AL to memory byte DS:[(€)BX + unsigned 
AL]. 

REX.W + D7 XLATB ZO | Valid N.E. Set AL to memory byte [RBX + unsigned AL]. 

Instruction Operand Encoding 
Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Locates a byte entry in a table in memory, using the contents of the AL register as a table index, then copies the 
contents of the table entry back into the AL register. The index in the AL register is treated as an unsigned integer. 
The XLAT and XLATB instructions get the base address of the table in memory from either the DS:EBX or the DS:BX 
registers (depending on the address-size attribute of the instruction, 32 or 16, respectively). (The DS segment may 
be overridden with a segment override prefix.) 


At the assembly-code level, two forms of this instruction are allowed: the “explicit-operand” form and the “no- 
operand” form. The explicit-operand form (specified with the XLAT mnemonic) allows the base address of the table 
to be specified explicitly with a symbol. This explicit-operands form is provided to allow documentation; however, 
note that the documentation provided by this form can be misleading. That is, the symbol does not have to specify 
the correct base address. The base address is always specified by the DS:(E)BX registers, which must be loaded 
correctly before the XLAT instruction is executed. 


The no-operands form (XLATB) provides a “short form” of the XLAT instructions. Here also the processor assumes 
that the DS:(E)BX registers contain the base address of the table. 


In 64-bit mode, operation is similar to that in legacy or compatibility mode. AL is used to specify the table index 
(the operand size is fixed at 8 bits). RBX, however, is used to specify the table’s base address. See the summary 
chart at the beginning of this section for encoding data and limits. 


Operation 


IF AddressSize = 16 
THEN 
AL:= (DS:BX + ZeroExtend(AL)); 
ELSE IF (AddressSize = 32) 
AL:= (DS:EBX + ZeroExtend(AL)); FI; 
ELSE (AddressSize = 64) 
AL:= (RBX + ZeroExtend(AL)); 
FI; 


Flags Affected 
None. 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 


#PF(fault-code) If a page fault occurs. 
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#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#UD If the LOCK prefix is used. 
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INSTRUCTION SET 


XOR—Logical 


REFERENCE, V-Z 


Exclusive OR 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
34 ib XOR AL, imm8 | Valid Valid AL XOR immé. 
35 iw XOR AX, imm16 | Valid Valid AX XOR imm76. 
35 id XOR EAX, imm32 | Valid Valid EAX XOR imm32. 
REX.W + 35 id XOR RAX, imm32 | Valid N.E. RAX XOR imm32 (sign-extended). 
80 /6 ib XOR r/m8, imm8 MI | Valid Valid r/m8 XOR immé. 
REX + 80 /6 ib XOR r/m8*, imm8 MI | Valid N.E. r/m8 XOR immé. 
81 /6 iw XOR r/m16, imm16 MI | Valid Valid r/m16 XOR imm176. 
81 /6 id XOR r/m32, imm32 MI | Valid Valid r/m32 XOR imm3z2. 
REX.W + 81 /6 id XOR r/m64, imm32 MI | Valid N.E. r/m64 XOR imm32 (sign-extended). 
83 /6 ib XOR r/m16, imm8 MI | Valid Valid r/m16 XOR imm6 (sign-extended). 
83 /6 ib XOR r/m32, imm8 MI | Valid Valid r/m32 XOR imm8 (sign-extended). 
REX.W + 83 /6 ib XOR r/m64, imm8 MI | Valid N.E. r/m64 XOR imm8 (sign-extended). 
30 /r XOR r/m8, r8 MR | Valid Valid r/m8 XOR r8. 
REX + 30 /r XOR r/m8*, r8* MR | Valid N.E. r/m8 XOR r8. 
31/r XOR r/m16, r16 MR | Valid Valid r/m16 XOR r16. 
31/r XOR r/m32, r32 MR | Valid Valid r/m32 XOR r32. 
REX.W + 31 /r XOR r/m64, r64 MR | Valid N.E. r/m64 XOR r64. 
32 /r XOR r8, r/m8 RM_ | Valid Valid r8 XOR r/mé. 
REX + 32 /r XOR r8*, r/m8* RM_ | Valid N.E. r8 XOR r/mé. 
33 /r XOR r76, r/m16 RM_ | Valid Valid r16 XOR r/m16. 
33 /r XOR r32, r/m32 RM_ | Valid Valid r32 XOR r/m32. 
REX.W + 33 /r XOR r64, r/m64 RM_ | Valid N.E. r64 XOR r/m64. 
NOTES: 


* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
| AL/AX/EAX/RAX imm8/16/32 NA NA 
MI ModRM:r/m (r, w) imm8/16/32 NA NA 
MR ModRM:r/m (r, w) ModRM:reg (r) NA NA 
RM ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Performs a bitwise exclusive OR (XOR) operation on the destination (first) and source (second) operands and 
stores the result in the destination operand location. The source operand can be an immediate, a register, or a 
memory location; the destination operand can be a register or a memory location. (However, two memory oper- 
ands cannot be used in one instruction.) Each bit of the result is 1 if the corresponding bits of the operands are 
different; each bit is 0 if the corresponding bits are the same. 


This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. 
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In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). Using a 
REX prefix in the form of REX.W promotes operation to 64 bits. See the summary chart at the beginning of this 
section for encoding data and limits. 


Operation 
DEST := DEST XOR SRC; 


Flags Affected 


The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is 
undefined. 


Protected Mode Exceptions 

#GP(0) If the destination operand points to a non-writable segment. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If the DS, ES, FS, or GS register contains a NULL segment selector. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Real-Address Mode Exceptions 


#GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS If a memory operand effective address is outside the SS segment limit. 
#UD If the LOCK prefix is used but the destination is not a memory operand. 


Virtual-8086 Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 

#GP(0) If the memory address is in a non-canonical form. 

#PF(fault-code) If a page fault occurs. 

#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the 
current privilege level is 3. 

#UD If the LOCK prefix is used but the destination is not a memory operand. 
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XORPD—Bitwise Logical XOR of Packed Double Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 

Support | Flag 
66 OF 57/r A VIV SSE2 Return the bitwise logical XOR of packed double- 
XORPD xmm1, xmm2/m128 precision floating-point values in xmm1 and xmm2/mem. 
VEX.128.66.0F.WIG 57 /r B VIV AVX Return the bitwise logical XOR of packed double- 
VXORPD xmm1,xmmz, precision floating-point values in xmm2 and xmm3/mem. 
xmm3/m128 
VEX.256.66.0F.WIG 57 /r B VIV AVX Return the bitwise logical XOR of packed double- 
VXORPD ymm1, ymme2, precision floating-point values in ymm2 and ymm3/mem. 
ymm3/m256 
EVEX.128.66.0F.W1 57 /r C VIV AVX512VL_ | Return the bitwise logical XOR of packed double- 
VXORPD xmm1 {k1}{z}, xmm2, AVX512DQ | precision floating-point values in xmm2 and 
xmm3/m1 28/m64bcst xmm3/m128/m64bcst subject to writemask k1. 
EVEX.256.66.0F.W1 57 /r C VIV AVX512VL_ | Return the bitwise logical XOR of packed double- 
VXORPD ymm1 {k1}{z}, ymm2, AVX512DQ_ | precision floating-point values in ymme2 and 
ymm3/m256/m64bcst ymm3/m256/m64bcst subject to writemask k1. 
EVEX.512.66.0F.W1 57 /r C VIN AVX512DQ_ | Return the bitwise logical XOR of packed double- 
VXORPD zmm1 {k1}{z}, zmm2, precision floating-point values in zmm2 and 
zmm3/m512/m64bcst zmm3/m512/m64bcst subject to writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical XOR of the two, four or eight packed double-precision floating-point values from the first 
source operand and the second source operand, and stores the result in the destination operand. 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand can be a ZMM 
register or a vector memory location. The destination operand is a ZMM register conditionally updated with 
writemask k1. 


VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand 
is a YMM register or a 256-bit memory location. The destination operand is a YMM register (conditionally updated 
with writemask k1 in case of EVEX). The upper bits (MAXVL-1:256) of the corresponding ZMM register destination 
are zeroed. 


VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand 
is an XMM register or 128-bit memory location. The destination operand is an XMM register (conditionally updated 
with writemask k1 in case of EVEX). The upper bits (MAXVL-1:128) of the corresponding ZMM register destination 
are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VXORPD (EVEX encoded versions) 
(KL, VL) = (2, 128), (4, 256), (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN DEST[i+63:i] = SRC1[i+63:i] BITWISE XOR SRC2[63:0]; 
ELSE DEST[i+63:i] := SRC1[i+63:i] BITWISE XOR SRC2[i+63:i); 


Fl; 
ELSE 

IF *merging-masking* ; Merging-masking 
THEN *DEST{[i+63:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+63:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VXORPD (VEX.256 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE XOR SRC2[1 27:64] 
DEST[191:128] := SRC1[191:128] BITWISE XOR SRC2[191:128] 
DEST[255:192] := SRC1[255:192] BITWISE XOR SRC2[255:192] 
DEST[MAXVL-1:256] := 0 


VXORPD (VEX.128 encoded version) 

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0] 
DEST[127:64] := SRC1[127:64] BITWISE XOR SRC2[1 27:64] 
DEST[MAXVL-1:128] := 0 


XORPD (128-bit Legacy SSE version) 

DEST[63:0] := DEST[63:0] BITWISE XOR SRC[63:0] 
DEST[127:64] := DEST[127:64] BITWISE XOR SRC[127:64] 
DEST[MAXVL-1:1 28] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VXORPD __m512d_mm512_xor_pd (__m512d a,__m512db); 


VXORPD __m512d_mm512_mask_xor_pd (__m512d a,__ mmask8 m,___m512d b); 


VXORPD __m512d_mm512_maskz_xor_pd (__mmask8 m, ___m512d a); 
VXORPD __m256d_mm256_xor_pd (__m256d a,___ m256d b); 
VXORPD __m256d__mm256_mask_xor_pd (__m256d a, ___mmask8 m, 
VXORPD __m256d_mm256_maskz_xor_pd (__mmask8 m, __m256d a); 
XORPD __m128d _mm_xor_pd (__m128d a, ___m128d b); 

VXORPD __m128d_mm_mask_xor_pd (__m128d a,___mmask8 m, __m128d b); 
VXORPD __m128d __mm_maskz_xor_pd (__mmask8 m, __m128d a); 


SIMD Floating-Point Exceptions 
None 
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Other Exceptions 
Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions”. 
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XORPS—Bitwise Logical XOR of Packed Single Precision Floating-Point Values 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
NP OF 57 /r A VV SSE Return the bitwise logical XOR of packed single- 
XORPS xmm1, xmm2/m128 precision floating-point values in xmm1 and 
xmm2/mem. 
VEX.128.0F.WIG 57 /r B VIN AVX Return the bitwise logical XOR of packed single- 
VXORPS xmm1,xmm_2, xmm3/m128 precision floating-point values in xmm2 and 
xmm3/mem. 
VEX.256.0F.WIG 57 /r B VIN AVX Return the bitwise logical XOR of packed single- 
VXORPS ymm1, ymm2, ymm3/m256 precision floating-point values in ymm2 and 
ymm3/mem. 
EVEX.128.0F.WO 57 /r C VV AVX512VL_ | Return the bitwise logical XOR of packed single- 
VXORPS xmm1 {k1}{z}, xmm2, AVX512DQ_ | precision floating-point values in xmm2 and 
xmm3/m128/m32bcst xmm3/m128/m32bcst subject to writemask k1. 
EVEX.256.0F.WO 57 /r C VV AVX512VL_ | Return the bitwise logical XOR of packed single- 
VXORPS ymm1 {k1}{z}, ymm2, AVX512DQ_ | precision floating-point values in ymme2 and 
ymm3/m256/m32bcst ymm3/m256/m32bcst subject to writemask k1. 
EVEX.512.0F.W0 57 /r C VV AVX512DQ_ | Return the bitwise logical XOR of packed single- 
VXORPS zmm1 {k1}{z}, zmm2, precision floating-point values in zmm2 and 
zmm3/m512/m32bcst zmm3/m512/m32bcst subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A NA ModRM:reg (r, w) ModRM:r/m (r) NA NA 
B NA ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) NA 
C Full ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Performs a bitwise logical XOR of the four, eight or sixteen packed single-precision floating-point values from the 
first source operand and the second source operand, and stores the result in the destination operand 


EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand can be a ZMM 
register or a vector memory location. The destination operand is a ZMM register conditionally updated with 
writemask k1. 


VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand 
is a YMM register or a 256-bit memory location. The destination operand is a YMM register (conditionally updated 
with writemask k1 in case of EVEX). The upper bits (MAXVL-1:256) of the corresponding ZMM register destination 
are zeroed. 


VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand 
is an XMM register or 128-bit memory location. The destination operand is an XMM register (conditionally updated 
with writemask k1 in case of EVEX). The upper bits (MAXVL-1:128) of the corresponding ZMM register destination 
are zeroed. 


128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti- 
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding 
register destination are unmodified. 
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Operation 


VXORPS (EVEX encoded versions) 
(KL, VL) = (4, 128), (8, 256), (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b == 1) AND (SRC2 *is memory*) 
THEN DEST[i+31:i] = SRC1[i+31:i] BITWISE XOR SRC2[3 1:0); 
ELSE DEST[i+31:i] := SRC1[i+31:i] BITWISE XOR SRC2[i+3 1:1]; 


Fl; 
ELSE 

IF *merging-masking* ; merging-masking 
THEN *DEST{[i+31:i] remains unchanged* 
ELSE *zeroing-masking* ; zeroing-masking 

DEST[i+31:i] = 0 
Fl 
Fl; 
ENDFOR 


DEST[MAXVL-1:VL] := 0 


VXORPS (VEX.256 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[127:96] 
DEST[159:128] := SRC1[159:128] BITWISE XOR SRC2[159:128] 
DEST[191:160] := SRC1[191:160] BITWISE XOR SRC2[191:160] 
DEST[223:192] := SRC1[223:192] BITWISE XOR SRC2[223:192] 
DEST[255:224] := SRC1[255:224] BITWISE XOR SRC2[255:224]. 
DEST[MAXVL-1:256] := 0 


VXORPS (VEX.128 encoded version) 

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[127:96] 
DEST[MAXVL-1:128] := 0 


XORPS (128-bit Legacy SSE version) 

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0] 
DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32] 
DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64] 
DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[1 27:96] 
DEST[MAXVL-1:128] (Unmodified) 


Intel C/C++ Compiler Intrinsic Equivalent 


VXORPS __m512_mm512_xor_ps (_m512a,__m512 b); 
VXORPS __m512_mm512_mask_xor_ps (__m512 a,__mmask16 m,__m512 b); 
VXORPS __m512_mm512_maskz_xor_ps (__mmask16 m, ___m512 a); 

VXORPS __m256 _mm256_xor_ps (_m256 a,__m256 b); 

VXORPS __m256 __mm256_mask_xor_ps (__m256 a,___ mmask8 m,__m256 b); 
VXORPS __m256 __mm256_maskz_xor_ps (__mmask8 m, __m256 a); 

XORPS __m128_mm_xor_ps (__m128 a,__m128 b); 

VXORPS __m128 _mm_mask_xor_ps (__m128 a,__mmask8 m, 


m128 b); 
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VXORPS __m128 __mm_maskz_xor_ps (__mmask8 m, __m128 a); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 


Non-EVEX-encoded instructions, see Table 2-21, “Type 4 Class Exception Conditions”. 
EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions”. 
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XRSTOR—Restore Processor Extended States 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF AE/5 M VIV XSAVE Restore state components specified by EDX:EAX from 
XRSTOR mem mem. 
NP REX.W + OF AE/5 M V/N.E. XSAVE Restore state components specified by EDX:EAX from 
XRSTOR64 mem Mem. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Performs a full or partial restore of processor state components from the XSAVE area located at the memory 
address specified by the source operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. The 
specific state components restored correspond to the bits set in the requested-feature bitmap (RFBM), which is the 
logical-AND of EDX:EAX and XCRO. 


The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte!® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FXRSTOR and FXSAVE, the memory format used for x87 state depends 
on a REX.W prefix; see Section 13.5.1, “x87 State” of Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.8, “Operation of XRSTOR,” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 

1 provides a detailed description of the operation of the XRSTOR instruction. The following items provide a high- 

level outline: 

° Execution of XRSTOR may take one of two forms: standard and compacted. Bit 63 of the XCOMP_BV field in the 
XSAVE header determines which form is used: value 0 specifies the standard form, while value 1 specifies the 
compacted form. 


* If RFBM[/] = 0, XRSTOR does not update state component i.! 

¢ If RFBM[/] = 1 and bit / is clear in the XSTATE_BV field in the XSAVE header, XRSTOR initializes state 
component /. 

e If RFBM[/] = 1 and XSTATE_BV[/] = 1, XRSTOR loads state component j from the XSAVE area. 

¢ The standard form of XRSTOR treats MXCSR (which is part of state component 1 — SSE) differently from the 


XMM registers. If either form attempts to load MXCSR with an illegal value, a general-protection exception 
(#GP) occurs. 


¢ XRSTOR loads the internal value XRSTOR_INFO, which may be used to optimize a subsequent execution of 
XSAVEOPT or XSAVES. 


* Immediately following an execution of XRSTOR, the processor tracks as in-use (not in initial configuration) any 
state component / for which RFBM[/] = 1 and XSTATE_BV[/] = 1; it tracks as modified any state component 
i for which RFBM[/] = 0. 
Use of a source operand not aligned to 64-byte boundary (for 64-bit and 32-bit modes) results in a general-protec- 
tion (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


See Section 13.6, “Processor Tracking of XSAVE-Managed State,” of Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1 for discussion of the bitmaps XINUSE and XMODIFIED and of the quantity 
XRSTOR_INFO. 


1. There is an exception if RFBM[1] = 0 and RFBM[2] = 1. In this case, the standard form of XRSTOR will load MXCSR from memory, 
even though MXCSR is part of state component 1 — SSE. The compacted form of XRSTOR does not make this exception. 
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Operation 


RFBM := XCRO AND EDX:EAX; /* bitwise logical AND */ 
COMPMASK := XCOMP_BV field from XSAVE header; 
RSTORMASK := XSTATE_BV field from XSAVE header; 


IF COMPMASK[63] = 0 
THEN 
/* Standard form of XRSTOR */ 
TO_BE_RESTORED := RFBM AND RSTORMASK; 
TO_BE_INITIALIZED := RFBM AND NOT RSTORMASK; 


IF TO_BE_RESTORED[O] = 1 
THEN 
XINUSE[0] := 1; 
load x87 state from legacy region of XSAVE area; 
ELSIF TO_BE_INITIALIZED[O] = 1 
THEN 
XINUSE[0] := 0; 
initialize x87 state; 
Fl; 


IF RFBM[1] = 1 OR RFBM[2] = 1 
THEN load MXCSR from legacy region of XSAVE area; 
Fl; 


IF TO_BE_RESTORED[1] = 1 
THEN 
XINUSE[1] := 1; 
load XMM registers from legacy region of XSAVE area; // this step does not load MXCSR 
ELSIF TO_BE_INITIALIZED[1] = 1 


THEN 
XINUSE[1] := 0; 
set all XMM registers to 0; // this step does not initialize MXCSR 
Fl; 
FOR i:= 2 TO62 
IF TO_BE_RESTORED[i] = 1 
THEN 
XINUSE[i] := 1; 
load XSAVE state component i at offset n from base of XSAVE area; 
//n enumerated by CPUID(EAX=ODH,ECX=i):EBX) 
ELSIF TO_BE_INITIALIZED[i] = 1 
THEN 
XINUSE[i] := 0; 
initialize XSAVE state component i; 
Fl; 
ENDFOR; 
ELSE 


/* Compacted form of XRSTOR */ 
IF CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0 
THEN  /* compacted form not supported */ 
#GP(0); 
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Fl; 


FORMAT = COMPMASK AND 7FFFFFFF_FFFFFFFFH; 
RESTORE_FEATURES = FORMAT AND RFBM; 

TO_BE_RESTORED := RESTORE_FEATURES AND RSTORMASK; 
FORCE_INIT := RFBM AND NOT FORMAT; 

TO_BE_INITIALIZED = (RFBM AND NOT RSTORMASK) OR FORCE_INIT; 


IF TO_BE_RESTORED[O] = 1 
THEN 
XINUSE[0] := 1; 
load x87 state from legacy region of XSAVE area; 
ELSIF TO_BE_INITIALIZED[O] = 1 
THEN 
XINUSE[0] := 0; 
initialize x87 state; 
Fl; 


IF TO_BE_RESTORED[1] = 1 
THEN 
XINUSE[1] := 1; 
load SSE state from legacy region of XSAVE area; // this step loads the XMM registers and MXCSR 
ELSIF TO_BE_INITIALIZED[1] = 1 


THEN 
set all XMM registers to O; 
XINUSE[1] := 0; 
MXCSR := 1F80H; 
Fl; 
NEXT_FEATURE_OFFSET = 576; // Legacy area and XSAVE header consume 576 bytes 
FOR i := 2 TO 62 
IF FORMAT[i] = 1 
THEN 
IF TO_BE_RESTORED[i] = 1 
THEN 
XINUSE[i] := 1; 
load XSAVE state component i at offset NEXT_FEATURE_OFFSET from base of XSAVE area; 
Fl; 
NEXT_FEATURE_OFFSET = NEXT_FEATURE_OFFSET + n(n enumerated by CPUID(EAX=0DH,ECX=i):EAX); 
Fl; 
IF TO_BE_INITIALIZED[i] = 1 
THEN 
XINUSE[i] := 0; 
initialize XSAVE state component i; 
Fl; 
ENDFOR; 


Fl; 

XMODIFIED := NOT RFBM; 

IF in VMX non-root operation 
THEN VMXNR := 1; 


ELSE VMXNR := 0; 
Fl; 
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LAXA := linear address of XSAVE area; 
XRSTOR_INFO := (CPL,|VMXNR,LAXA,COMPMASK); 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XRSTOR: void _xrstor( void *, unsigned __int64); 
XRSTOR: void _xrstor64( void * , unsigned __int64); 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 


#AC 


If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 


If bit 63 of the XCOMP_BV field of the XSAVE header is 1 and 
CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 


If the standard form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XSTATE_BV field of the XSAVE header is 1. 


If the standard form is executed and bytes 23:8 of the XSAVE header are not all zero. 

If the compacted form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XCOMP_BV field of the XSAVE header is 1. 

If the compacted form is executed and a bit in the XCOMP_BV field in the XSAVE header is 0 
and the corresponding bit in the XSTATE_BV field is 1. 

If the compacted form is executed and bytes 63:16 of the XSAVE header are not all zero. 

If attempting to write any reserved bits of the MXCSR register with 1. 

If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.O1H:ECX.XSAVE[bit 26] = 0. 

If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 

If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


Real-Address Mode Exceptions 


#GP 


If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 


If bit 63 of the XCOMP_BV field of the XSAVE header is 1 and 
CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 


If the standard form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XSTATE_BV field of the XSAVE header is 1. 


If the standard form is executed and bytes 23:8 of the XSAVE header are not all zero. 


If the compacted form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XCOMP_BV field of the XSAVE header is 1. 


XRSTOR—Restore Processor Extended States Vol.2C 5-633 


INSTRUCTION SET REFERENCE, V-Z 


#NM 
#UD 


If the compacted form is executed and a bit in the XCOMP_BV field in the XSAVE header is 0 
and the corresponding bit in the XSTATE_BV field is 1. 


If the compacted form is executed and bytes 63:16 of the XSAVE header are not all zero. 
If attempting to write any reserved bits of the MXCSR register with 1. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0. 

If CR4.0SXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 


#AC 
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If a memory address is in a non-canonical form. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 


If bit 63 of the XCOMP_BV field of the XSAVE header is 1 and 
CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 


If the standard form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XSTATE_BV field of the XSAVE header is 1. 


If the standard form is executed and bytes 23:8 of the XSAVE header are not all zero. 


If the compacted form is executed and a bit in XCRO is 0 and the corresponding bit in the 
XCOMP_BV field of the XSAVE header is 1. 


If the compacted form is executed and a bit in the XCOMP_BV field in the XSAVE header is 0 
and the corresponding bit in the XSTATE_BV field is 1. 


If the compacted form is executed and bytes 63:16 of the XSAVE header are not all zero. 
If attempting to write any reserved bits of the MXCSR register with 1. 

If a memory address referencing the SS segment is in a non-canonical form. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0. 

If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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XRSTORS—Restore Processor Extended States Supervisor 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF C7 /3 M VIV XSS Restore state components specified by EDX:EAX from 
XRSTORS mem mem. 
NP REX.W + OF C7 /3 M V/N.E. XSS Restore state components specified by EDX:EAX from 
XRSTORS64 mem mem. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Performs a full or partial restore of processor state components from the XSAVE area located at the memory 
address specified by the source operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. 
The specific state components restored correspond to the bits set in the requested-feature bitmap (RFBM), which 
is the logical-AND of EDX:EAX and the logical-OR of XCRO with the IA32_XSS MSR. XRSTORS may be executed only 
if CPL = 0. 

The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FKRSTOR and FXSAVE, the memory format used for x87 state depends 


on a REX.W prefix; see Section 13.5.1, “x87 State” of Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.12, “Operation of XRSTORS,” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1 provides a detailed description of the operation of the XRSTOR instruction. The following items provide a 
high-level outline: 


° Execution of XRSTORS is similar to that of the compacted form of XRSTOR; XRSTORS cannot restore from an 
XSAVE area in which the extended region is in the standard format (see Section 13.4.3, “Extended Region of an 
XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


¢ XRSTORS differs from XRSTOR in that it can restore state components corresponding to bits set in the 
IA32_XSS MSR. 


¢ If RFBM[/] = 0, XRSTORS does not update state component i. 


¢ If RFBM[/] = 1 and bit /is clear in the XSTATE_BV field in the XSAVE header, XRSTORS initializes state 
component /. 


¢ If RFBM[/] = 1 and XSTATE_BV[/] = 1, XRSTORS loads state component i from the XSAVE area. 
° If XRSTORS attempts to load MXCSR with an illegal value, a general-protection exception (#GP) occurs. 


¢ XRSTORS loads the internal value XRSTOR_INFO, which may be used to optimize a subsequent execution of 
XSAVEOPT or XSAVES. 


¢ Immediately following an execution of XRSTORS, the processor tracks as in-use (not in initial configuration) 
any state component / for which RFBM[/] = 1 and XSTATE_BV[/] = 1; it tracks as modified any state component 
i for which RFBM[/] = 0. 


Use of a source operand not aligned to 64-byte boundary (for 64-bit and 32-bit modes) results in a general-protec- 
tion (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


See Section 13.6, “Processor Tracking of XSAVE-Managed State,” of Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1 for discussion of the bitmaps XINUSE and XMODIFIED and of the quantity 
XRSTOR_INFO. 
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Operation 


RFBM := (XCRO OR IA32_XSS) AND EDX:EAX; /* bitwise logical OR and AND */ 
COMPMASK := XCOMP_BV field from XSAVE header; 
RSTORMASK := XSTATE_BV field from XSAVE header; 


FORMAT = COMPMASK AND 7FFFFFFF_FFFFFFFFH; 
RESTORE_FEATURES = FORMAT AND RFBM; 

TO_BE_RESTORED := RESTORE_FEATURES AND RSTORMASK; 
FORCE_INIT := RFBM AND NOT FORMAT; 

TO_BE_INITIALIZED = (RFBM AND NOT RSTORMASK) OR FORCE_INIT; 


IF TO_BE_RESTORED[O] = 1 
THEN 
XINUSE[0] := 1; 
load x87 state from legacy region of XSAVE area; 
ELSIF TO_BE_INITIALIZED[O] = 1 
THEN 
XINUSE[0] := 0; 
initialize x87 state; 
Fl; 


IF TO_BE_RESTORED[1] = 1 
THEN 
XINUSE[1] := 1; 
load SSE state from legacy region of XSAVE area; // this step loads the XMM registers and MXCSR 
ELSIF TO_BE_INITIALIZED[1] = 1 
THEN 
set all XMM registers to O; 
XINUSE[1] := 0; 
MXCSR := 1F80H; 
Fl; 


NEXT_FEATURE_OFFSET = 576; // Legacy area and XSAVE header consume 576 bytes 
FOR i :=2 TO 62 
IF FORMAT{Ii] = 1 
THEN 
IF TO_BE_RESTORED{i] = 1 
THEN 
XINUSE[i] := 1; 
load XSAVE state component i at offset NEXT_FEATURE_OFFSET from base of XSAVE area; 
Fl; 
NEXT_FEATURE_OFFSET = NEXT_FEATURE_OFFSET + n(n enumerated by CPUID(EAX=0DH,ECX=i):EAX); 
Fl; 
IF TO_BE_INITIALIZED[i] = 1 
THEN 
XINUSE[i] := 0; 
initialize XSAVE state component i; 
Fl; 
ENDFOR; 


XMODIFIED := NOT RFBM; 


IF in VMX non-root operation 
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THEN VMXNR := 1; 
ELSE VMXNR := 0; 


Fl; 
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LAXA := linear address of XSAVE area; 
XRSTOR_INFO := (CPL,|VMXNR,LAXA,COMPMASK); 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XRSTORS: — void _xrstors( void * , unsigned __int64); 
XRSTORS64: void _xrstors64( void * , unsigned __int64); 


Protected Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 


If CPL > O. 

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 

If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If bit 63 of the XCOMP_BV field of the XSAVE header is 0. 

If a bit in XCRO is 0 and the corresponding bit in the XCOMP_BV field of the XSAVE header is 1. 


If a bit in the XCOMP_BV field in the XSAVE header is 0 and the corresponding bit in the 
XSTATE_BV field is 1. 


If bytes 63:16 of the XSAVE header are not all zero. 

If attempting to write any reserved bits of the MXCSR register with 1. 

If a memory operand effective address is outside the SS segment limit. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.O1H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP 


#NM 
#UD 


If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If any part of the operand lies outside the effective address space from 0 to FFFFH. 

If bit 63 of the XCOMP_BV field of the XSAVE header is 0. 

If a bit in XCRO is 0 and the corresponding bit in the XCOMP_BV field of the XSAVE header is 1. 


If a bit in the XCOMP_BV field in the XSAVE header is 0 and the corresponding bit in the 
XSTATE_BV field is 1. 


If bytes 63:16 of the XSAVE header are not all zero. 

If attempting to write any reserved bits of the MXCSR register with 1. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 
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Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 
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If CPL > 0. 

If a memory address is in a non-canonical form. 

If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If bit 63 of the XCOMP_BV field of the XSAVE header is 0. 

If a bit in XCRO is 0 and the corresponding bit in the XCOMP_BV field of the XSAVE header is 1. 


If a bit in the XCOMP_BV field in the XSAVE header is 0 and the corresponding bit in the 
XSTATE_BV field is 1. 


If bytes 63:16 of the XSAVE header are not all zero. 

If attempting to write any reserved bits of the MXCSR register with 1. 

If a memory address referencing the SS segment is in a non-canonical form. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 
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XSAVE—Save Processor Extended States 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF AE /4 M VIV XSAVE Save state components specified by EDX:EAX to mem. 
XSAVE mem 
NP REX.W + OF AE /4 M V/N.E. XSAVE Save state components specified by EDX:EAX to mem. 
XSAVE64 mem 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Performs a full or partial save of processor state components to the XSAVE area located at the memory address 

specified by the destination operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. The 

specific state components saved correspond to the bits set in the requested-feature bitmap (RFBM), which is the 
logical-AND of EDX:EAX and XCRO. 


The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FKRSTOR and FXSAVE, the memory format used for x87 state depends 
on a REX.W prefix; see Section 13.5.1, “x87 State” of Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.7, “Operation of XSAVE,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 
provides a detailed description of the operation of the XSAVE instruction. The following items provide a high-level 
outline: 


* XSAVE saves state component / if and only if RFBM[/] = 1.1 


¢ XSAVE does not modify bytes 511:464 of the legacy region of the XSAVE area (see Section 13.4.1, “Legacy 
Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


e XSAVE reads the XSTATE_BV field of the XSAVE header (see Section 13.4.2, “XSAVE Header” of Inte/® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1) and writes a modified value back to memory as 
follows. If RFBM[/] = 1, XSAVE writes XSTATE_BV[/] with the value of XINUSE[/]. (XINUSE is a bitmap by which 
the processor tracks the status of various state components. See Section 13.6, “Processor Tracking of XSAVE- 
Managed State” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) If RFBM[/] = 0, 
XSAVE writes XSTATE_BV[/] with the value that it read from memory (it does not modify the bit). XSAVE does 
not write to any part of the XSAVE header other than the XSTATE_BV field. 


¢ XSAVE always uses the standard format of the extended region of the XSAVE area (see Section 13.4.3, 
“Extended Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). 


Use of a destination operand not aligned to 64-byte boundary (in either 64-bit or 32-bit modes) results ina 
general-protection (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


1. Anexception is made for MXCSR and MXCSR_MASK, which belong to state component 1 — SSE. XSAVE saves these values to mem- 
ory if either RFBM[1] or RFBM[2] is 1. 
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Operation 


RFBM := XCRO AND EDX:EAX; = /* bitwise logical AND */ 
OLD_BV := XSTATE_BV field from XSAVE header; 


IF RFBM[O] = 1 
THEN store x87 state into legacy region of XSAVE area; 
Fl; 


IF RFBM[1] = 1 
THEN store XMM registers into legacy region of XSAVE area; // this step does not save MXCSR or MXCSR_MASK 
Fl; 


IF RFBM[1] = 1 OR RFBM[2] = 1 
THEN store MXCSR and MXCSR_MASK into legacy region of XSAVE area; 
Fl; 


FOR i := 2 TO 62 
IF RFBM[i] = 1 
THEN save XSAVE state component i at offset n from base of XSAVE area (n enumerated by CPUID(EAX=0DH,ECX=i):EBX); 
FI; 
ENDFOR; 


XSTATE_BV field in XSAVE header := (OLD_BV AND NOT RFBM) OR (XINUSE AND RFBM); 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XSAVE: void _xsave( void * , unsigned __int64); 
XSAVE: void _xsave64( void * , unsigned __int64); 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#NM If CRO.TS[bit 3] = 1. 

#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


#AC If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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Real-Address Mode Exceptions 


#GP 


#NM 
#UD 


If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 
If CRO.TS[bit 3] = 1. 

If CPUID.O1H:ECX.XSAVE[bit 26] = 0. 

If CR4.0SXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 


#SS(0) 
#PF(fault-code) 
#NM 

#UD 


#AC 


If the memory address is in a non-canonical form. 

If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 
If a memory address referencing the SS segment is in a non-canonical form. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0. 

If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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XSAVEC—Save Processor Extended States with Compaction 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En Mode Feature 

Support | Flag 
NP OF C7 /4 M VIV XSAVEC Save state components specified by EDX:EAX to mem with 
XSAVEC mem compaction. 
NP REX.W + OF C7 /4 M V/N.E. XSAVEC Save state components specified by EDX:EAX to mem with 
XSAVEC64 mem compaction. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Performs a full or partial save of processor state components to the XSAVE area located at the memory address 

specified by the destination operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. The 

specific state components saved correspond to the bits set in the requested-feature bitmap (RFBM), which is the 
logical-AND of EDX:EAX and XCRO. 


The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FXRSTOR and FXSAVE, the memory format used for x87 state depends 
on a REX.W prefix; see Section 13.5.1, “x87 State” of Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.10, “Operation of XSAVEC,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1 provides a detailed description of the operation of the XSAVEC instruction. The following items provide a high- 
level outline: 


¢ Execution of XSAVEC is similar to that of XSAVE. XSAVEC differs from XSAVE in that it uses compaction and that 
it may use the init optimization. 


* XSAVEC saves state component / if and only if RFBM[/] = 1 and XINUSE[/] = 1.1 (XINUSE is a bitmap by which 
the processor tracks the status of various state components. See Section 13.6, “Processor Tracking of XSAVE- 
Managed State” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) 


° XSAVEC does not modify bytes 511:464 of the legacy region of the XSAVE area (see Section 13.4.1, “Legacy 
Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


¢ XSAVEC writes the logical AND of RFBM and XINUSE to the XSTATE_BV field of the XSAVE header.2/3 (See 
Section 13.4.2, “XSAVE Header” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1.) XSAVEC sets bit 63 of the XCOMP_BV field and sets bits 62:0 of that field to RFBM[62:0]. XSAVEC does not 
write to any parts of the XSAVE header other than the XSTATE_BV and XCOMP_BV fields. 


° XSAVEC always uses the compacted format of the extended region of the XSAVE area (see Section 13.4.3, 
“Extended Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). 


Use of a destination operand not aligned to 64-byte boundary (in either 64-bit or 32-bit modes) results in a 
general-protection (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


1. There is an exception for state component 1 (SSE). MXCSR is part of SSE state, but XINUSE[1] may be 0 even if MXCSR does not 
have its initial value of 1F80H. In this case, XSAVEC saves SSE state as long as RFBM[1] = 1. 


2. Unlike XSAVE and XSAVEOPT, XSAVEC clears bits in the XSTATE_BV field that correspond to bits that are clear in RFBM. 


3. There is an exception for state component 1 (SSE). MXCSR is part of SSE state, but XINUSE[1] may be 0 even if MXCSR does not 
have its initial value of 1F80H. In this case, XSAVEC sets XSTATE_BV[1] to 1 as long as RFBM[1] = 1. 
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Operation 


RFBM := XCRO AND EDX:EAX; /* bitwise logical AND */ 
TO_BE_SAVED := RFBM AND XINUSE; _/* bitwise logical AND */ 
If MXCSR # 1F80H AND RFBM[1] 

TO_BE_SAVED[1] = 1; 
Fl; 


IF TO_BE_SAVED[0] = 1 
THEN store x87 state into legacy region of XSAVE area; 
Fl; 


IF TO_BE_SAVED[1] = 1 
THEN store SSE state into legacy region of XSAVE area; // this step saves the XMM registers, MXCSR, and MXCSR_MASK 


Fl; 
NEXT_FEATURE_OFFSET = 576; // Legacy area and XSAVE header consume 576 bytes 
FOR i := 2 TO 62 
IF RFBM[i] = 1 
THEN 
IF TO_BE_SAVED[i] 
THEN save XSAVE state component i at offset NEXT_FEATURE_OFFSET from base of XSAVE area; 
Fl; 
NEXT_FEATURE_OFFSET = NEXT_FEATURE_OFFSET + n (n enumerated by CPUID(EAX=0DH,ECX=i):EAX); 
Fl; 
ENDFOR; 


XSTATE_BV field in XSAVE header := TO_BE_SAVED; 
XCOMP_BV field in XSAVE header := RFBM OR 80000000_O00000000H; 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XSAVEC: void _xsavec( void * , unsigned __int64); 
XSAVEC64: void_xsavec64( void *, unsigned __int64); 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#NM If CRO.TS[bit 3] = 1. 

#UD If CPUID.OLH:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 
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#AC 


If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


Real-Address Mode Exceptions 


#GP 


#NM 
#UD 


If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If any part of the operand lies outside the effective address space from 0 to FFFFH. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#GP(0) 
#SS(0) 
#PF(fault-code) 


#NM 
#UD 


#AC 
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If the memory address is in a non-canonical form. 

If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If a memory address referencing the SS segment is in a non-canonical form. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 


If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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XSAVEOPT—Save Processor Extended States Optimized 


Opcode/ Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF AE /6 M VIV XSAVEOPT | Save state components specified by EDX:EAX 
XSAVEOPT mem to mem, optimizing if possible. 
NP REX.W + OF AE /6 M VIV XSAVEOPT | Save state components specified by EDX:EAX 
XSAVEOPT64 mem to mem, optimizing if possible. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Performs a full or partial save of processor state components to the XSAVE area located at the memory address 

specified by the destination operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. The 

specific state components saved correspond to the bits set in the requested-feature bitmap (RFBM), which is the 
logical-AND of EDX:EAX and XCRO. 


The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FKRSTOR and FXSAVE, the memory format used for x87 state depends 
on a REX.W prefix; see Section 13.5.1, “x87 State” of Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.9, “Operation of XSAVEOPT,” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1 provides a detailed description of the operation of the XSAVEOPT instruction. The following items provide 
a high-level outline: 


¢ Execution of XSAVEOPT is similar to that of XSAVE. XSAVEOPT differs from XSAVE in that it may use the init and 
modified optimizations. The performance of XSAVEOPT will be equal to or better than that of XSAVE. 


* XSAVEOPT saves state component / only if RFBM[/] = 1 and XINUSE[/] = 1.1 (XINUSE is a bitmap by which the 
processor tracks the status of various state components. See Section 13.6, “Processor Tracking of XSAVE- 
Managed State”of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) Even if both 
bits are 1, XSAVEOPT may optimize and not save state component i if (1) state component / has not been 
modified since the last execution of XRSTOR or XRSTORS; and (2) this execution of XSAVES corresponds to 
that last execution of XRSTOR or XRSTORS as determined by the internal value XRSTOR_INFO (see the 
Operation section below). 


¢ XSAVEOPT does not modify bytes 511:464 of the legacy region of the XSAVE area (see Section 13.4.1, “Legacy 
Region of an XSAVE Area” of Inte!® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


¢ XSAVEOPT reads the XSTATE_BV field of the XSAVE header (see Section 13.4.2, “XSAVE Header” of Inte/® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 1) and writes a modified value back to memory 
as follows. If RFBM[/] = 1, XSAVEOPT writes XSTATE_BV[/] with the value of XINUSE[/]. If RFBM[/] = 0, 
XSAVEOPT writes XSTATE_BV[/] with the value that it read from memory (it does not modify the bit). 
XSAVEOPT does not write to any part of the XSAVE header other than the XSTATE_BV field. 


¢ XSAVEOPT always uses the standard format of the extended region of the XSAVE area (see Section 13.4.3, 
“Extended Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). 


Use of a destination operand not aligned to 64-byte boundary (in either 64-bit or 32-bit modes) will result in a 
general-protection (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


1. There is an exception made for MXCSR and MXCSR_MASK, which belong to state component 1 — SSE. XSAVEOPT always saves 
these to memory if RFBM[1] = 1 or RFBM[2] = 1, regardless of the value of XINUSE. 
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See Section 13.6, “Processor Tracking of XSAVE-Managed State,” of Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1 for discussion of the bitmap XMODIFIED and of the quantity XRSTOR_INFO. 


Operation 


RFBM := XCRO AND EDX:EAX; = /* bitwise logical AND */ 
OLD_BV := XSTATE_BV field from XSAVE header; 
TO_BE_SAVED := RFBM AND XINUSE; 


IF in VMX non-root operation 
THEN VMXNR := 1; 
ELSE VMXNR := 0; 

Fl; 

LAXA := linear address of XSAVE area; 

IF XRSTOR_INFO = (CPL,VMXNR,LAXA,OOO00000_00000000h) 
THEN TO_BE_SAVED := TO_BE_SAVED AND XMODIFIED; 

Fl; 


IF TO_BE_SAVED[O] = 1 
THEN store x87 state into legacy region of XSAVE area; 
Fl; 


IF TO_BE_SAVED[1] 
THEN store XMM registers into legacy region of XSAVE area; // this step does not save MXCSR or MXCSR_MASK 
Fl; 


IF RFBM[1] = 1 or RFBM[2] = 1 
THEN store MXCSR and MXCSR_MASK into legacy region of XSAVE area; 
Fl; 


FOR i := 2 TO 62 
IF TO_BE_SAVED[i] = 1 
THEN save XSAVE state component i at offset n from base of XSAVE area (n enumerated by CPUID(EAX=0DH,ECX=i):EBX); 
FI; 
ENDFOR; 


XSTATE_BV field in XSAVE header := (OLD_BV AND NOT RFBM) OR (XINUSE AND RFBM); 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XSAVEOPT: void _xsaveopt( void * , unsigned __int64); 
XSAVEOPT: void_xsaveopt64( void *, unsigned __int64); 


Protected Mode Exceptions 


#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#NM If CRO.TS[bit 3] = 1. 
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If CPUID.O1LH:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEOPT[bit 0] = 
0 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 


Real-Address Mode Exceptions 


#GP 


#NM 
#UD 


If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 
If CRO.TS[bit 3] = 1. 


If CPUID.O1H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEOPT[bit 0] = 
0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 


#SS(0) 
#GP(0) 


#PF(fault-code) 


#NM 
#UD 


#AC 


If a memory address referencing the SS segment is in a non-canonical form. 

If the memory address is in a non-canonical form. 

If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 

If a page fault occurs. 

If CRO.TS[bit 3] = 1. 

If CPUID.O1H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSAVEOPT[bit 0] = 
0. 

If CR4.OSXSAVE[bit 18] = 0. 

If the LOCK prefix is used. 

If this exception is disabled a general protection exception (#GP) is signaled if the memory 
operand is not aligned on a 64-byte boundary, as described above. If the alignment check 
exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may 
vary with implementation, as follows. In all implementations where #AC is not signaled, a 
general protection exception is signaled in its place. In addition, the width of the alignment 
check may also vary with implementation. For instance, for a given implementation, an align- 
ment check exception might be signaled for a 2-byte misalignment, whereas a general protec- 
tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte 
misalignments). 
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XSAVES—Save Processor Extended States Supervisor 


Opcode / Op/ | 64/32 bit | CPUID Description 
Instruction En |Mode Feature 

Support | Flag 
NP OF C7 /5 M VIV XSS Save state components specified by EDX:EAX to 
XSAVES mem mem with compaction, optimizing if possible. 
NP REX.W + OF C7 /5 M V/N.E. XSS Save state components specified by EDX:EAX to 
XSAVES64 mem mem with compaction, optimizing if possible. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (w) NA NA NA 
Description 


Performs a full or partial save of processor state components to the XSAVE area located at the memory address 
specified by the destination operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask. The 
specific state components saved correspond to the bits set in the requested-feature bitmap (RFBM), the logical- 
AND of EDX:EAX and the logical-OR of XCRO with the IA32_XSS MSR. XSAVES may be executed only if CPL = 0. 


The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Inte/® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. Like FXRSTOR and FXSAVE, the memory format used for x87 state depends 
on a REX.W prefix; see Section 13.5.1, “x87 State” of Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Section 13.11, “Operation of XSAVES,” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1 provides a detailed description of the operation of the XSAVES instruction. The following items provide a high- 
level outline: 


° Execution of XSAVES is similar to that of XSAVEC. XSAVES differs from XSAVEC in that it can save state 
components corresponding to bits set in the IA32_XSS MSR and that it may use the modified optimization. 


* XSAVES saves state component j only if RFBM[/] = 1 and XINUSE[/] = 1.! (XINUSE is a bitmap by which the 
processor tracks the status of various state components. See Section 13.6, “Processor Tracking of XSAVE- 
Managed State” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) Even if both 
bits are 1, XSAVES may optimize and not save state component i if (1) state component / has not been modified 
since the last execution of XRSTOR or XRSTORS; and (2) this execution of XSAVES correspond to that last 
execution of XRSTOR or XRSTORS as determined by XRSTOR_INFO (see the Operation section below). 


¢ XSAVES does not modify bytes 511:464 of the legacy region of the XSAVE area (see Section 13.4.1, “Legacy 
Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


* XSAVES writes the logical AND of RFBM and XINUSE to the XSTATE_BV field of the XSAVE header. (See Section 
13.4.2, “XSAVE Header” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.) 
XSAVES sets bit 63 of the XCOMP_BV field and sets bits 62:0 of that field to RFBM[62:0]. XSAVES does not 
write to any parts of the XSAVE header other than the XSTATE_BV and XCOMP_BV fields. 


°  XSAVES always uses the compacted format of the extended region of the XSAVE area (see Section 13.4.3, 
“Extended Region of an XSAVE Area” of Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1). 


Use of a destination operand not aligned to 64-byte boundary (in either 64-bit or 32-bit modes) results in a 
general-protection (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored. 


1. There is an exception for state component 1 (SSE). MXCSR is part of SSE state, but XINUSE[1] may be 0 even if MXCSR does not 
have its initial value of 1F80H. In this case, the init optimization does not apply and XSAVEC will save SSE state as long as RFBM[1] = 
1 and the modified optimization is not being applied. 

2. There is an exception for state component 1 (SSE). MXCSR is part of SSE state, but XINUSE[1] may be 0 even if MXCSR does not 
have its initial value of 1F80H. In this case, XSAVES sets XSTATE_BV[1] to 1 as long as RFBM[1] = 1. 
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See Section 13.6, “Processor Tracking of XSAVE-Managed State,” of Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1 for discussion of the bitmap XMODIFIED and of the quantity XRSTOR_INFO. 


Operation 


RFBM := (XCRO OR IA32_XSS) AND EDX:EAX; /* bitwise logical OR and AND */ 
IF in VMX non-root operation 
THEN VMXNR := 1; 
ELSE VMXNR := 0; 
Fl; 
LAXA := linear address of XSAVE area; 
COMPMASK := RFBM OR 80000000_00000000H; 
TO_BE_SAVED := RFBM AND XINUSE; 
IF XRSTOR_INFO = (CPL,VMXNR,LAXA,COMPMASK) 
THEN TO_BE_SAVED := TO_BE_SAVED AND XMODIFIED; 
Fl; 
IF MXCSR # 1F80H AND RFBM[1] 
THEN TO_BE_SAVED[1] = 1; 
Fl; 


IF TO_BE_SAVED[0] = 1 
THEN store x87 state into legacy region of XSAVE area; 
Fl; 


IF TO_BE_SAVED[1] = 1 
THEN store SSE state into legacy region of XSAVE area; // this step saves the XMM registers, MXCSR, and MXCSR_MASK 
Fl; 


NEXT_FEATURE_OFFSET = 576; // Legacy area and XSAVE header consume 576 bytes 
FOR i := 2 TO 62 
IF RFBM[i] = 1 
THEN 
IF TO_BE_SAVED[i] 
THEN 
save XSAVE state component i at offset NEXT_FEATURE_OFFSET from base of XSAVE area; 
IFi=8 // state component 8 is for PT state 
THEN IA32_RTIT_CTL.Trace€En[bit 0] := 0; 
Fl; 
Fl; 
NEXT_FEATURE_OFFSET = NEXT_FEATURE_OFFSET + n (n enumerated by CPUID(EAX=0DH,ECX=i):EAX); 
Fl; 
ENDFOR; 


NEW_HEADER := RFBM AND XINUSE; 
IF MXCSR # 1F80H AND RFBM[1] 
THEN NEW_HEADER[1] = 1; 
Fl; 
XSTATE_BV field in XSAVE header := NEW_HEADER; 
XCOMP_BV field in XSAVE header := COMPMASK; 


Flags Affected 
None. 
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Intel C/C++ Compiler Intrinsic Equivalent 
XSAVES: void _xsaves( void * , unsigned __int64); 
XSAVES64: void _xsaves64( void * , unsigned __int64); 


Protected Mode Exceptions 

#GP(0) If CPL > 0. 
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 


#SS(0) If a memory operand effective address is outside the SS segment limit. 

#PF(fault-code) If a page fault occurs. 

#NM If CRO.TS[bit 3] = 1. 

#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Real-Address Mode Exceptions 

#GP If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 
If any part of the operand lies outside the effective address space from 0 to FFFFH. 

#NM If CRO.TS[bit 3] = 1. 

#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 
If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
Same exceptions as in protected mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
#GP(0) If CPL > 0. 
If the memory address is in a non-canonical form. 
If a memory operand is not aligned on a 64-byte boundary, regardless of segment. 


#SS(0) If a memory address referencing the SS segment is in a non-canonical form. 
#PF(fault-code) If a page fault occurs. 

#NM If CRO.TS[bit 3] = 1. 

#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0 or CPUID.(EAX=0DH,ECX=1):EAX.XSS[bit 3] = 0. 


If CR4.OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


5-650 Vol. 2C XSAVES—Save Processor Extended States Supervisor 


INSTRUCTION SET REFERENCE, V-Z 


XSETBV—Set Extended Control Register 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
NP OF 01 D1 XSETBV ZO | Valid Valid Write the value in EDX:EAX to the XCR 
specified by ECX. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO NA NA NA NA 
Description 


Writes the contents of registers EDX:EAX into the 64-bit extended control register (XCR) specified in the ECX 
register. (On processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The 
contents of the EDX register are copied to high-order 32 bits of the selected XCR and the contents of the EAX 
register are copied to low-order 32 bits of the XCR. (On processors that support the Intel 64 architecture, the high- 
order 32 bits of each of RAX and RDX are ignored.) Undefined or reserved bits in an XCR should be set to values 
previously read. 


This instruction must be executed at privilege level 0 or in real-address mode; otherwise, a general protection 
exception #GP(0) is generated. Specifying a reserved or unimplemented XCR in ECX will also cause a general 
protection exception. The processor will also generate a general protection exception if software attempts to write 
to reserved bits in an XCR. 


Currently, only XCRO is supported. Thus, all other values of ECX are reserved and will cause a #GP(0). Note that 
bit O of XCRO (corresponding to x87 state) must be set to 1; the instruction will cause a #GP(0) if an attempt is 
made to clear this bit. In addition, the instruction causes a #GP(0) if an attempt is made to set XCRO[2] (AVX state) 
while clearing XCRO[1] (SSE state); it is necessary to set both bits to use AVX instructions; Section 13.3, “Enabling 
the XSAVE Feature Set and XSAVE-Enabled Features,” of Inte/® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


Operation 
XCR[ECX] := EDX:EAX; 


Flags Affected 
None. 


Intel C/C++ Compiler Intrinsic Equivalent 
XSETBV: void _xsetbv( unsigned int, unsigned __int64); 


Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
If an invalid XCR is specified in ECX. 
If the value in EDX:EAX sets bits that are reserved in the XCR specified by ECX. 
If an attempt is made to clear bit 0 of XCRO. 
If an attempt is made to set XCRO[2:1] to 10b. 
#UD If CPUID.O1H:ECX.XSAVE[bit 26] = 0. 
If CR4.0SXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 
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Real-Address Mode Exceptions 
#GP If an invalid XCR is specified in ECX. 
If the value in EDX:EAX sets bits that are reserved in the XCR specified by ECX. 
If an attempt is made to clear bit 0 of XCRO. 
If an attempt is made to set XCRO[2:1] to 10b. 
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. 
If CR4.0OSXSAVE[bit 18] = 0. 
If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The XSETBV instruction is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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XTEST — Test If In Transactional Execution 


INSTRUCTION SET REFERENCE, V-Z 


Opcode/Instruction Op/ | 64/32bit | CPUID Description 
En Mode Feature 

Support | Flag 
NP OF 01 D6 ZO VIV HLE or Test if executing in a transactional region 
XTEST RTM 

Instruction Operand Encoding 
Op/En Operand 1 Operand2 Operand3 Operand4 
ZO NA NA NA NA 
Description 


The XTEST instruction queries the transactional execution status. If the instruction executes inside a transaction- 
ally executing RTM region or a transactionally executing HLE region, then the ZF flag is cleared, else it is set. 


Operation 

XTEST 

IF (RTM_ACTIVE = 1 OR HLE_ACTIVE = 1) 
THEN 


ELSE 
Fl; 


Flags Affected 


The ZF flag is cleared if the instruction is executed transactionally; otherwise it is set to 1. The CF, OF, SF, PF, and 
AF, flags are cleared. 


Intel C/C++ Compiler Intrinsic Equivalent 


XTEST: int __xtest( void ); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
#UD CPUID.(EAX=7, ECX=0):EBX.HLE[bit 4] = 0 and CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11] = 
0. 


If LOCK prefix is used. 
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CHAPTER 6 
SAFER MODE EXTENSIONS REFERENCE 


6.1 OVERVIEW 


This chapter describes the Safer Mode Extensions (SMX) for the Intel 64 and IA-32 architectures. Safer Mode 
Extensions (SMX) provide a programming interface for system software to establish a measured environment 
within the platform to support trust decisions by end users. The measured environment includes: 


* Measured launch of a system executive, referred to as a Measured Launched Environment (MLE)!. The system 
executive may be based on a Virtual Machine Monitor (VMM), a measured VMM is referred to as MVMM2. 


* Mechanisms to ensure the above measurement is protected and stored in a secure location in the platform. 
¢ Protection mechanisms that allow the VMM to control attempts to modify the VMM. 


The measurement and protection mechanisms used by a measured environment are supported by the capabilities 
of an Intel® Trusted Execution Technology (Intel® TXT) platform: 


¢ The SMX are the processor’s programming interface in an Intel TXT platform. 
¢ The chipset in an Intel TXT platform provides enforcement of the protection mechanisms. 


¢ Trusted Platform Module (TPM) 1.2 in the platform provides platform configuration registers (PCRs) to store 
software measurement values. 


6.2 SMX FUNCTIONALITY 


SMX functionality is provided in an Intel 64 processor through the GETSEC instruction via leaf functions. The 
GETSEC instruction supports multiple leaf functions. Leaf functions are selected by the value in EAX at the time 
GETSEC is executed. Each GETSEC leaf function is documented separately in the reference pages with a unique 
mnemonic (even though these mnemonics share the same opcode, OF 37). 


6.2.1 Detecting and Enabling SMX 


Software can detect support for SMX operation using the CPUID instruction. If software executes CPUID with 1 in 
EAX, a value of 1 in bit 6 of ECX indicates support for SMX operation (GETSEC is available), see CPUID instruction 
for the layout of feature flags of reported by CPUID.01H:ECX. 


System software enables SMX operation by setting CR4.SMXE[Bit 14] = 1 before attempting to execute GETSEC. 
Otherwise, execution of GETSEC results in the processor signaling an invalid opcode exception (#UD). 


If the CPUID SMX feature flag is clear (CPUID.01H.ECX[Bit 6] = 0), attempting to set CR4.SMXE[Bit 14] results in 
a general protection exception. 


The IA32_FEATURE_CONTROL MSR (at address 03AH) provides feature control bits that configure operation of 
VMX and SMX. These bits are documented in Table 6-1. 


1. See Intel® Trusted Execution Technology Measured Launched Environment Programming Guide. 


2. AnMVMM is sometimes referred to as a measured launched environment (MLE). See Intel® Trusted Execution Technology Measured 
Launched Environment Programming Guide 
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Table 6-1. Layout of IA32_FEATURE_CONTROL 


Bit Position Description 

0 Lock bit (O = unlocked, 1 = locked). When set to ‘1’ further writes to this MSR are blocked. 

1 Enable VMX in SMX operation. 

2 Enable VMX outside SMX operation. 

7:3 Reserved 

14:8 SENTER Local Function Enables: When set, each bit in the field represents an enable control for a corresponding 
SENTER function. 

15 SENTER Global Enable: Must be set to ‘1’ to enable operation of GETSEC[SENTER]. 

16 Reserved 

17 SGX Launch Control Enable: Must be set to ‘1’ to enable runtime re-configuration of SGX Launch Control via the 
IA32_SGXLEPUBKEYHASHh MSR. 

18 SGX Global Enable: Must be set to ‘1’ to enable Intel SGX leaf functions. 

19 Reserved 

20 LMCE On: When set, system software can program the MSRs associated with LMCE to configure delivery of some 
machine check exceptions to a single logical processor. 

63:21 Reserved 


Bit O is a lock bit. If the lock bit is clear, an attempt to execute VMXON will cause a general-protection exception. 
Attempting to execute GETSEC[SENTER] when the lock bit is clear will also cause a general-protection 
exception. If the lock bit is set, WRMSR to the IA32_FEATURE_CONTROL MSR will cause a general-protection 
exception. Once the lock bit is set, the MSR cannot be modified until a power-on reset. System BIOS can use 
this bit to provide a setup option for BIOS to disable support for VMX, SMX or both VMX and SMX. 


Bit 1 enables VMX in SMX operation (between executing the SENTER and SEXIT leaves of GETSEC). If this bit is 
clear, an attempt to execute VMXON in SMX will cause a general-protection exception if executed in SMX 
operation. Attempts to set this bit on logical processors that do not support both VMX operation (Chapter 6, 
“Safer Mode Extensions Reference”) and SMX operation cause general-protection exceptions. 


Bit 2 enables VMX outside SMX operation. If this bit is clear, an attempt to execute VMXON will cause a general- 
protection exception if executed outside SMX operation. Attempts to set this bit on logical processors that do 
not support VMX operation cause general-protection exceptions. 


Bits 8 through 14 specify enabled functionality of the SENTER leaf function. Each bit in the field represents an 
enable control for a corresponding SENTER function. Only enabled SENTER leaf functionality can be used when 
executing SENTER. 


Bits 15 specify global enable of all SENTER functionalities. 


6.2.2 SMX Instruction Summary 


System software must first query for available GETSEC leaf functions by executing GETSEC[CAPABILITIES]. The 
CAPABILITIES leaf function returns a bit map of available GETSEC leaves. An attempt to execute an unsupported 
leaf index results in an undefined opcode (#UD) exception. 
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6.2.2.1 GETSEC[CAPABILITIES] 


The SMX functionality provides an architectural interface for newer processor generations to extend SMX capabili- 
ties. Specifically, the GETSEC instruction provides a capability leaf function for system software to discover the 
available GETSEC leaf functions that are supported in a processor. Table 6-2 lists the currently available GETSEC 
leaf functions. 


Table 6-2. GETSEC Leaf Functions 


Index (EAX) Leaf function Description 

0 CAPABILITIES Returns the available leaf functions of the GETSEC instruction. 
1 Undefined Reserved 

2 ENTERACCS Enter 

3 EXITAC Exit 

4 SENTER Launch an MLE. 

5 SEXIT Exit the MLE. 

6 PARAMETERS Return SMX related parameter information. 
7 SMCTRL SMX mode control. 

8 WAKEUP Wake up sleeping processors in safer mode. 
9 - (4G-1) Undefined Reserved 


6.2.2.2 GETSEC[ENTERACCS] 


The GETSEC[ENTERACCS] leaf enables authenticated code execution mode. The ENTERACCS leaf function 
performs an authenticated code module load using the chipset public key as the signature verification. ENTERACCS 
requires the existence of an Intel® Trusted Execution Technology capable chipset since it unlocks the chipset 
private configuration register space after successful authentication of the loaded module. The physical base 
address and size of the authenticated code module are specified as input register values in EBX and ECX, respec- 
tively. 

While in the authenticated code execution mode, certain processor state properties change. For this reason, the 


time in which the processor operates in authenticated code execution mode should be limited to minimize impact 
on external system events. 


Upon entry into , the previous paging context is disabled (since the authenticated code module image is specified 
with physical addresses and can no longer rely upon external memory-based page-table structures). 


Prior to executing the GETSEC[ENTERACCS] leaf, system software must ensure the logical processor issuing 
GETSEC[ENTERACCS] is the boot-strap processor (BSP), as indicated by IA32_APIC_BASE.BSP = 1. System soft- 
ware must ensure other logical processors are in a suitable idle state and not marked as BSP. 


The GETSEC[ENTERACCS] leaf may be used by different agents to load different authenticated code modules to 
perform functions related to different aspects of a measured environment, for example system software and 
Intel® TXT enabled BIOS may use more than one authenticated code modules. 


6.2.2.3 GETSEC[EXITAC] 


GETSEC[EXITAC] takes the processor out of . When this instruction leaf is executed, the contents of the authenti- 
cated code execution area are scrubbed and control is transferred to the non-authenticated context defined by a 
near pointer passed with the GETSEC[EXITAC] instruction. 


The authenticated code execution area is no longer accessible after completion of GETSEC[EXITAC]. RBX (or EBX) 
holds the address of the near absolute indirect target to be taken. 
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6.2.2.4 GETSEC(SENTER] 


The GETSEC[SENTER] leaf function is used by the initiating logical processor (ILP) to launch an MLE. 
GETSEC[SENTER] can be considered a superset of the ENTERACCS leaf, because it enters as part of the measured 
environment launch. 


Measured environment startup consists of the following steps: 

¢ the ILP rendezvous the responding logical processors (RLPs) in the platform into a controlled state (At the 
completion of this handshake, all the RLPs except for the ILP initiating the measured environment launch are 
placed in a newly defined SENTER sleep state). 


° Load and authenticate the authenticated code module required by the measured environment, and enter 
authenticated code execution mode. 


°® Verify and lock certain system configuration parameters. 
® Measure the dynamic root of trust and store into the PCRs in TPM. 
¢ Transfer control to the MLE with interrupts disabled. 


Prior to executing the GETSEC[SENTER] leaf, system software must ensure the platform’s TPM is ready for access 
and the ILP is the boot-strap processor (BSP), as indicated by IA32_APIC_BASE.BSP. System software must ensure 
other logical processors (RLPs) are in a suitable idle state and not marked as BSP. 


System software launching a measurement environment is responsible for providing a proper authenticate code 
module address when executing GETSEC[SENTER]. The AC module responsible for the launch of a measured envi- 
ronment and loaded by GETSEC[SENTER] is referred to as SINIT. See Inte/® Trusted Execution Technology 
Measured Launched Environment Programming Guide for additional information on system software requirements 
prior to executing GETSEC[SENTER]. 


6.2.2.5 GETSEC[SEXIT] 


System software exits the measured environment by executing the instruction GETSEC[SEXIT] on the ILP. This 
instruction rendezvous the responding logical processors in the platform for exiting from the measured environ- 
ment. External events (if left masked) are unmasked and Intel® TXT-capable chipset’s private configuration space 
is re-locked. 


6.2.2.6 GETSEC[PARAMETERS] 


The GETSEC[PARAMETERS] leaf function is used to report attributes, options and limitations of SMX operation. 
Software uses this leaf to identify operating limits or additional options. 


The information reported by GETSEC[PARAMETERS] may require executing the leaf multiple times using EBX as an 
index. If the GETSEC[PARAMETERS] instruction leaf or if a specific parameter field is not available, then SMX oper- 
ation should be interpreted to use the default limits of respective GETSEC leaves or parameter fields defined in the 
GETSEC[PARAMETERS] leaf. 


6.2.2.7 GETSEC[SMCTRL] 


The GETSEC[SMCTRL] leaf function is used for providing additional control over specific conditions associated with 
the SMX architecture. An input register is supported for selecting the control operation to be performed. See the 
specific leaf description for details on the type of control provided. 


6.2.2.8 GETSEC(WAKEUP] 


Responding logical processors (RLPs) are placed in the SENTER sleep state after the initiating logical processor 
executes GETSEC[SENTER]. The ILP can wake up RLPs to join the measured environment by using 
GETSEC[WAKEUP]. When the RLPs in SENTER sleep state wake up, these logical processors begin execution at the 
entry point defined in a data structure held in system memory (pointed to by an chipset register LT.MLE.JOIN) in 
TXT configuration space. 
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6.2.3 Measured Environment and SMX 


This section gives a simplified view of a representative life cycle of a measured environment that is launched by a 
system executive using SMX leaf functions. Inte/® Trusted Execution Technology Measured Launched Environment 
Programming Guide provides more detailed examples of using SMX and chipset resources (including chipset regis- 
ters, Trusted Platform Module) to launch an MVMM. 


The life cycle starts with the system executive (an OS, an OS loader, and so forth) loading the MLE and SINIT AC 
module into available system memory. The system executive must validate and prepare the platform for the 
measured launch. When the platform is properly configured, the system executive executes GETSEC[SENTER] on 
the initiating logical processor (ILP) to rendezvous the responding logical processors into an SENTER sleep state, 
the ILP then enters into using the SINIT AC module. In a multi-threaded or multi-processing environment, the 
system executive must ensure that other logical processors are already in an idle loop, or asleep (such as after 
executing HLT) before executing GETSEC[SENTER]. 


After the GETSEC[SENTER] rendezvous handshake is performed between all logical processors in the platform, the 
ILP loads the chipset authenticated code module (SINIT) and performs an authentication check. If the check 
passes, the processor hashes the SINIT AC module and stores the result into TPM PCR 17. It then switches execu- 
tion context to the SINIT AC module. The SINIT AC module will perform a number of platform operations, 
including: verifying the system configuration, protecting the system memory used by the MLE from I/O devices 
capable of DMA, producing a hash of the MLE, storing the hash value in TPM PCR 18, and various other operations. 
When SINIT completes execution, it executes the GETSEC[EXITAC] instruction and transfers control the MLE at the 
designated entry point. 


Upon receiving control from the SINIT AC module, the MLE must establish its protection and isolation controls 
before enabling DMA and interrupts and transferring control to other software modules. It must also wake up the 
RLPs from their SENTER sleep state using the GETSEC[WAKEUP] instruction and bring them into its protection and 
isolation environment. 


While executing in a measured environment, the MVMM can access the Trusted Platform Module (TPM) in locality 2. 
The MVMM has complete access to all TPM commands and may use the TPM to report current measurement values 
or use the measurement values to protect information such that only when the platform configuration registers 
(PCRs) contain the same value is the information released from the TPM. This protection mechanism is known as 
sealing. 


A measured environment shutdown is ultimately completed by executing GETSEC[SEXIT]. Prior to this step system 
software is responsible for scrubbing sensitive information left in the processor caches, system memory. 


6.3 GETSEC LEAF FUNCTIONS 


This section provides detailed descriptions of each leaf function of the GETSEC instruction. GETSEC is available only 
if CPUID.O1H:ECX[Bit 6] = 1. This indicates the availability of SMX and the GETSEC instruction. Before GETSEC can 
be executed, SMX must be enabled by setting CR4.SMXE[Bit 14] = 1. 


A GETSEC leaf can only be used if it is shown to be available as reported by the GETSEC[CAPABILITIES] function. 
Attempts to access a GETSEC leaf index not supported by the processor, or if CR4.SMXE is 0, results in the signaling 
of an undefined opcode exception. 


All GETSEC leaf functions are available in protected mode, including the compatibility sub-mode of IA-32e mode 
and the 64-bit sub-mode of IA-32e mode. Unless otherwise noted, the behavior of all GETSEC functions and inter- 
actions related to the measured environment are independent of IA-32e mode. This also applies to the interpreta- 
tion of register widths! passed as input parameters to GETSEC functions and to register results returned as output 
parameters. 


1. This chapter uses the 64-bit notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because processors that support SMX also 
support Intel 64 Architecture. The MVMM can be launched in IA-32e mode or outside IA-32e mode. The 64-bit notation of processor 
registers also refer to its 32-bit forms if SMX is used in 32-bit environment. In some places, notation such as EAX is used to refer 
specifically to lower 32 bits of the indicated register 
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The GETSEC functions ENTERACCS, SENTER, SEXIT, and WAKEUP require a Intel® TXT capable-chipset to be 
present in the platform. The GETSEC[CAPABILITIES] returned bit vector in position 0 indicates an Intel® TXT- 
capable chipset has been sampled present! by the processor. 


The processor's operating mode also affects the execution of the following GETSEC leaf functions: SMCTRL, ENTER- 
ACCS, EXITAC, SENTER, SEXIT, and WAKEUP. These functions are only allowed in protected mode at CPL = 0. They 
are not allowed while in SMM in order to prevent potential intra-mode conflicts. Further execution qualifications 
exist to prevent potential architectural conflicts (for example: nesting of the measured environment or authenti- 
cated code execution mode). See the definitions of the GETSEC leaf functions for specific requirements. 


For the purpose of performance monitor counting, the execution of GETSEC functions is counted as a single instruc- 
tion with respect to retired instructions. The response by a responding logical processor (RLP) to messages associ- 
ated with GETSEC[SENTER] or GTSEC[SEXIT] is transparent to the retired instruction count on the ILP. 


1. Sampled present means that the processor sent a message to the chipset and the chipset responded that it (a) knows about the 
message and (b) is capable of executing SENTER. This means that the chipset CAN support Intel® TXT, and is configured and WILLING 
to support it. 
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GETSEC[CAPABILITIES] - Report the SMX Capabilities 


Opcode Instruction Description 

NP OF 37 GETSEC[CAPABILITIES] | Report the SMX capabilities. 

(EAX = 0) The capabilities index is input in EBX with the result returned in EAX. 
Description 


The GETSEC[CAPABILITIES] function returns a bit vector of supported GETSEC leaf functions. The CAPABILITIES 
leaf of GETSEC is selected with EAX set to 0 at entry. EBX is used as the selector for returning the bit vector field in 
EAX. GETSEC[CAPABILITIES] may be executed at all privilege levels, but the CR4.SMXE bit must be set or an unde- 
fined opcode exception (#UD) is returned. 


With EBX = 0 upon execution of GETSEC[CAPABILITIES], EAX returns the a bit vector representing status on the 
presence of a Intel® TXT-capable chipset and the first 30 available GETSEC leaf functions. The format of the 
returned bit vector is provided in Table 6-3. 


If bit 0 is set to 1, then an Intel® TXT-capable chipset has been sampled present by the processor. If bits in the range 
of 1-30 are set, then the corresponding GETSEC leaf function is available. If the bit value at a given bit index is 0, 
then the GETSEC leaf function corresponding to that index is unsupported and attempted execution results in a 
#UD. 


Bit 31 of EAX indicates if further leaf indexes are supported. If the Extended Leafs bit 31 is set, then additional leaf 
functions are accessed by repeating GETSEC[CAPABILITIES] with EBX incremented by one. When the most signifi- 
cant bit of EAX is not set, then additional GETSEC leaf functions are not supported; indexing EBX to a higher value 
results in EAX returning zero. 


Table 6-3. GETSEC Capability Result Encoding (EBX = 0) 


Field Bit position Description 

Chipset Present 0 Intel? TXT-capable chipset is present. 
Undefined 1 Reserved 

ENTERACCS 2 GETSEC[ENTERACCS] is available. 
EXITAC 3 GETSEC[EXITAC] is available. 

SENTER 4 GETSEC[SENTER] is available. 

SEXIT 5 GETSEC[SEXIT] is available. 
PARAMETERS 6 GETSEC[PARAMETERS] is available. 
SMCTRL 7 GETSEC[SMCTRL] is available. 
WAKEUP 8 GETSEC[WAKEUP] is available. 
Undefined 30:9 Reserved 

Extended Leafs 31 Reserved for extended information reporting of GETSEC capabilities. 
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Operation 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSIF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction”); 
IF (EBX=0) THEN 
BitVector := 0; 
IF (TXT chipset present) 
BitVector[Chipset present] := 1; 
IF (ENTERACCS Available) 
THEN BitVector[ENTERACCS] := 1; 
IF (EXITAC Available) 
THEN BitVector[EXITAC] := 1; 
IF (SENTER Available) 
THEN BitVector[SENTER] := 1; 
IF (SEXIT Available) 
THEN BitVector[SEXIT] := 1; 
IF (PARAMETERS Available) 
THEN BitVector[PARAMETERS] := 1; 
IF (SMCTRL Available) 
THEN BitVector[SMCTRL] := 1; 
IF (WAKEUP Available) 
THEN BitVector[WAKEUP] := 1; 
EAX := BitVector; 
ELSE 
EAX := 0; 
END:;: 


Flags Affected 
None 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 


Protected Mode Exceptions 
#UD IF CR4.SMXE = 0. 


Real-Address Mode Exceptions 
#UD IF CR4.SMXE = 0. 


Virtual-8086 Mode Exceptions 
#UD IF CR4.SMXE = 0. 


Compatibility Mode Exceptions 
#UD IF CR4.SMXE = 0. 
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64-Bit Mode Exceptions 
#UD IF CR4.SMXE = 0. 


VM-exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[ENTERACCS] — Execute Authenticated Chipset Code 


Opcode Instruction Description 

NP OF 37 GETSEC[ENTERACCS] | Enter authenticated code execution mode. 

(EAX = 2) EBX holds the authenticated code module physical base address. ECX holds the authenticated 
code module size (bytes). 


Description 


The GETSEC[ENTERACCS] function loads, authenticates and executes an authenticated code module using an 
Intel® TXT platform chipset's public key. The ENTERACCS leaf of GETSEC is selected with EAX set to 2 at entry. 


There are certain restrictions enforced by the processor for the execution of the GETSEC[ENTERACCS] instruction: 


* Execution is not allowed unless the processor is in protected mode or IA-32e mode with CPL = 0 and 
EFLAGS.VM = 0. 


¢ Processor cache must be available and not disabled, that is, CRO.CD and CRO.NW bits must be 0. 


°® For processor packages containing more than one logical processor, CRO.CD is checked to ensure consistency 
between enabled logical processors. 


¢ For enforcing consistency of operation with numeric exception reporting using Interrupt 16, CRO.NE must be 
set. 


e An Intel TXT-capable chipset must be present as communicated to the processor by sampling of the power-on 
configuration capability field after reset. 


¢ The processor can not already be in authenticated code execution mode as launched by a previous 
GETSEC[ENTERACCS] or GETSEC[SENTER] instruction without a subsequent exiting using GETSEC[EXITAC]). 


* To avoid potential operability conflicts between modes, the processor is not allowed to execute this instruction 
if it currently is in SMM or VMX operation. 


° To ensure consistent handling of SIPI messages, the processor executing the GETSEC[ENTERACCS] instruction 
must also be designated the BSP (boot-strap processor) as defined by IA32_APIC_BASE.BSP (Bit 8). 


Failure to conform to the above conditions results in the processor signaling a general protection exception. 
Prior to execution of the ENTERACCS leaf, other logical processors, i.e., RLPs, in the platform must be: 


¢ Idle in a wait-for-SIPI state (as initiated by an INIT assertion or through reset for non-BSP designated 
processors), or 


¢ Inthe SENTER sleep state as initiated by a GETSEC[SENTER] from the initiating logical processor (ILP). 


If other logical processor(s) in the same package are not idle in one of these states, execution of ENTERACCS 
signals a general protection exception. The same requirement and action applies if the other logical processor(s) of 
the same package do not have CRO.CD = 0. 


A successful execution of ENTERACCS results in the ILP entering an authenticated code execution mode. Prior to 
reaching this point, the processor performs several checks. These include: 


¢ Establish and check the location and size of the specified authenticated code module to be executed by the 
processor. 


¢ Inhibit the ILP’s response to the external events: INIT, A20M, NMI and SMI. 
¢ Broadcast a message to enable protection of memory and I/O from other processor agents. 
¢ Load the designated code module into an authenticated code execution area. 


* Isolate the contents of the authenticated code execution area from further state modification by external 
agents. 


¢ Authenticate the authenticated code module. 


¢ Initialize the initiating logical processor state based on information contained in the authenticated code module 
header. 


* Unlock the Intel® TXT-capable chipset private configuration space and TPM locality 3 space. 
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¢ Begin execution in the authenticated code module at the defined entry point. 


The GETSEC[ENTERACCS] function requires two additional input parameters in the general purpose registers EBX 
and ECX. EBX holds the authenticated code (AC) module physical base address (the AC module must reside below 
4 GBytes in physical address space) and ECX holds the AC module size (in bytes). The physical base address and 
size are used to retrieve the code module from system memory and load it into the internal authenticated code 
execution area. The base physical address is checked to verify it is on a modulo-4096 byte boundary. The size is 
verified to be a multiple of 64, that it does not exceed the internal authenticated code execution area capacity (as 
reported by GETSEC[CAPABILITIES]), and that the top address of the AC module does not exceed 32 bits. An error 
condition results in an abort of the authenticated code execution launch and the signaling of a general protection 
exception. 


As an integrity check for proper processor hardware operation, execution of GETSEC[ENTERACCS] will also check 
the contents of all the machine check status registers (as reported by the MSRs IA32_MCi_STATUS) for any valid 
uncorrectable error condition. In addition, the global machine check status register IA32_MCG_STATUS MCIP bit 
must be cleared and the IERR processor package pin (or its equivalent) must not be asserted, indicating that no 
machine check exception processing is currently in progress. These checks are performed prior to initiating the 
load of the authenticated code module. Any outstanding valid uncorrectable machine check error condition present 
in these status registers at this point will result in the processor signaling a general protection violation. 


The ILP masks the response to the assertion of the external signals INIT#, A2Z0M, NMI#, and SMI#. This masking 
remains active until optionally unmasked by GETSEC[EXITAC] (this defined unmasking behavior assumes 
GETSEC[ENTERACCS] was not executed by a prior GETSEC[SENTER]). The purpose of this masking control is to 
prevent exposure to existing external event handlers that may not be under the control of the authenticated code 
module. 


The ILP sets an internal flag to indicate it has entered authenticated code execution mode. The state of the A20M 
pin is likewise masked and forced internally to a de-asserted state so that any external assertion is not recognized 
during authenticated code execution mode. 


To prevent other (logical) processors from interfering with the ILP operating in authenticated code execution mode, 
memory (excluding implicit write-back transactions) access and I/O originating from other processor agents are 
blocked. This protection starts when the ILP enters into authenticated code execution mode. Only memory and I/O 
transactions initiated from the ILP are allowed to proceed. Exiting authenticated code execution mode is done by 
executing GETSEC[EXITAC]. The protection of memory and I/O activities remains in effect until the ILP executes 
GETSEC[EXITAC]. 


Prior to launching the authenticated execution module using GETSEC[ENTERACCS] or GETSEC[SENTER], the 
processor's MTRRs (Memory Type Range Registers) must first be initialized to map out the authenticated RAM 
addresses as WB (writeback). Failure to do so may affect the ability for the processor to maintain isolation of the 
loaded authenticated code module. If the processor detected this requirement is not met, it will signal an Intel® 
TXT reset condition with an error code during the loading of the authenticated code module. 


While physical addresses within the load module must be mapped as WB, the memory type for locations outside of 
the module boundaries must be mapped to one of the supported memory types as returned by GETSEC[PARAME- 
TERS] (or UC as default). 


To conform to the minimum granularity of MTRR MSRs for specifying the memory type, authenticated code RAM 
(ACRAM) is allocated to the processor in 4096 byte granular blocks. If an AC module size as specified in ECX is not 
a multiple of 4096 then the processor will allocate up to the next 4096 byte boundary for mapping as ACRAM with 
indeterminate data. This pad area will not be visible to the authenticated code module as external memory nor can 
it depend on the value of the data used to fill the pad area. 


At the successful completion of GETSEC[ENTERACCS], the architectural state of the processor is partially initialized 
from contents held in the header of the authenticated code module. The processor GDTR, CS, and DS selectors are 
initialized from fields within the authenticated code module. Since the authenticated code module must be relocat- 
able, all address references must be relative to the authenticated code module base address in EBX. The processor 
GDTR base value is initialized to the AC module header field GDTBasePtr + module base address held in EBX and 
the GDTR limit is set to the value in the GDTLimit field. The CS selector is initialized to the AC module header 
SegSel field, while the DS selector is initialized to CS + 8. The segment descriptor fields are implicitly initialized to 
BASE=0, LIMIT=FFFFFh, G=1, D=1, P=1, S=1, read/write access for DS, and execute/read access for CS. The 
processor begins the authenticated code module execution with the EIP set to the AC module header EntryPoint 
field + module base address (EBX). The AC module based fields used for initializing the processor state are checked 
for consistency and any failure results in a shutdown condition. 
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A summary of the register state initialization after successful completion of GETSEC[ENTERACCS] is given for the 
processor in Table 6-4. The paging is disabled upon entry into authenticated code execution mode. The authenti- 
cated code module is loaded and initially executed using physical addresses. It is up to the system software after 
execution of GETSEC[ENTERACCS] to establish a new (or restore its previous) paging environment with an appro- 
priate mapping to meet new protection requirements. EBP is initialized to the authenticated code module base 
physical address for initial execution in the authenticated environment. As a result, the authenticated code can 
reference EBP for relative address based references, given that the authenticated code module must be position 


independent. 


Table 6-4. Register State Initialization after GETSEC[ENTERACCS] 


Register State Initialization Status Comment 
CRO PG<0, AM<-0, WP<-0: Others unchanged Paging, Alignment Check, Write-protection are 
disabled. 
CR4 MCE~0, CET<-0, PCIDE<-0: Others unchanged Machine Check Exceptions, Control-flow 
Enforcement Technology, and Process-context 
Identifiers disabled. 
EFLAGS 00000002H 
IA32_EFER OH IA-32e mode disabled. 
EIP AC.base + EntryPoint AC.base is in EBX as input to GETSEC[ENTERACCS]. 
[EJR]BX Pre-ENTERACCS state: Next [E|R]JIP prior to Carry forward 64-bit processor state across 
GETSEC[ENTERACCS] GETSEC[ENTERACCS]. 
ECX Pre-ENTERACCS state: [31:16]=GDTR.limit; Carry forward processor state across 
[15:0]=CS.sel GETSEC[ENTERACCS]. 
[EJR]DX Pre-ENTERACCS state: Carry forward 64-bit processor state across 
GDTR base GETSEC[ENTERACCS]. 
EBP AC.base 
cs Sel=[SegSel], base=0, limit=FFFFFh, G=1, D=1, 
AR=9BH 
DS Sel=[SegSel] +8, base=0, limit=FFFFFh, G=1, D=1, 
AR=93H 
GDTR Base= AC.base (EBX) + [GDTBasePtr], 
Limit=[GDTLimit] 
DR7 00000400H 
IA32_DEBUGCTL OH 
1A32_MISC_ENABLE | See Table 6-5 for example. The number of initialized fields may change due to 
processor implementation. 
Performance OH 
counters and 
counter control 
registers 


The segmentation related processor state that has not been initialized by GETSEC[ENTERACCS] requires appro- 
priate initialization before use. Since a new GDT context has been established, the previous state of the segment 
selector values held in ES, SS, FS, GS, TR, and LDTR might not be valid. 


6-12 Vol.2D 


GETSEC[ENTERACCS] — Execute Authenticated Chipset Code 


SAFER MODE EXTENSIONS REFERENCE 


The MSR IA32_EFER is also unconditionally cleared as part of the processor state initialized by ENTERACCS. Since 
paging is disabled upon entering authenticated code execution mode, a new paging environment will have to be 
reestablished in order to establish IA-32e mode while operating in authenticated code execution mode. 


Debug exception and trap related signaling is also disabled as part of GETSEC[ENTERACCS]. This is achieved by 
resetting DR7, TF in EFLAGs, and the MSR IA32_DEBUGCTL. These debug functions are free to be re-enabled once 
supporting exception handler(s), descriptor tables, and debug registers have been properly initialized following 
entry into authenticated code execution mode. Also, any pending single-step trap condition will have been cleared 
upon entry into this mode. 


Performance related counters and counter control registers are cleared as part of execution of ENTERACCS. This 
implies any active performance counters at any time of ENTERACCS execution will be disabled. To reactive the 
processor performance counters, this state must be re-initialized and re-enabled. 


The IA32_MISC_ENABLE MSR is initialized upon entry into authenticated execution mode. Certain bits of this MSR 
are preserved because preserving these bits may be important to maintain previously established platform settings 
(See the footnote for Table 6-5.). The remaining bits are cleared for the purpose of establishing a more consistent 
environment for the execution of authenticated code modules. One of the impacts of initializing this MSR is any 
previous condition established by the MONITOR instruction will be cleared. 


To support the possible return to the processor architectural state prior to execution of GETSEC[ENTERACCS], 
certain critical processor state is captured and stored in the general- purpose registers at instruction completion. 
[E|R]BX holds effective address ([E|RJIP) of the instruction that would execute next after GETSEC[ENTERACCS], 
ECX[15:0] holds the CS selector value, ECX[31:16] holds the GDTR limit field, and [E]R]DX holds the GDTR base 
field. The subsequent authenticated code can preserve the contents of these registers so that this state can be 
manually restored if needed, prior to exiting authenticated code execution mode with GETSEC[EXITAC]. For the 
processor state after exiting authenticated code execution mode, see the description of GETSEC[SEXIT]. 


Table 6-5. IA32_MISC_ENABLE MSR Initialization’ by ENTERACCS and SENTER 


Field Bit position Description 
Fast strings enable 0 Clear to 0. 
FOPCODE compatibility mode 2 Clear to 0. 
enable 
Thermal monitor enable 3 Set to 1 if other thermal monitor capability is not enabled. 
Split-lock disable 4 Clear to 0. 
Bus lock on cache line splits 8 Clear to 0. 
disable 
Hardware prefetch disable 9 Clear to 0. 
GV1/2 legacy enable 15 Clear to 0. 
MONITOR/MWAIT s/m enable 18 Clear to 0. 
Adjacent sector prefetch disable | 19 Clear to 0. 
NOTES: 


1. The number of IA32_MISC_ENABLE fields that are initialized may vary due to processor implementations. 

ENTERACCS (and SENTER) initialize the state of processor thermal throttling such that at least a minimum level is enabled. If thermal 
throttling is already enabled when executing one of these GETSEC leaves, then no change in the thermal throttling control settings 
will occur. If thermal throttling is disabled, then it will be enabled via setting of the thermal throttle control bit 3 as a result of execut- 
ing these GETSEC leaves. 


N 


The IDTR will also require reloading with a new IDT context after entering authenticated code execution mode, 
before any exceptions or the external interrupts INTR and NMI can be handled. Since external interrupts are re- 
enabled at the completion of authenticated code execution mode (as terminated with EXITAC), it is recommended 
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that a new IDT context be established before this point. Until such a new IDT context is established, the 
programmer must take care in not executing an INT n instruction or any other operation that would result in an 
exception or trap signaling. 


Prior to completion of the GETSEC[ENTERACCS] instruction and after successful authentication of the AC module, 
the private configuration space of the Intel TXT chipset is unlocked. The authenticated code module alone can gain 
access to this normally restricted chipset state for the purpose of securing the platform. 


Once the authenticated code module is launched at the completion of GETSEC[ENTERACCS], it is free to enable 
interrupts by setting EFLAGS.IF and enable NMI by execution of IRET. This presumes that it has re-established 
interrupt handling support through initialization of the IDT, GDT, and corresponding interrupt handling code. 


Operation in a Uni-Processor Platform 
(* The state of the internal flag ACMODEFLAG persists across instruction boundary *) 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSIF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction’); 
ELSIF (GETSEC leaf unsupported) 
THEN #UD; 
ELSIF ((in VMX operation) or 
(CRO.PE=0) or (CRO.CD=1) or (CRO.NW=1) or (CRO.NE=0) or 
CPL>O) or (EFLAGS.VM=1) or 
1A32_APIC_BASE.BSP=0) or 
TXT chipset not present) or 
ACMODEFLAG=1) or (IN_SMM=1)) 
THEN #GP(0); 
IF (GETSEC[PARAMETERS].Parameter_Type = 5, MCA_Handling (bit 6) = 0) 
FOR I = 0 to [A32_MCG_CAP.COUNT-1 DO 
IF (IA32_MC[I]_ STATUS = uncorrectable error) 
THEN #GP(0); 


oan pore eens ee 


OD; 
Fl; 
IF (IA32_MCG_STATUS.MCIP=1) or (IERR pin is asserted) 
THEN #GP(0); 
ACBASE := EBX; 
ACSIZE := ECX; 
IF (((ACBASE MOD 4096) # 0) or ((ACSIZE MOD 64 ) # 0) or (ACSIZE < minimum module size) OR (ACSIZE > authenticated RAM 
capacity)) or (ACBASE+ACSIZE) > (2°32 -1))) 
THEN #GP(0); 
IF (secondary thread(s) CRO.CD = 1) or ((secondary thread(s) NOT(wait-for-SIPI)) and 
(secondary thread(s) not in SENTER sleep state) 
THEN #GP(0); 
Mask SMI, INIT, A20M, and NMI external pin events; 
IA32_MISC_ENABLE := (IA32_MISC_ENABLE & MASK_CONST*) 
(* The hexadecimal value of MASK_CONST may vary due to processor implementations *) 
A20M := 0; 
IA32_DEBUGCTL := 0; 
Invalidate processor TLB(s); 
Drain Outgoing Transactions; 
ACMODEFLAG := 1; 
SignalTXTMessage(ProcessorHold); 
Load the internal ACRAM based on the AC module size; 
(* Ensure that all ACRAM loads hit Write Back memory space *) 
IF (ACRAM memory type + WB) 
THEN TXT-SHUTDOWN(#BadACMMT ype); 
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IF (AC module header version isnot supported) OR (ACRAM[ModuleT ype] + 2) 
THEN TXT-SHUTDOWN(#UnsupportedACM); 

(* Authenticate the AC Module and shutdown with an error if it fails *) 

KEY := GETKEY(ACRAM, ACBASE); 

KEYHASH := HASH(KEY); 

CSKEYHASH := READ(TXT.PUBLIC.KEY); 

IF (KEYHASH # CSKEYHASH) 
THEN TXT-SHUTDOWN(#AuthenticateFail); 

SIGNATURE := DECRYPT(ACRAM, ACBASE, KEY); 

(* The value of SIGNATURE_LEN_CONST is implementation-specific*) 

FOR I=0 to SIGNATURE_LEN_CONST - 1 DO 
ACRAM[SCRATCH.I] := SIGNATURE[I]; 

COMPUTEDSIGNATURE := HASH(ACRAM, ACBASE, ACSIZE); 

FOR I=0 to SIGNATURE_LEN_CONST - 1 DO 
ACRAM[SCRATCH.SIGNATURE_LEN_CONST +I] := COMPUTEDSIGNATURE[I]; 

IF (SIGNATURE # COMPUTEDSIGNATURE) 
THEN TXT-SHUTDOWN(#AuthenticateFail); 

ACMCONTROL := ACRAM[CodeControl]; 

IF (ACMCONTROL.O = 0) and (ACMCONTROL.1 = 1) and (snoop hit to modified line detected on ACRAM load)) 
THEN TXT-SHUTDOWN(#UnexpectedHITM); 

IF (ACMCONTROL reserved bits are set) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[GDTBasePtr] < (ACRAM[HeaderLen] * 4 + Scratch_size)) OR 
((ACRAM[GDTBasePtr] + ACRAM[GDTLimit]) >= ACSIZE)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACMCONTROL.O = 1) and (ACMCONTROL.1 = 1) and (snoop hit to modified line detected on ACRAM load)) 
THEN ACEntryPoint := ACBASE+ACRAM[ErrorEntryPoint]; 

ELSE 
ACEntryPoint := ACBASE+ACRAM[EntryPoint]; 

IF ((ACEntryPoint >= ACSIZE) OR (ACEntryPoint < (ACRAM[HeaderLen] * 4 + Scratch_size)))THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[GDTLimit] & FFFFOOO0Oh) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[SegSel] > (ACRAM[GDTLimit] - 15)) OR (ACRAM[SegSel] < 8)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[SegSel].Tl=1) OR (ACRAM[SegSel].RPL + 0)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

CRO.[PG.AM.WP] := 0; 

CR4.MCE := 0; 

EFLAGS := 00000002h; 

IA32_EFER := Oh; 

[E|R]BX := [EJR]IP of the instruction after GETSEC[ENTERACCS]; 

ECX := Pre-GETSEC[ENTERACCS] GDT.limit:CS.sel; 

[EJR]DX := Pre-GETSEC[ENTERACCS] GDT.base; 

EBP := ACBASE; 

GDTR.BASE := ACBASE+ACRAM[GDTBasePtr]; 

GDTR.LIMIT := ACRAM[GDTLimit]; 

CS.SEL := ACRAM[SegSel]; 

CS.BASE := 0; 

CS.LIMIT := FFFFFh; 

CS.G:= 1; 

CS.D:= 1; 

CS.AR := 9Bh; 

DS.SEL := ACRAM[SegSel]+8; 

DS.BASE := 0; 
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DS.LIMIT := FFFFFh; 

DS.G := 1; 

DS.D := 1; 

DS.AR := 93h; 

DR7 := 00000400h; 
IA32_DEBUGCTL := 0; 
SignalTXTMsg(OpenPrivate); 
SignalTXTMsg(OpenLocality3); 
EIP := ACEntryPoint; 

END; 


Flags Affected 
All flags are cleared. 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 


Protected Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[ENTERACCS] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) If CRO.CD = 1 or CRO.NW = 1 or CRO.NE = 0 or CRO.PE = 0 or CPL > O or EFLAGS.VM = 1. 


If a Intel® TXT-capable chipset is not present. 
If in VMX root operation. 


If the initiating processor is not designated as the bootstrap processor via the MSR bit 
IA32_APIC_BASE.BSP. 


If the processor is already in authenticated code execution mode. 

If the processor is in SMM. 

If a valid uncorrectable machine check error is logged in IA32_MC[I]_STATUS. 

If the authenticated code base is not on a 4096 byte boundary. 

If the authenticated code size > processor internal authenticated code area capacity. 
If the authenticated code size is not modulo 64. 

If other enabled logical processor(s) of the same package CRO.CD = 1. 


If other enabled logical processor(s) of the same package are not in the wait-for-SIPI or 
SENTER sleep state. 


Real-Address Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[ENTERACCS] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[ENTERACCS] is not recognized in real-address mode. 
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Virtual-8086 Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[ENTERACCS] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[ENTERACCS] is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 
#GP IF AC code module does not reside in physical address below 2%32 -1. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 
#GP IF AC code module does not reside in physical address below 2%32 -1. 


VM-exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[EXITAC]—Exit Authenticated Code Execution Mode 


Opcode Instruction Description 

NP OF 37 GETSEC{EXITAC] Exit authenticated code execution mode. 

(EAX=3) RBX holds the Near Absolute Indirect jump target and EDX hold the exit parameter flags. 
Description 


The GETSEC[EXITAC] leaf function exits the ILP out of authenticated code execution mode established by 
GETSEC[ENTERACCS] or GETSEC[SENTER]. The EXITAC leaf of GETSEC is selected with EAX set to 3 at entry. EBX 
(or RBX, if in 64-bit mode) holds the near jump target offset for where the processor execution resumes upon 
exiting authenticated code execution mode. EDX contains additional parameter control information. Currently only 
an input value of 0 in EDX is supported. All other EDX settings are considered reserved and result in a general 
protection violation. 


GETSEC[EXITAC] can only be executed if the processor is in protected mode with CPL = 0 and EFLAGS.VM = 0. The 
processor must also be in authenticated code execution mode. To avoid potential operability conflicts between 
modes, the processor is not allowed to execute this instruction if it is in SMM or in VMX operation. A violation of 
these conditions results in a general protection violation. 


Upon completion of the GETSEC[EXITAC] operation, the processor unmasks responses to external event signals 
INIT#, NMI#, and SMI#. This unmasking is performed conditionally, based on whether the authenticated code 
execution mode was entered via execution of GETSEC[SENTER] or GETSEC[ENTERACCS]. If the processor is in 
authenticated code execution mode due to the execution of GETSEC[SENTER], then these external event signals 
will remain masked. In this case, A20M is kept disabled in the measured environment until the measured environ- 
ment executes GETSEC[SEXIT]. INIT# is unconditionally unmasked by EXITAC. Note that any events that are 
pending, but have been blocked while in authenticated code execution mode, will be recognized at the completion 
of the GETSEC[EXITAC] instruction if the pin event is unmasked. 


The intent of providing the ability to optionally leave the pin events SMI#, and NMI# masked is to support the 
completion of a measured environment bring-up that makes use of VMX. In this envisioned security usage 
scenario, these events will remain masked until an appropriate virtual machine has been established in order to 
field servicing of these events in a safer manner. Details on when and how events are masked and unmasked in 
VMX operation are described in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C. It 
should be cautioned that if no VMX environment is to be activated following GETSEC[EXITAC], that these events 
will remain masked until the measured environment is exited with GETSEC[SEXIT]. If this is not desired then the 
GETSEC function SMCTRL(0O) can be used for unmasking SMI# in this context. NMI# can be correspondingly 
unmasked by execution of IRET. 


A successful exit of the authenticated code execution mode requires the ILP to perform additional steps as outlined 
below: 


* Invalidate the contents of the internal authenticated code execution area. 
¢ Invalidate processor TLBs. 

° Clear the internal processor AC Mode indicator flag. 

® Re-lock the TPM locality 3 space. 


* Unlock the Intel® TXT-capable chipset memory and I/O protections to allow memory and I/O activity by other 
processor agents. 


° Perform a near absolute indirect jump to the designated instruction location. 


The content of the authenticated code execution area is invalidated by hardware in order to protect it from further 
use or visibility. This internal processor storage area can no longer be used or relied upon after GETSEC[EXITAC]. 

Data structures need to be re-established outside of the authenticated code execution area if they are to be refer- 
enced after EXITAC. Since addressed memory content formerly mapped to the authenticated code execution area 
may no longer be coherent with external system memory after EXITAC, processor TLBs in support of linear to phys- 
ical address translation are also invalidated. 
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Upon completion of GETSEC[EXITAC] a near absolute indirect transfer is performed with EIP loaded with the 
contents of EBX (based on the current operating mode size). In 64-bit mode, all 64 bits of RBX are loaded into RIP 
if REX.W precedes GETSEC[EXITAC]. Otherwise RBX is treated as 32 bits even while in 64-bit mode. Conventional 
CS limit checking is performed as part of this control transfer. Any exception conditions generated as part of this 
control transfer will be directed to the existing IDT; thus it is recommended that an IDTR should also be established 
prior to execution of the EXITAC function if there is a need for fault handling. In addition, any segmentation related 
(and paging) data structures to be used after EXITAC should be re-established or validated by the authenticated 
code prior to EXITAC. 


In addition, any segmentation related (and paging) data structures to be used after EXITAC need to be re-estab- 
lished and mapped outside of the authenticated RAM designated area by the authenticated code prior to EXITAC. 
Any data structure held within the authenticated RAM allocated area will no longer be accessible after completion 
by EXITAC. 


Operation 

(* The state of the internal flag ACMODEFLAG and SENTERFLAG persist across instruction boundary *) 

IF (CR4.SMXE=0) 

THEN #UD; 

ELSIF (in VMX non-root operation) 

THEN VM Exit (reason="GETSEC instruction’); 

ELSIF (GETSEC leaf unsupported) 

THEN #UD; 

ELSIF ((in VMX operation) or ( (in 64-bit mode) and ( RBX is non-canonical) ) 
(CRO.PE=0) or (CPL>O) or (EFLAGS.VM=1) or 
(ACMODEFLAG=0) or (IN_SMM=1)) or (EDX + 0)) 
THEN #GP(0); 

IF (OperandSize = 32) 

THEN tempEIP := EBX; 

ELSIF (OperandSize = 64) 
THEN tempElIP := RBX; 

ELSE 
tempEIP := EBX AND OOOOFFFFH; 

IF (tempEIP > code segment limit) 

THEN #GP(0); 

Invalidate ACRAM contents; 

Invalidate processor TLB(s); 

Drain outgoing messages; 

SignalTXTMsg(CloseLocality3); 

SignalTXTMsg(LockSMRAM); 

SignalTXTMsg(ProcessorRelease); 

Unmask INIT; 

IF (SENTERFLAG=0) 

THEN Unmask SMI, INIT, NMI, and A2OM pin event; 

ELSEIF (IA32_SMM_MONITOR_CTL[O] = 0) 

THEN Unmask SMI pin event; 

ACMODEFLAG := 0; 

IF IA32_EFER.LMA == 
THEN CR3 := R8; 

EIP := tempEIP; 

END; 


Flags Affected 
None. 
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Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX.W Sets 64-bit mode Operand size attribute. 


Protected Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[EXITAC] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) If CRO.PE = 0 or CPL>0 or EFLAGS.VM =1. 


If in VMX root operation. 

If the processor is not currently in authenticated code execution mode. 
If the processor is in SMM. 

If any reserved bit position is set in the EDX parameter register. 


Real-Address Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[EXITAC] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[EXITAC] is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[EXITAC] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[EXITAC] is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 
#GP(0) If the target address in RBX is not in a canonical form. 


VM-Exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[SENTER]—Enter a Measured Environment 


Opcode Instruction Description 
NP OF 37 GETSEC[SENTER] Launch a measured environment. 
(EAX=4) EBX holds the SINIT authenticated code module physical base address. 


ECX holds the SINIT authenticated code module size (bytes). 
EDX controls the level of functionality supported by the measured environment launch. 


Description 


The GETSEC[SENTER] instruction initiates the launch of a measured environment and places the initiating logical 
processor (ILP) into the authenticated code execution mode. The SENTER leaf of GETSEC is selected with EAX set 
to 4 at execution. The physical base address of the AC module to be loaded and authenticated is specified in EBX. 
The size of the module in bytes is specified in ECX. EDX controls the level of functionality supported by the 
measured environment launch. To enable the full functionality of the protected environment launch, EDX must be 
initialized to zero. 


The authenticated code base address and size parameters (in bytes) are passed to the GETSEC[SENTER] instruc- 
tion using EBX and ECX respectively. The ILP evaluates the contents of these registers according to the rules for the 
AC module address in GETSEC[ENTERACCS]. AC module execution follows the same rules, as set by 
GETSEC[ENTERACCS]. 


The launching software must ensure that the TPM.ACCESS_0.activeLocality bit is clear before executing the 
GETSEC[SENTER] instruction. 


There are restrictions enforced by the processor for execution of the GETSEC[SENTER] instruction: 


° Execution is not allowed unless the processor is in protected mode or IA-32e mode with CPL = 0 and 
EFLAGS.VM = 0. 


¢* Processor cache must be available and not disabled using the CRO.CD and NW bits. 


¢ For enforcing consistency of operation with numeric exception reporting using Interrupt 16, CRO.NE must be 
set. 


¢ An Intel TXT-capable chipset must be present as communicated to the processor by sampling of the power-on 
configuration capability field after reset. 


¢ The processor can not be in authenticated code execution mode or already in a measured environment (as 
launched by a previous GETSEC[ENTERACCS] or GETSEC[SENTER] instruction). 


* To avoid potential operability conflicts between modes, the processor is not allowed to execute this instruction 
if it currently is in SMM or VMX operation. 


* To ensure consistent handling of SIPI messages, the processor executing the GETSEC[SENTER] instruction 
must also be designated the BSP (boot-strap processor) as defined by IA32_APIC_BASE.BSP (Bit 8). 


¢ EDX must be initialized to a setting supportable by the processor. Unless enumeration by the GETSEC[PARAM- 
ETERS] leaf reports otherwise, only a value of zero is supported. 


Failure to abide by the above conditions results in the processor signaling a general protection violation. 


This instruction leaf starts the launch of a measured environment by initiating a rendezvous sequence for all logical 
processors in the platform. The rendezvous sequence involves the initiating logical processor sending a message 
(by executing GETSEC[SENTER]) and other responding logical processors (RLPs) acknowledging the message, 
thus synchronizing the RLP(s) with the ILP. 


In response to a message signaling the completion of rendezvous, RLPs clear the bootstrap processor indicator flag 
(IA32_APIC_BASE.BSP) and enter an SENTER sleep state. In this sleep state, RLPs enter an idle processor condi- 
tion while waiting to be activated after a measured environment has been established by the system executive. 
RLPs in the SENTER sleep state can only be activated by the GETSEC leaf function WAKEUP in a measured environ- 
ment. 
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A successful launch of the measured environment results in the initiating logical processor entering the authenti- 
cated code execution mode. Prior to reaching this point, the ILP performs the following steps internally: 


¢ Inhibit processor response to the external events: INIT, A20M, NMI, and SMI. 

¢ Establish and check the location and size of the authenticated code module to be executed by the ILP. 

* Check for the existence of an Intel® TXT-capable chipset. 

e Verify the current power management configuration is acceptable. 

° Broadcast a message to enable protection of memory and I/O from activities from other processor agents. 
¢ Load the designated AC module into authenticated code execution area. 

¢ Isolate the content of authenticated code execution area from further state modification by external agents. 
¢ Authenticate the AC module. 

¢ Updated the Trusted Platform Module (TPM) with the authenticated code module's hash. 

* Initialize processor state based on the authenticated code module header information. 

* Unlock the Intel® TXT-capable chipset private configuration register space and TPM locality 3 space. 

¢ Begin execution in the authenticated code module at the defined entry point. 


As an integrity check for proper processor hardware operation, execution of GETSEC[SENTER] will also check the 
contents of all the machine check status registers (as reported by the MSRs IA32_MCi_STATUS) for any valid 
uncorrectable error condition. In addition, the global machine check status register IA32_MCG_STATUS MCIP bit 
must be cleared and the IERR processor package pin (or its equivalent) must be not asserted, indicating that no 
machine check exception processing is currently in-progress. These checks are performed twice: once by the ILP 
prior to the broadcast of the rendezvous message to RLPs, and later in response to RLPs acknowledging the rendez- 
vous message. Any outstanding valid uncorrectable machine check error condition present in the machine check 
status registers at the first check point will result in the ILP signaling a general protection violation. If an 
outstanding valid uncorrectable machine check error condition is present at the second check point, then this will 
result in the corresponding logical processor signaling the more severe TXT-shutdown condition with an error code 
of 12. 


Before loading and authentication of the target code module is performed, the processor also checks that the 
current voltage and bus ratio encodings correspond to known good values supportable by the processor. The MSR 
IA32_PERF_STATUS values are compared against either the processor supported maximum operating target 
setting, system reset setting, or the thermal monitor operating target. If the current settings do not meet any of 
these criteria then the SENTER function will attempt to change the voltage and bus ratio select controls in a 
processor-specific manner. This adjustment may be to the thermal monitor, minimum (if different), or maximum 
operating target depending on the processor. 


This implies that some thermal operating target parameters configured by BIOS may be overridden by SENTER. 
The measured environment software may need to take responsibility for restoring such settings that are deemed 
to be safe, but not necessarily recognized by SENTER. If an adjustment is not possible when an out of range setting 
is discovered, then the processor will abort the measured launch. This may be the case for chipset controlled 
settings of these values or if the controllability is not enabled on the processor. In this case it is the responsibility of 
the external software to program the chipset voltage ID and/or bus ratio select settings to known good values 
recognized by the processor, prior to executing SENTER. 


NOTE 


For a mobile processor, an adjustment can be made according to the thermal monitor operating 
target. For a quad-core processor the SENTER adjustment mechanism may result in a more conser- 
vative but non-uniform voltage setting, depending on the pre-SENTER settings per core. 


The ILP and RLPs mask the response to the assertion of the external signals INIT#, A20M, NMI#, and SMI#. The 
purpose of this masking control is to prevent exposure to existing external event handlers until a protected handler 
has been put in place to directly handle these events. Masked external pin events may be unmasked conditionally 
or unconditionally via the GETSEC[EXITAC], GETSEC[SEXIT], GETSEC[SMCTRL] or for specific VMX related opera- 
tions such as a VM entry or the VMXOFF instruction (see respective GETSEC leaves and Inte/® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 3C for more details). The state of the A20M pin is masked and 
forced internally to a de-asserted state so that external assertion is not recognized. A20M masking as set by 
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GETSEC[SENTER] is undone only after taking down the measured environment with the GETSEC[SEXIT] instruc- 
tion or processor reset. INTR is masked by simply clearing the EFLAGS.IF bit. It is the responsibility of system soft- 
ware to control the processor response to INTR through appropriate management of EFLAGS. 


To prevent other (logical) processors from interfering with the ILP operating in authenticated code execution mode, 
memory (excluding implicit write-back transactions) and I/O activities originating from other processor agents are 
blocked. This protection starts when the ILP enters into authenticated code execution mode. Only memory and I/O 
transactions initiated from the ILP are allowed to proceed. Exiting authenticated code execution mode is done by 

executing GETSEC[EXITAC]. The protection of memory and I/O activities remains in effect until the ILP executes 

GETSEC[EXITAC]. 


Once the authenticated code module has been loaded into the authenticated code execution area, it is protected 
against further modification from external bus snoops. There is also a requirement that the memory type for the 
authenticated code module address range be WB (via initialization of the MTRRs prior to execution of this instruc- 
tion). If this condition is not satisfied, it is a violation of security and the processor will force a TXT system reset 
(after writing an error code to the chipset LT.ERRORCODE register). This action is referred to as a Intel® TXT reset 
condition. It is performed when it is considered unreliable to signal an error through the conventional exception 
reporting mechanism. 


To conform to the minimum granularity of MTRR MSRs for specifying the memory type, authenticated code RAM 
(ACRAM) is allocated to the processor in 4096 byte granular blocks. If an AC module size as specified in ECX is not 
a multiple of 4096 then the processor will allocate up to the next 4096 byte boundary for mapping as ACRAM with 
indeterminate data. This pad area will not be visible to the authenticated code module as external memory nor can 
it depend on the value of the data used to fill the pad area. 


Once successful authentication has been completed by the ILP, the computed hash is stored in a trusted storage 
facility in the platform. The following trusted storage facility are supported: 


¢  =If the platform register FTM_INTERFACE_ID.[bits 3:0] = 0, the computed hash is stored to the platform’s TPM 
at PCR17 after this register is implicitly reset. PCR17 is a dedicated register for holding the computed hash of 
the authenticated code module loaded and subsequently executed by the GETSEC[SENTER]. As part of this 
process, the dynamic PCRs 18-22 are reset so they can be utilized by subsequently software for registration of 
code and data modules. 


¢ If the platform register FTM_INTERFACE_ID.[bits 3:0] = 1, the computed hash is stored in a firmware trusted 
module (FTM) using a modified protocol similar to the protocol used to write to TPM’s PCR17. 


After successful execution of SENTER, either PCR17 (if FTM is not enabled) or the FTM (if enabled) contains the 
measurement of AC code and the SENTER launching parameters. 


After authentication is completed successfully, the private configuration space of the Intel® TXT-capable chipset is 
unlocked so that the authenticated code module and measured environment software can gain access to this 
normally restricted chipset state. The Intel® TXT-capable chipset private configuration space can be locked later 
by software writing to the chipset LT.CMD.CLOSE-PRIVATE register or unconditionally using the GETSEC[SEXIT] 
instruction. 


The SENTER leaf function also initializes some processor architecture state for the ILP from contents held in the 
header of the authenticated code module. Since the authenticated code module is relocatable, all address refer- 
ences are relative to the base address passed in via EBX. The ILP GDTR base value is initialized to EBX + [GDTBa- 
sePtr] and GDTR limit set to [GDTLimit]. The CS selector is initialized to the value held in the AC module header 
field SegSel, while the DS, SS, and ES selectors are initialized to CS+8. The segment descriptor fields are initialized 
implicitly with BASE=0, LIMIT=FFFFFh, G=1, D=1, P=1, S=1, read/write/accessed for DS, SS, and ES, while 
execute/read/accessed for CS. Execution in the authenticated code module for the ILP begins with the EIP set to 
EBX + [EntryPoint]. AC module defined fields used for initializing processor state are consistency checked with a 
failure resulting in an TXT-shutdown condition. 


Table 6-6 provides a summary of processor state initialization for the ILP and RLP(s) after successful completion of 
GETSEC[SENTER]. For both ILP and RLP(s), paging is disabled upon entry to the measured environment. It is up to 
the ILP to establish a trusted paging environment, with appropriate mappings, to meet protection requirements 
established during the launch of the measured environment. RLP state initialization is not completed until a subse- 
quent wake-up has been signaled by execution of the GETSEC[ WAKEUP] function by the ILP. 
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Table 6-6. Register State Initialization after GETSEC[SENTER] and GETSEC[WAKEUP] 


Register State ILP after GETSEC[SENTER] RLP after GETSEC[WAKEUP] 

CRO PG<0, AM<0, WP<-0; Others unchanged PG<0, CD0, NW<0, AM<0, WP<-0; PE<-1, NE<-1 

CR4 00004000H 00004000H 

EFLAGS 00000002H 00000002H 

IA32_EFER OH 0 

EIP [EntryPoint from MLE header!] ([LT.MLEJOIN + 12] 

EBX Unchanged [SINIT.BASE] Unchanged 

EDX SENTER control flags Unchanged 

EBP SINIT.BASE Unchanged 

cs Sel=[SINIT SegSel], base=0, limit=FFFFFH, G=1, Sel = [LT.MLEJOIN + 8], base = 0, limit = FFFFFH, G = 
D=1, AR=9BH 1,D = 1, AR = SBH 

DS, ES, SS Sel=[SINIT SegSel] +8, base=0, limit=FFFFFA, G=1, | Sel = [LT.MLEJOIN + 8] +8, base = 0, limit = FFFFFH, 
D=1, AR=93H G=1,D=1, AR = 93H 

GDTR Base= SINIT.base (EBX) + [SINIT.GDTBasePtr], Base = [LT.MLEJOIN + 4], Limit = [LT.MLEJOIN] 
Limit=[SINIT.GDTLimit] 

DR7 00000400H 00000400H 

IA32_DEBUGCTL OH OH 

Performance OH OH 

counters and counter 

control registers 

IA32_MISC_ENABLE See Table 6-5 See Table 6-5 

IA32_SMM_MONITOR | Bit 2-0 Bit 20 

_CTL 

NOTES: 


1. See Inte/® Trusted Execution Technology Measured Launched Environment Programming Guide for MLE header 
format. 


Segmentation related processor state that has not been initialized by GETSEC[SENTER] requires appropriate 
initialization before use. Since a new GDT context has been established, the previous state of the segment selector 
values held in FS, GS, TR, and LDTR may no longer be valid. The IDTR will also require reloading with a new IDT 
context after launching the measured environment before exceptions or the external interrupts INTR and NMI can 
be handled. In the meantime, the programmer must take care in not executing an INT n instruction or any other 
condition that would result in an exception or trap signaling. 


Debug exception and trap related signaling is also disabled as part of execution of GETSEC[SENTER]. This is 
achieved by clearing DR7, TF in EFLAGs, and the MSR IA32_DEBUGCTL as defined in Table 6-6. These can be re- 
enabled once supporting exception handler(s), descriptor tables, and debug registers have been properly re-initial- 
ized following SENTER. Also, any pending single-step trap condition will be cleared at the completion of SENTER for 
both the ILP and RLP(s). 


Performance related counters and counter control registers are cleared as part of execution of SENTER on both the 
ILP and RLP. This implies any active performance counters at the time of SENTER execution will be disabled. To 
reactive the processor performance counters, this state must be re-initialized and re-enabled. 


Since MCE along with all other state bits (with the exception of SMXE) are cleared in CR4 upon execution of SENTER 
processing, any enabled machine check error condition that occurs will result in the processor performing the TXT- 
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shutdown action. This also applies to an RLP while in the SENTER sleep state. For each logical processor CR4.MCE 
must be reestablished with a valid machine check exception handler to otherwise avoid an TXT-shutdown under 
such conditions. 


The MSR IA32_EFER is also unconditionally cleared as part of the processor state initialized by SENTER for both the 
ILP and RLP. Since paging is disabled upon entering authenticated code execution mode, a new paging environ- 
ment will have to be re-established if it is desired to enable IA-32e mode while operating in authenticated code 
execution mode. 


The miscellaneous feature control MSR, IA32_MISC_ENABLE, is initialized as part of the measured environment 
launch. Certain bits of this MSR are preserved because preserving these bits may be important to maintain previ- 
ously established platform settings. See the footnote for Table 6-5 The remaining bits are cleared for the purpose 
of establishing a more consistent environment for the execution of authenticated code modules. Among the impact 
of initializing this MSR, any previous condition established by the MONITOR instruction will be cleared. 


Effect of MSR IA32_FEATURE_CONTROL MSR 


Bits 15:8 of the IA32_FEATURE_CONTROL MSR affect the execution of GETSEC[SENTER]. These bits consist of two 
fields: 


¢ Bit 15: a global enable control for execution of SENTER. 


¢ Bits 14:8: a parameter control field providing the ability to qualify SENTER execution based on the level of 
functionality specified with corresponding EDX parameter bits 6:0. 


The layout of these fields in the IA32_FEATURE_CONTROL MSR is shown in Table 6-1. 


Prior to the execution of GETSEC[SENTER], the lock bit of IA32_FEATURE_CONTROL MSR must be bit set to affirm 
the settings to be used. Once the lock bit is set, only a power-up reset condition will clear this MSR. The 
IA32_FEATURE_CONTROL MSR must be configured in accordance to the intended usage at platform initialization. 
Note that this MSR is only available on SMX or VMX enabled processors. Otherwise, IA32_FEATURE_CONTROL is 
treated as reserved. 


The Intel® Trusted Execution Technology Measured Launched Environment Programming Guide provides additional details and 
requirements for programming measured environment software to launch in an Intel TXT platform. 


Operation in a Uni-Processor Platform 
(* The state of the internal flag ACMODEFLAG and SENTERFLAG persist across instruction boundary *) 
GETSEC[SENTER] (ILP only): 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSE IF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction’); 
ELSE IF (GETSEC leaf unsupported) 
THEN #UD; 
ELSE IF ((in VMX root operation) or 
(CRO.PE=0) or (CRO.CD=1) or (CRO.NW=1) or (CRO.NE=0) or 
(CPL>O) or (EFLAGS.VM=1) or 
(IA32_APIC_BASE.BSP=0) or (TXT chipset not present) or 
(SENTERFLAG=1) or (ACMODEFLAG=1) or (IN_'SMM=1) or 
(TPM interface is not present) or 
(EDX + (SENTER_EDX_support_mask & EDX)) or 
(IA32_FEATURE_CONTROL[0]=0) or (IA32_FEATURE_CONTROL[15]=0) or 
((IA32_FEATURE_CONTROL[1 4:8] & EDX[6:0]) + EDX[6:0])) 
THEN #GP(0); 
IF (GETSEC[PARAMETERS].Parameter_Type = 5, MCA_Handling (bit 6) = 0) 
FOR | = 0 to IA32_MCG_CAP.COUNT-1 DO 
IF IA32_MC[I]_STATUS = uncorrectable error 
THEN #GP(0); 
Fl; 
OD; 
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FI; 

IF (IA32_MCG_STATUS.MCIP=1) or (IERR pin is asserted) 
THEN #GP(0); 

ACBASE := EBX; 

ACSIZE := ECX; 

IF (((ACBASE MOD 4096) + 0) or ((ACSIZE MOD 64) + 0) or (ACSIZE < minimum 
module size) or (ACSIZE > AC RAM capacity) or ((ACBASE+ACSIZE) > (232 -1))) 

THEN #GP(0); 

Mask SMI, INIT, A20M, and NMI external pin events; 

SignalTXTMsg(SENTER); 

DO 

WHILE (no SignalSENTER message); 


TXT_SENTER__MSG_EVENT (ILP & RLP): 
Mask and clear SignalSENTER event; 
Unmask SignalSEXIT event; 
IF (in VMX operation) 
THEN TXT-SHUTDOWN(#lllegalEvent); 
FOR | = 0 to IA32_MCG_CAP.COUNT-1 DO 
IF [A32_MC[I]_ STATUS = uncorrectable error 
THEN TXT-SHUTDOWN(#UnrecovMCError); 
Fl; 
OD; 
IF (IA32_MCG_STATUS.MCIP=1) or (IERR pin is asserted) 
THEN TXT-SHUTDOWN(#UnrecovMCError); 
IF (Voltage or bus ratio status are NOT at a known good state) 
THEN IF (Voltage select and bus ratio are internally adjustable) 
THEN 
Make product-specific adjustment on operating parameters; 
ELSE 
TXT-SHUTDOWN(#illegalVIDBRatio); 
Fl; 


IA32_MISC_ENABLE := (IA32_MISC_ENABLE & MASK_CONST*) 
(* The hexadecimal value of MASK_CONST may vary due to processor implementations *) 
A20M := 0; 

IA32_DEBUGCTL := 0; 

Invalidate processor TLB(s); 

Drain outgoing transactions; 

Clear performance monitor counters and control; 

SENTERFLAG := 1; 

SignalTXTMsg(SENTERAck); 

IF (logical processor is not ILP) 

THEN GOTO RLP_SENTER_ROUTINE; 

(* ILP waits for all logical processors to ACK *) 

DO 
DONE := TXT.READ(LT.STS); 

WHILE (not DONE); 

SignalTXTMsg(SENTERContinue); 

SignalTXTMsg(ProcessorHold); 

FOR I=ACBASE to ACBASE+ACSIZE-1 DO 
ACRAM[I-ACBASE].ADDR := |; 
ACRAM[I-ACBASE].DATA := LOAD(); 

OD; 


6-26 Vol. 2D GETSEC[SENTER]J—Enter a Measured Environment 


SAFER MODE EXTENSIONS REFERENCE 


IF (ACRAM memory type + WB) 
THEN TXT-SHUTDOWN(#BadACMMT ype); 

IF (AC module header version is not supported) OR (ACRAM[ModuleType] # 2) 
THEN TXT-SHUTDOWN(#UnsupportedACM); 

KEY := GETKEY(ACRAM, ACBASE); 

KEYHASH := HASH(KEY); 

CSKEYHASH := LT.READ(LT.PUBLIC.KEY); 

IF (KEYHASH # CSKEYHASH) 
THEN TXT-SHUTDOWN(#AuthenticateFail); 

SIGNATURE := DECRYPT(ACRAM, ACBASE, KEY); 

(* The value of SIGNATURE_LEN_CONST is implementation-specific*) 

FOR I=0 to SIGNATURE_LEN_CONST - 1 DO 
ACRAM[SCRATCH.I] := SIGNATURE[I]; 

COMPUTEDSIGNATURE := HASH(ACRAM, ACBASE, ACSIZE); 

FOR I=0 to SIGNATURE_LEN_CONST - 1 DO 
ACRAM[SCRATCH.SIGNATURE_LEN_CONST +I] := COMPUTEDSIGNATURE[I]; 

IF (SIGNATURE # COMPUTEDSIGNATURE) 
THEN TXT-SHUTDOWN(#AuthenticateFail); 

ACMCONTROL := ACRAM[CodeControl]; 

IF (ACMCONTROL.O = 0) and (ACMCONTROL.1 = 1) and (snoop hit to modified line detected on ACRAM load)) 
THEN TXT-SHUTDOWN(#UnexpectedHITM); 

IF (ACMCONTROL reserved bits are set) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF ((ACRAM[GDTBasePtr] < (ACRAM[HeaderLen] * 4 + Scratch_size)) OR 
((ACRAM[GDTBasePtr] + ACRAM[GDTLimit]) >= ACSIZE)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACMCONTROL.O = 1) and (ACMCONTROL.1 = 1) and (snoop hit to modified 
line detected on ACRAM load)) 
THEN ACEntryPoint := ACBASE+ACRAM[ErrorEntryPoint]; 

ELSE 
ACEntryPoint := ACBASE+ACRAM[EntryPoint]; 

IF ((ACEntryPoint >= ACSIZE) or (ACEntryPoint < (ACRAM[HeaderLen] * 4 + Scratch_size))) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[SegSel] > (ACRAM[GDTLimit] - 15)) or (ACRAM[SegSel] < 8)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 

IF (ACRAM[SegSel].Tl=1) or (ACRAM[SegSel].RPL+0)) 
THEN TXT-SHUTDOWN(#BadACMFormat); 


IF (FTM_INTERFACE_ID.[3:0] = 1 ) (* Alternate FTM Interface has been enabled *) 
THEN (* TPM_LOC_CTRL_4 is located at OFED44008H, TMP_DATA_BUFFER_4 is located at OFED44080H *) 
WRITE(TPM_LOC_CTRL_4) := 01H; (* Modified HASH.START protocol *) 
(* Write to firmware storage *) 
WRITE(TPM_DATA_BUFFER_4) := SIGNATURE_LEN_CONST + 4; 
FOR I=0 to SIGNATURE_LEN_CONST - 1 DO 
WRITE(TPM_DATA_BUFFER_4 + 2 +1) := ACRAM[SCRATCH1I]; 
WRITE(TPM_DATA_BUFFER_4 + 2 + SIGNATURE_LEN_CONST) := EDX; 
WRITE(FTM.LOC_CTRL) := O6H; (* Modified protocol combining HASH.DATA and HASH.END *) 
ELSE IF (FTM_INTERFACE_ID.[3:0] = 0 ) (* Use standard TPM Interface *) 
ACRAM[SCRATCH.SIGNATURE_LEN_CONST] := EDX; 
WRITE(TPM.HASH.START) := 0; 
FOR I=0 to SIGNATURE_LEN_CONST + 3 DO 
WRITE(TPM.HASH.DATA) := ACRAM[SCRATCH.I]; 
WRITE(TPM.HASH.END) := 0; 
FI; 
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ACMODEFLAG := 1; 
CRO.[PG.AM.WP] := 0; 

CR4 := 00004000h; 

EFLAGS := 00000002h; 
IA32_EFER := 0; 

EBP := ACBASE; 

GDTR.BASE := ACBASE+ACRAM[GDTBasePtr]; 
GDTR.LIMIT := ACRAM[GDTLimit]; 
CS.SEL := ACRAM[SegSel]; 
CS.BASE := 0; 

CS.LIMIT := FFFFFH; 

CS.G:= 1; 

CS.D:= 1; 

CS.AR := 9Bh; 

DS.SEL := ACRAM[SegSel]+8; 
DS.BASE := 0; 

DS.LIMIT := FFFFFh; 

DS.G := 1; 

DS.D := 1; 

DS.AR := 93h; 

SS := DS; 

ES := DS; 

DR7 := 00000400h; 
IA32_DEBUCCTL := 0; 
SignalTXTMsg(UnlockSMRAM); 
SignalTXTMsg(OpenPrivate); 
SignalTXTMsg(OpenLocality3); 
EIP := ACEntryPoint; 

END; 


RLP_SENTER_ROUTINE: (RLP only) 

Mask SMI, INIT, A20M, and NMI external pin events 
Unmask SignalWAKEUP event; 

Wait for SignalSENTERContinue message; 
IA32_APIC_BASE.BSP := 0; 

GOTO SENTER sleep state; 

END; 


Flags Affected 
All flags are cleared. 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 
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Protected Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SENTER] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) If CRO.CD = 1 or CRO.NW = 1 or CRO.NE = 0 or CRO.PE = O or CPL > O or EFLAGS.VM = 1. 


If in VMX root operation. 


If the initiating processor is not designated as the bootstrap processor via the MSR bit 
IA32_APIC_BASE.BSP. 


If an Intel® TXT-capable chipset is not present. 
If an Intel® TXT-capable chipset interface to TPM is not detected as present. 


If a protected partition is already active or the processor is already in authenticated code 
mode. 


If the processor is in SMM. 
If a valid uncorrectable machine check error is logged in IA32_MC[I]_STATUS. 
If the authenticated code base is not on a 4096 byte boundary. 


If the authenticated code size > processor's authenticated code execution area storage 
capacity. 
If the authenticated code size is not modulo 64. 


Real-Address Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SENTER] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SENTER] is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SENTER] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SENTER] is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 
#GP IF AC code module does not reside in physical address below 2%32 -1. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 
#GP IF AC code module does not reside in physical address below 2%32 -1. 


VM-Exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[SEXIT]—Exit Measured Environment 


Opcode Instruction Description 

NP OF 37 GETSEC{SEXIT] Exit measured environment. 
(EAX=5) 

Description 


The GETSEC[SEXIT] instruction initiates an exit of a measured environment established by GETSEC[SENTER]. The 
SEXIT leaf of GETSEC is selected with EAX set to 5 at execution. This instruction leaf sends a message to all logical 
processors in the platform to signal the measured environment exit. 


There are restrictions enforced by the processor for the execution of the GETSEC[SEXIT] instruction: 

¢® Execution is not allowed unless the processor is in protected mode (CRO.PE = 1) with CPL = 0 and EFLAGS.VM 
=0. 

¢ The processor must be in a measured environment as launched by a previous GETSEC[SENTER] instruction, 
but not still in authenticated code execution mode. 

° To avoid potential inter-operability conflicts between modes, the processor is not allowed to execute this 
instruction if it currently is in SMM or in VMX operation. 


¢ To ensure consistent handling of SIPI messages, the processor executing the GETSEC[SEXIT] instruction must 
also be designated the BSP (bootstrap processor) as defined by the register bit IA32_APIC_BASE.BSP (bit 8). 


Failure to abide by the above conditions results in the processor signaling a general protection violation. 


This instruction initiates a sequence to rendezvous the RLPs with the ILP. It then clears the internal processor flag 
indicating the processor is operating in a measured environment. 


In response to a message signaling the completion of rendezvous, all RLPs restart execution with the instruction 
that was to be executed at the time GETSEC[SEXIT] was recognized. This applies to all processor conditions, with 
the following exceptions: 


¢ If an RLP executed HLT and was in this halt state at the time of the message initiated by GETSEC[SEXIT], then 
execution resumes in the halt state. 


¢ If an RLP was executing MWAIT, then a message initiated by GETSEC[SEXIT] causes an exit of the MWAIT state, 
falling through to the next instruction. 


¢ If an RLP was executing an intermediate iteration of a string instruction, then the processor resumes execution 
of the string instruction at the point which the message initiated by GETSEC[SEXIT] was recognized. 


° IfanRLP is still in the SENTER sleep state (never awakened with GETSEC[WAKEUP]), it will be sent to the wait- 
for-SIPI state after first clearing the bootstrap processor indicator flag (IA32_APIC_BASE.BSP) and any 
pending SIPI state. In this case, such RLPs are initialized to an architectural state consistent with having taken 
a soft reset using the INIT# pin. 


Prior to completion of the GETSEC[SEXIT] operation, both the ILP and any active RLPs unmask the response of the 
external event signals INIT#, A20M, NMI#, and SMI#. This unmasking is performed unconditionally to recognize 
pin events which are masked after a GETSEC[SENTER]. The state of A20M is unmasked, as the A20M pin is not 
recognized while the measured environment is active. 


On a successful exit of the measured environment, the ILP re-locks the Intel® TXT-capable chipset private config- 
uration space. GETSEC[SEXIT] does not affect the content of any PCR. 


At completion of GETSEC[SEXIT] by the ILP, execution proceeds to the next instruction. Since EFLAGS and the 
debug register state are not modified by this instruction, a pending trap condition is free to be signaled if previously 
enabled. 
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Operation in a Uni-Processor Platform 
(* The state of the internal flag ACMODEFLAG and SENTERFLAG persist across instruction boundary *) 


GETSEC[SEXIT] (ILP only): 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSE IF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction”); 
ELSE IF (GETSEC leaf unsupported) 
THEN #UD; 
ELSE IF ((in VMX root operation) or 
(CRO.PE=0) or (CPL>O) or (EFLAGS.VM=1) or 
(IA32_APIC_BASE.BSP=0) or 
(TXT chipset not present) or 
(SENTERFLAG=0) or (ACMODEFLAG=1) or (IN_'SMM=1)) 
THEN #GP(0); 
SignalTXTMsg(SEXIT); 
DO 
WHILE (no SignalSEXIT message); 


TXT_SEXIT_MSG_EVENT (ILP & RLP): 
Mask and clear SignalSEXIT event; 
Clear MONITOR FSM; 
Unmask SignalSENTER event; 
IF (in VMX operation) 
THEN TXT-SHUTDOWN(#lllegalEvent); 
SignalTXTMsg(SEXITAck); 
IF (logical processor is not ILP) 
THEN GOTO RLP_SEXIT_ROUTINE; 
(* ILP waits for all logical processors to ACK *) 
DO 
DONE := READ(LT.STS); 
WHILE (NOT DONE); 
SignalTXTMsg(SEX!T Continue); 
SignalTXTMsg(ClosePrivate); 
SENTERFLAG := 0; 
Unmask SMI, INIT, A2OM, and NMI external pin events; 
END; 


RLP_SEXIT_ROUTINE (RLPs only): 
Wait for SignalSEXITContinue message; 
Unmask SMI, INIT, A2OM, and NMI external pin events; 
IF (prior execution state = HLT) 
THEN reenter HLT state; 
IF (prior execution state = SENTER sleep) 
THEN 
IA32_APIC_BASE.BSP := 0; 
Clear pending SIPI state; 
Call INIT_PROCESSOR_STATE; 
Unmask SIPI event; 
GOTO WAIT-FOR-SIPI; 
Fl; 
END; 
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Flags Affected 
ILP: None. 
RLPs: all flags are modified for an RLP. returning to wait-for-SIPI state, none otherwise. 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 


Protected Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SEXIT] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) If CRO.PE = 0 or CPL > O or EFLAGS.VM = 1. 


If in VMX root operation. 
If the initiating processor is not designated via the MSR bit IA32_APIC_BASE.BSP. 
If an Intel® TXT-capable chipset is not present. 


If a protected partition is not already active or the processor is already in authenticated code 
mode. 


If the processor is in SMM. 


Real-Address Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SEXIT] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SEXIT] is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SEXIT] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SEXIT] is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 


VM-Exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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Opcode Instruction Description 

NP OF 37 GETSEC[PARAMETERS] | Report the SMX parameters. 

(EAX=6) The parameters index is input in EBX with the result returned in EAX, EBX, and ECX. 
Description 


The GETSEC[PARAMETERS] instruction returns specific parameter information for SMX features supported by the 
processor. Parameter information is returned in EAX, EBX, and ECX, with the input parameter selected using EBX. 


Software retrieves parameter information by searching with an input index for EBX starting at 0, and then reading 
the returned results in EAX, EBX, and ECX. EAX[4:0] is designated to return a parameter type field indicating if a 
parameter is available and what type it is. If EAX[4:0] is returned with 0, this designates a null parameter and indi- 


cates no more parameters are available. 


Table 6-7 defines the parameter types supported in current and future implementations. 


Table 6-7. SMX Reporting Parameters Format 


Parameter 
Type EAX[4:0] | Parameter Description EAX[31:5] EBX[31:0] ECX[31:0] 
0 NULL Reserved (0 returned) Reserved (unmodified) Reserved (unmodified) 
1 Supported AC module Reserved (0 returned) Version comparison mask | Version numbers 
versions supported 
2 Max size of authenticated | Multiply by 32 for size in Reserved (unmodified) Reserved (unmodified) 
code execution area bytes 
3 External memory types Memory type bit mask Reserved (unmodified) Reserved (unmodified) 
supported during AC mode 
4 Selective SENTER EAX[1 4:8] correspond to Reserved (unmodified) Reserved (unmodified) 
functionality control available SENTER function 
disable controls 
5 TXT extensions support TXT Feature Extensions Reserved Reserved 
Flags (see Table 6-8) 
6-31 Undefined Reserved (unmodified) Reserved (unmodified) Reserved (unmodified) 
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Table 6-8. TXT Feature Extensions Flags 


Bit Definition Description 


5 Processor based Returns 1 if this processor implements a processor-rooted S-CRTM capability and 0 if not (S- 
S-CRTM support CRTM is rooted in BIOS). 

This flag cannot be used to infer whether the chipset supports TXT or whether the 
processor support SMX. 


6 Machine Check Returns 1 if it machine check status registers can be preserved through ENTERACCS and 
Handling SENTER. If this bit is 1, the caller of ENTERACCS and SENTER is not required to clear machine 
check error status bits before invoking these GETSEC leaves. 

If this bit returns O, the caller of ENTERACCS and SENTER must clear all machine check error 
status bits before invoking these GETSEC leaves. 


31:7 Reserved Reserved for future use. Will return 0. 


Supported AC module versions (as defined by the AC module HeaderVersion field) can be determined for a partic- 
ular SMX capable processor by the type 1 parameter. Using EBX to index through the available parameters reported 
by GETSEC[PARAMETERS] for each unique parameter set returned for type 1, software can determine the complete 
list of AC module version(s) supported. 


For each parameter set, EBX returns the comparison mask and ECX returns the available HeaderVersion field 
values supported, after AND'ing the target HeaderVersion with the comparison mask. Software can then determine 
if a particular AC module version is supported by following the pseudo-code search routine given below: 


parameter_search_index= 0 
do { 
EBX= parameter_search_index++ 
EAX=6 
GETSEC 
if (EAX[4:0] = 1) { 
if ((version_query & EBX) = ECX) { 
version_is_supported= 1 
break 


} 


} 
} while (EAX[4:0] + 0) 


If only AC modules with a HeaderVersion of 0 are supported by the processor, then only one parameter set of type 
1 will be returned, as follows: EAX = OOOOOOOI1H, 


EBX = FFFFFFFFH and ECX = OO0OQO0000H. 


The maximum capacity for an authenticated code execution area supported by the processor is reported with the 
parameter type of 2. The maximum supported size in bytes is determined by multiplying the returned size in 
EAX[31:5] by 32. Thus, for a maximum supported authenticated RAM size of 32KBytes, EAX returns with 
00008002H. 


Supportable memory types for memory mapped outside of the authenticated code execution area are reported 
with the parameter type of 3. While is active, as initiated by the GETSEC functions SENTER and ENTERACCS and 
terminated by EXITAC, there are restrictions on what memory types are allowed for the rest of system memory. It 
is the responsibility of the system software to initialize the memory type range register (MTRR) MSRs and/or the 
page attribute table (PAT) to only map memory types consistent with the reporting of this parameter. The reporting 
of supportable memory types of external memory is indicated using a bit map returned in EAX[31:8]. These bit 
positions correspond to the memory type encodings defined for the MTRR MSR and PAT programming. See 

Table 6-9. 


The parameter type of 4 is used for enumerating the availability of selective GETSEC[SENTER] function disable 
controls. If a 1 is reported in bits 14:8 of the returned parameter EAX, then this indicates a disable control capa- 
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bility exists with SENTER for a particular function. The enumerated field in bits 14:8 corresponds to use of the EDX 
input parameter bits 6:0 for SENTER. If an enumerated field bit is set to 1, then the corresponding EDX input 
parameter bit of EDX may be set to 1 to disable that designated function. If the enumerated field bit is 0 or this 
parameter is not reported, then no disable capability exists with the corresponding EDX input parameter for 
SENTER, and EDX bit(s) must be cleared to 0 to enable execution of SENTER. If no selective disable capability for 
SENTER exists as enumerated, then the corresponding bits in the IA32_FEATURE_CONTROL MSR bits 14:8 must 
also be programmed to 1 if the SENTER global enable bit 15 of the MSR is set. This is required to enable future 
extensibility of SENTER selective disable capability with respect to potentially separate software initialization of the 


MSR. 
Table 6-9. External Memory Types Using Parameter 3 
EAX Bit Position Parameter Description 
8 Uncacheable (UC) 
9 Write Combining (WC) 
11:10 Reserved 
12 Write-through (WT) 
13 Write-protected (WP) 
14 Write-back (WB) 
31:15 Reserved 


If the GETSEC[PARAMETERS] leaf or specific parameter is not present for a given SMX capable processor, then 
default parameter values should be assumed. These are defined in Table 6-10. 


Table 6-10. Default Parameter Values 


Parameter Type EAX[4:0] Default Setting Parameter Description 
1 0.0 only Supported AC module versions. 
2 32 KBytes Authenticated code execution area size. 
3 UC only External memory types supported during AC execution mode. 
4 None Available SENTER selective disable controls. 
Operation 


(* example of a processor supporting only a 0.0 HeaderVersion, 32K ACRAM size, memory types UC and WC *) 


IF (CR4.SMXE=0) 
THEN #UD; 


ELSE IF (in VMX non-root operation) 


THEN VM Exit (reason="GETSEC instruction’); 


ELSE IF (GETSEC leaf unsupported) 


THEN #UD; 


(* example of a processor supporting a 0.0 HeaderVersion *) 


IF (EBX=0) THEN 
EAX := 00000001h; 
EBX := FFFFFFFFh; 
ECX := 00000000h; 

ELSE IF (EBX=1) 


(* example of a processor supporting a 32K ACRAM size *) 
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THEN EAX := 00008002h; 
ESE IF (EBX= 2) 
(* example of a processor supporting external memory types of UC and WC *) 
THEN EAX := 00000303h; 
ESE IF (EBX= other value(s) less than unsupported index value) 
(* EAX value varies. Consult Table 6-7 and Table 6-8*) 
ELSE (* unsupported index*) 
EAX := OOO00000h; 
END; 


Flags Affected 
None. 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 


Protected Mode Exceptions 
#UD If CR4.SMXE = 0. 
If GETSEC[PARAMETERS] is not reported as supported by GETSEC[CAPABILITIES]. 


Real-Address Mode Exceptions 
#UD If CR4.SMXE = 0. 
If GETSEC[PARAMETERS] is not reported as supported by GETSEC[CAPABILITIES]. 


Virtual-8086 Mode Exceptions 
#UD If CR4.SMXE = 0. 
If GETSEC[PARAMETERS] is not reported as supported by GETSEC[CAPABILITIES]. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 


VM-Exit Condition 
Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[SMCTRL]—SMX Mode Control 


Opcode Instruction Description 
NP OF 37 (EAX = 7) | GETSEC[SMCTRL] Perform specified SMX mode control as selected with the input EBX. 
Description 


The GETSEC[SMCTRL] instruction is available for performing certain SMX specific mode control operations. The 
operation to be performed is selected through the input register EBX. Currently only an input value in EBX of 0 is 
supported. All other EBX settings will result in the signaling of a general protection violation. 


If EBX is set to 0, then the SMCTRL leaf is used to re-enable SMI events. SMI is masked by the ILP executing the 
GETSEC[SENTER] instruction (SMI is also masked in the responding logical processors in response to SENTER 
rendezvous messages.). The determination of when this instruction is allowed and the events that are unmasked 
is dependent on the processor context (See Table 6-11). For brevity, the usage of SMCTRL where EBX=0 will be 
referred to as GETSEC[SMCTRL(0)]. 


As part of support for launching a measured environment, the SMI, NMI and INIT events are masked after 
GETSEC[SENTER], and remain masked after exiting authenticated execution mode. Unmasking these events 
should be accompanied by securely enabling these event handlers. These security concerns can be addressed in 
VMX operation by a MVMM. 


The VM monitor can choose two approaches: 


¢ Inadual monitor approach, the executive software will set up an SMM monitor in parallel to the executive VMM 
(i.e. the MVMM), see Chapter 30, “System Management Mode” of Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3C. The SMM monitor is dedicated to handling SMI events without compromising 
the security of the MVMM. This usage model of handling SMI while a measured environment is active does not 
require the use of GETSEC[SMCTRL(0)] as event re-enabling after the VMX environment launch is handled 
implicitly and through separate VMX based controls. 


° If a dedicated SMM monitor will not be established and SMIs are to be handled within the measured 
environment, then GETSEC[SMCTRL(0)] can be used by the executive software to re-enable SMI that has been 
masked as a result of SENTER. 


Table 6-11 defines the processor context in which GETSEC[SMCTRL(0)] can be used and which events will be 
unmasked. Note that the events that are unmasked are dependent upon the currently operating processor context. 


Table 6-11. Supported Actions for GETSEC[SMCTRL(0)] 


ILP Mode of Operation SMCTRL execution action 
In VMX non-root operation VM exit 

SENTERFLAG = 0 #GP(0), illegal context 

In authenticated code execution mode #GP(0), illegal context 
(ACMODEFLAG = 1) 

SENTERFLAG = 1, not in VMX operation, not in Unmask SMI 

SMM 


SENTERFLAG = 1, in VMX root operation, not in Unmask SMI if SMM monitor is not configured, otherwise #GP(0) 
SMM 


SENTERFLAG = 1, In VMX root operation, in SMM #GP(0), illegal context 
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Operation 
(* The state of the internal flag ACMODEFLAG and SENTERFLAG persist across instruction boundary *) 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSE IF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction”); 
ELSE IF (GETSEC leaf unsupported) 
THEN #UD; 
ELSE IF ((CRO.PE=0) or (CPL>O) OR (EFLAGS.VM=1)) 
THEN #GP(0); 
ELSE IF((EBX=0) and (SENTERFLAG=1) and (ACMODEFLAG=0) and (IN_SMM=0) and 
(((in VMX root operation) and (SMM monitor not configured)) or (not in VMX operation)) ) 
THEN unmask SMI; 
ELSE 
#GP(0); 
END 


Flags Affected 
None. 


Use of Prefixes 


LOCK Causes #UD. 

REP* Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Operand size Causes #UD. 

NP 66/F2/F3 prefixes are not allowed. 

Segment overrides Ignored. 

Address size Ignored. 

REX Ignored. 


Protected Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SMCTRL] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) If CRO.PE = 0 or CPL > O or EFLAGS.VM = 1. 


If in VMX root operation. 


If a protected partition is not already active or the processor is currently in authenticated code 
mode. 


If the processor is in SMM. 
If the SMM monitor is not configured. 


Real-Address Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SMCTRL] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SMCTRL] is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD If CR4.SMXE = 0. 
If GETSEC[SMCTRL] is not reported as supported by GETSEC[CAPABILITIES]. 
#GP(0) GETSEC[SMCTRL] is not recognized in virtual-8086 mode. 
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All protected mode exceptions apply. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 


VM-exit Condition 


Reason (GETSEC) IF in VMX non-root operation. 
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GETSEC[WAKEUP]—Wake up sleeping processors in measured environment 


Opcode Instruction Description 

NP OF 37 GETSEC[WAKEUP] Wake up the responding logical processors from the SENTER sleep state. 
(EAX=8) 

Description 


The GETSEC[WAKEUP] leaf function broadcasts a wake-up message to all logical processors currently in the 
SENTER sleep state. This GETSEC leaf must be executed only by the ILP, in order to wake-up the RLPs. Responding 
logical processors (RLPs) enter the SENTER sleep state after completion of the SENTER rendezvous sequence. 


The GETSEC[WAKEUP] instruction may only be executed: 

¢ Inameasured environment as initiated by execution of GETSEC[SENTER]. 

* Outside of authenticated code execution mode. 

¢ Execution is not allowed unless the processor is in protected mode with CPL = 0 and EFLAGS.VM = 0. 


¢ In addition, the logical processor must be designated as the boot-strap processor as configured by setting 
IA32_APIC_BASE.BSP = 1. 


If these conditions are not met, attempts to execute GETSEC[WAKEUP] result in a general protection violation. 


An RLP exits the SENTER sleep state and start execution in response to a WAKEUP signal initiated by ILP’s execution 
of GETSEC[WAKEUP]. The RLP retrieves a pointer to a data structure that contains information to enable execution 
from a defined entry point. This data structure is located using a physical address held in the Intel® TXT-capable 
chipset configuration register LT.MLE.JOIN. The register is publicly writable in the chipset by all processors and is 
not restricted by the Intel® TXT-capable chipset configuration register lock status. The format of this data structure 
is defined in Table 6-12. 


Table 6-12. RLP MVMM JOIN Data Structure 


Offset Field 

0 GDT limit 

4 CDT base pointer 

8 Segment selector initializer 
12 EIP 


The MLE JOIN data structure contains the information necessary to initialize RLP processor state and permit the 
processor to join the measured environment. The GDTR, LIP, and CS, DS, SS, and ES selector values are initialized 
using this data structure. The CS selector index is derived directly from the segment selector initializer field; DS, 
SS, and ES selectors are initialized to CS+8. The segment descriptor fields are initialized implicitly with BASE = 0, 
LIMIT = FFFFFH,G=1,D=1,P=1,S = 1; read/write/access for DS, SS, and ES; and execute/read/access for 
CS. It is the responsibility of external software to establish a GDT pointed to by the MLE JOIN data structure that 
contains descriptor entries consistent with the implicit settings initialized by the processor (see Table 6-6). Certain 
states from the content of Table 6-12 are checked for consistency by the processor prior to execution. A failure of 
any consistency check results in the RLP aborting entry into the protected environment and signaling an Intel® TXT 
shutdown condition. The specific checks performed are documented later in this section. After successful comple- 
tion of processor consistency checks and subsequent initialization, RLP execution in the measured environment 
begins from the entry point at offset 12 (as indicated in Table 6-12). 
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Operation 
(* The state of the internal flag ACMODEFLAG and SENTERFLAG persist across instruction boundary *) 
IF (CR4.SMXE=0) 
THEN #UD; 
ELSE IF (in VMX non-root operation) 
THEN VM Exit (reason="GETSEC instruction’); 
ELSE IF (GETSEC leaf unsupported) 
THEN #UD; 
ELSE IF ((CRO.PE=0) or (CPL>O) or (EFLAGS.VM=1) or (SENTERFLAG=0) or (ACMODEFLAG=1) or (IN_SMM=0) or (in VMX operation) or 
(IA32_APIC_BASE.BSP=0) or (TXT chipset not present)) 
THEN #GP(0); 
ELSE 
SignalTXTMsg(WAKEUP); 
END; 


RLP_SIPI_WAKEUP_FROM_SENTER_ROUTINE: (RLP only) 
WHILE (no SignalWAKEUP event); 
IF ([A32_SMM_MONITOR_CTL[0] # ILP.IA32_SMM_MONITOR_CTL[0]) 
THEN TXT-SHUTDOWN(#illlegalEvent) 
IF ([A32_SMM_MONITOR_CTL[0] = 0) 
THEN Unmask SMI pin event; 
ELSE 
Mask SMI pin event; 
Mask A20M, and NMI external pin events (unmask INIT); 
Mask SignalWAKEUP event; 
Invalidate processor TLB(s); 
Drain outgoing transactions; 
TempGDTRLIMIT := LOAD(LT.MLE.JOIN); 
TempGDTRBASE := LOAD(LT.MLEJOIN+4); 
TempSegSel := LOAD(LT.MLE.JOIN+8); 
TempElP := LOAD(LT.MLEJOIN+1 2); 
IF (TempGDTLimit & FFFFOOOOh) 
THEN TXT-SHUTDOWN(#BadJOINFormat); 
IF ((TempSegSel > TempGDTRLIMIT-15) or (TempSegSel < 8)) 
THEN TXT-SHUTDOWN(#BadJOINFormat); 
IF ((TempSegSel.Tl=1) or (TempSegSel.RPL+0)) 
THEN TXT-SHUTDOWN(#BadJOINFormat); 
CRO.[PG,CD,NW,AM,WP] := 0; 
CRO.[NE,PE] := 1; 
CR4 := 00004000h; 
EFLAGS := 00000002h; 
IA32_EFER := 0; 
GDTR.BASE := TempGDTRBASE; 
GDTR.LIMIT := TempGDTRLIMIT; 
CS.SEL := TempSegSel; 
CS.BASE := 0; 
CS.LIMIT := FFFFFh; 
CS.G:= 1; 
CS.D:= 1; 
CS.AR := SBh; 
DS.SEL := TempSegSel+8; 
DS.BASE := 0; 
DS.LIMIT := FFFFFh; 
DS.G := 1; 


GETSEC[WAKEUP]—Wake up sleeping processors in measured environment Vol.2D 6-41 


SAFER MODE EXTENSIONS REFERENCE 


DS.D := 1; 

DS.AR := 93h; 

SS := DS; 

ES := DS; 

DR7 := 00000400h; 
IA32_DEBUGCTL := 0; 
EIP := TempElP; 

END; 


Flags Affected 
None. 


Use of Prefixes 
LOCK 

REP* 

Operand size 

NP 

Segment overrides 
Address size 

REX 


Causes #UD. 

Cause #UD (includes REPNE/REPNZ and REP/REPE/REPZ). 
Causes #UD. 

66/F2/F3 prefixes are not allowed. 

Ignored. 

Ignored. 

Ignored. 


Protected Mode Exceptions 


#UD 


#GP(0) 


#UD 


#GP(0) 


If CR4.SMXE = 0. 

If GETSEC[WAKEUP] is not reported as supported by GETSEC[CAPABILITIES]. 
If CRO.PE = 0 or CPL > O or EFLAGS.VM = 1. 

If in VMX operation. 


If a protected partition is not already active or the processor is currently in authenticated code 
mode. 


If the processor is in SMM. 

If CR4.SMXE = 0. 

If GETSEC[WAKEUP] is not reported as supported by GETSEC[CAPABILITIES]. 
GETSEC[WAKEUP] is not recognized in real-address mode. 


Virtual-8086 Mode Exceptions 


#UD 


#GP(0) 


If CR4.SMXE = 0. 
If GETSEC[WAKEUP] is not reported as supported by GETSEC[CAPABILITIES]. 
GETSEC[WAKEUP] is not recognized in virtual-8086 mode. 


Compatibility Mode Exceptions 
All protected mode exceptions apply. 


64-Bit Mode Exceptions 
All protected mode exceptions apply. 


VM-exit Condition 
Reason (GETSEC) 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI" 
PROCESSORS 


This chapter describes the instruction set that is unique to Intel® Xeon Phi™ Processors based on the Knights 
Landing and Knights Mill microarchitectures. The set is not supported in any other Intel processors. Included are 
Intel® AVX-512 instructions. For additional instructions supported on these processors, see Chapter 3, “Instruction 
Set Reference, A-L”, Chapter 4, “Instruction Set Reference, M-U”, and Chapter 5, “Instruction Set Reference, V-Z”. 
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PREFETCHWT1—Prefetch Vector Data Into Caches with Intent to Write and T1 Hint 


Opcode/ Op/ | 64/32 bit | CPUIDFeature | Description 
Instruction En Mode Flag 
Support 
OF OD /2 M VIV PREFETCHWT1 | Move data from m8 closer to the processor using T1 hint 
PREFETCHWT1 m8 with intent to write. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) NA NA NA 
Description 


Fetches the line of data from memory that contains the byte specified with the source operand to a location in the 
cache hierarchy specified by an intent to write hint (so that data is brought into ‘Exclusive’ state via a request for 
ownership) and a locality hint: 


e T1 (temporal data with respect to first level cache)—prefetch data into the second level cache. 


The source operand is a byte memory location. (The locality hints are encoded into the machine level instruction 
using bits 3 through 5 of the ModR/M byte. Use of any ModR/M value other than the specified ones will lead to 
unpredictable behavior.) 


If the line selected is already present in the cache hierarchy at a level closer to the processor, no data movement 
occurs. Prefetches from uncacheable or WC memory are ignored. 


The PREFETCHWT1 instruction is merely a hint and does not affect program behavior. If executed, this instruction 
moves data closer to the processor in anticipation of future use. 


The implementation of prefetch locality hints is implementation-dependent, and can be overloaded or ignored by a 
processor implementation. The amount of data prefetched is also processor implementation-dependent. It will, 
however, be a minimum of 32 bytes. Additional details of the implementation-dependent locality hints are 
described in Section 9.5, “Memory Optimization Using Prefetch” of the Intel® 64 and IA-32 Architectures Optimi- 
zation Reference Manual. 


It should be noted that processors are free to speculatively fetch and cache data from system memory regions that 
are assigned a memory-type that permits speculative reads (that is, the WB, WC, and WT memory types). A 
PREFETCHWT1 instruction is considered a hint to this speculative behavior. Because this speculative fetching can 
occur at any time and is not tied to instruction execution, a PREFETCHWT1 instruction is not ordered with respect 
to the fence instructions (MFENCE, SFENCE, and LFENCE) or locked memory references. A PREFETCHWT1 instruc- 
tion is also unordered with respect to CLFLUSH and CLFLUSHOPT instructions, other PREFETCHWT1 instructions, or 
any other general instruction. It is ordered with respect to serializing instructions such as CPUID, WRMSR, OUT, and 
MOV CR. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 

Operation 

PREFETCH(mem, Level, State) Prefetches a byte memory location pointed by ‘mem’ into the cache level specified by ‘Level’; a request 
for exclusive/ownership is done if ‘State’ is 1. Note that the memory location ignore cache line splits. This operation is considered a 
hint for the processor and may be skipped depending on implementation. 


Prefetch (m8, Level = 1, EXCLUSIVE=1); 


Flags Affected 
All flags are affected 


C/C++ Compiler Intrinsic Equivalent 
void __mm_prefetch( char const *, int hint= _MM_HINT_ET1); 
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Protected Mode Exceptions 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 


#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 


#UD If the LOCK prefix is used. 


64-Bit Mode Exceptions 


#UD If the LOCK prefix is used. 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 
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V4FMADDPS/V4FNMADDPS — Packed Single-Precision Floating-Point Fused Multiply-Add 
(4-iterations) 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.512.F2.0F38.W0 9A /r A VIV AVX512_4FMAPS | Multiply packed single-precision floating-point 
V4FMADDPS zmm1{k1}{z}, zmm2+3, values from source register block indicated by 
m128 zmm_2 by values from m128 and accumulate the 
result in zmm1. 
EVEX.512.F2.0F38.W0 AA /r A VIV AVX512_4FMAPS | Multiply and negate packed single-precision 
V4FNMADDPS zmm1{k1}{Z}, floating-point values from source register block 
zmm2+3,m128 indicated by zmm2 by values from m128 and 
accumulate the result in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1_4X ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction computes 4 sequential packed fused single-precision floating-point multiply-add instructions with a 
sequentially selected memory operand in each of the four steps. 


In the above box, the notation of “+3” is used to denote that the instruction accesses 4 source registers based on 
that operand; sources are consecutive, start in a multiple of 4 boundary, and contain the encoded register operand. 
This instruction supports memory fault suppression. The entire memory operand is loaded if any of the 16 lowest 
significant mask bits is set to 1 or if a “no masking” encoding is used. 

The tuple type Tuple1_4X implies that four 32-bit elements (16 bytes) are referenced by the memory operation 
portion of this instruction. 

Rounding is performed at every FMA (fused multiply and add) boundary. Exceptions are also taken sequentially. 
Pre- and post-computational exceptions of the first FMA take priority over the pre- and post-computational excep- 
tions of the second FMA, etc. 
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Operation 
src_reg_id is the 5 bit index of the vector register specified in the instruction as the src1 register. 


define NFMA_PS(kI, vl, dest, k1, msrc, regs_loaded, src_base, posneg): 
tmpdest := dest 


// reg[] is an array representing the SIMD register file. 
FOR j := 0 to regs_loaded-1: 


FOR i:= O to kl-1: 
IF k1[i] or *no writemask*: 
IF posneg = 0: 


tmpdest.single[i] := RoundFPControl_MXCSR(tmpdest.single[i] - reg[src_base + j ].single[i] * msrc.single[j]) 


ELSE: 


tmpdest.single[i] ‘= RoundFPControl_MXCSR(tmpdest.single[i] + reg[src_base + j ].single[i] * msrc.single[j]) 


ELSE IF *zeroing*: 
tmpdest.single[i] := 0 
dest := tmpdst 
dest{MAX_VL-1:VL] := 0 


V4FMADDPS and V4FNMADDPS dest{k1}, src1, msrc (AVX512) 
KL, VL = (16,512) 


regs_loaded := 4 

src_base := src_reg_id & ~3 // for src1 operand 

posneg := 0 if negative form, 1 otherwise 

NFMA_PS(kl, vl, dest, k1, msrc, regs_loaded, src_base, posneg) 


Intel C/C++ Compiler Intrinsic Equivalent 


V4FMADDPS __m512_mm512_4fmadd_ps(__m512,__m512x4,__m128 *); 
V4FMADDPS __m512 _mm512_mask_4fmadd_ps(__m512,__ mmask16,__m512x4,__m128 *); 


V4FMADDPS __m512_mm512_maskz_4fmadd_ps(__mmask16,__m512,__m512x4,_m128*); 
V4FNMADDPS __m512_mm512_4fnmadd_ps(__m512,__m512x4,__m128 *); 

V4FNMADDPS __m512_mm512_mask_4fnmadd_ps(__m512,__ mmask16,__m512x4,__m128 *); 
V4FNMADDPS __m512 _mm512_maskz_4fnmadd_ps(__mmask16,__m512,__m512x4,__m128 *); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal. 


Other Exceptions 

See Type E2; additionally 

#UD If the EVEX broadcast bit is set to 1. 
#UD If the MODRM.mod = 0b11. 
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V4FMADDSS/V4FNMADDSS —Scalar Single-Precision Floating-Point Fused Multiply-Add 
(4-iterations) 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.LLIG.F2.0F38.W0 9B /r A VIV AVX512_4FMAPS | Multiply scalar single-precision floating-point 
V4FMADDSS xmm1{k1}{Z}, values from source register block indicated by 
xmm2+3,m128 xmm_z by values from m128 and accumulate the 
result in xmm1. 
EVEX.LLIG.F2.0F38.W0 AB /r A VIV AVX512_4FMAPS | Multiply and negate scalar single-precision 
V4FNMADDSS xmm1{k1}{Z}, floating-point values from source register block 
xmm2+3, m128 indicated by xmm2 by values from m128 and 
accumulate the result in xmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1_4X ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction computes 4 sequential scalar fused single-precision floating-point multiply-add instructions with a 
sequentially selected memory operand in each of the four steps. 

In the above box, the notation of “+3” is used to denote that the instruction accesses 4 source registers based that 
operand; sources are consecutive, start in a multiple of 4 boundary, and contain the encoded register operand. 
This instruction supports memory fault suppression. The entire memory operand is loaded if the least significant 
mask bit is set to 1 or if a “no masking” encoding is used. 

The tuple type Tuple1_4X implies that four 32-bit elements (16 bytes) are referenced by the memory operation 
portion of this instruction. 

Rounding is performed at every FMA boundary. Exceptions are also taken sequentially. Pre- and post-computa- 
tional exceptions of the first FMA take priority over the pre- and post-computational exceptions of the second FMA, 
etc. 


Operation 
src_reg_id is the 5 bit index of the vector register specified in the instruction as the src1 register. 


define NFMA_SS(vI, dest, k1, msrc, regs_loaded, src_base, posneg): 
tmpdest := dest 
// reg{] is an array representing the SIMD register file. 
IF k1[0] or *no writemask*: 
FOR j := 0 to regs_loaded - 1: 
IF posneg = 0: 
tmpdest.single[0] := RoundFPControl_MXCSR(tmpdest.single[0] - reg[src_base + j ].single[O] * msrc.single[j]) 
ELSE: 
tmpdest.single[O] := RoundFPControl_MXCSR(tmpdest.single[O] + reg[src_base + j ].single[O] * msrc.single[j]) 
ELSE IF *zeroing*: 
tmpdest.single[0] := 0 
dest := tmpdst 
dest[MAX_VL-1:VL] := 0 
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V4FMADDSS and V4FNMADDSS dest{k1}, src1, msrc (AVX512) 
VL=128 


regs_loaded := 4 

src_base := src_reg_id & ~3 // for src1 operand 

posneg := 0 if negative form, 1 otherwise 

NFMA_SS(vI, dest, k1, msrc, regs_loaded, src_base, posneg) 


Intel C/C++ Compiler Intrinsic Equivalent 


V4FMADDSS __m128_mm_4fmadd_ss(__m128,___m128x4,___m128*); 

V4FMADDSS __m128 __mm_mask_4fmadd_ss(__m128, __mmask8,__m128x4,___m128 *); 
V4FMADDSS __m128 _mm_maskz_4fmadd_ss(__mmask8,___m128,___m128x4,__m128 *); 
V4FNMADDSS __m128 _mm_4fnmadd_ss(__m128,__m128x4,__m128 *); 

V4FNMADDSS __m128 _mm_mask_4fnmadd_ss(__m128, __mmask8,___m128x4,__m128 *); 
V4FNMADDSS __m128 _mm_maskz_4fnmadd_ss(__mmask8, ___m128,__m128x4,__m128 *); 


SIMD Floating-Point Exceptions 
Overflow, Underflow, Invalid, Precision, Denormal. 


Other Exceptions 

See Type E2; additionally 

#UD If the EVEX broadcast bit is set to 1. 
#UD If the MODRM.mod = 0b11. 
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VEXP2PD—Approximation to the Exponential 2~x of Packed Double-Precision Floating-Point 
Values with Less Than 2*-23 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W1 C8/r | A VIV AVX512ER | Computes approximations to the exponential 2*x (with less 
VEXP2PD zmm1 {k1}{Z}, than 2°-23 of maximum relative error) of the packed double- 
zmm2/m512/m64bcst {sae} precision floating-point values from zmm2/m512/m64bcst and 
stores the floating-point result in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Computes the approximate base-2 exponential evaluation of the double-precision floating-point values in the 
source operand (the second operand) and stores the results to the destination operand (the first operand) using 
the writemask ki. The approximate base-2 exponential is evaluated with less than 2-23 of relative error. 


Denormal input values are treated as zeros and do not signal #DE, irrespective of MKCSR.DAZ. Denormal results 
are flushed to zeros and do not signal #UE, irrespective of MXCSR.FTZ. 


The source operand is a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VEXP2xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 


VEXP2PD 
(KL, VL) = (8, 512) 
FOR j :=0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+63:i] := EXP2_23_DP(SRC[63:0)) 
ELSE DEST[i+63:i] := EXP2_23_DP(SRC[i+63:i]) 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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Table 6-1. Special Values Behavior 


Source Input Result Comments 

NaN QNaN(src) If (SRC = SNaN) then #1 
+0 +0 

+/-0 1.0f Exact result 

-O +0.0f 

Integral value N 2~ (N) Exact result 


Intel C/C++ Compiler Intrinsic Equivalent 
VEXP2PD __m512d_mm512_exp2a23_round_pd (__m512da, int sae); 


VEXP2PD __m512d_mm512_mask_exp2a23_round_pd (__m512da,__mmask8 m,___m512d, int sae); 
VEXP2PD __m512d_mm512_maskz_exp2a23_round_pd (__mmask8 m,_m512d , int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Overflow 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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VEXP2PS—Approximation to the Exponential 2~x of Packed Single-Precision Floating-Point 
Values with Less Than 2*-23 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.WO0 C8 /r | A VIV AVX512ER | Computes approximations to the exponential 2*x (with less 
VEXP2PS zmm1 {k1}{z}, than 2°-23 of maximum relative error) of the packed single- 
zmm2/m512/m32bcst {sae} precision floating-point values from zmm2/m512/m32bcst and 
stores the floating-point result in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) ModRM:r/m (r) NA NA 
Description 


Computes the approximate base-2 exponential evaluation of the single-precision floating-point values in the source 
operand (the second operand) and store the results in the destination operand (the first operand) using the 
writemask ki. The approximate base-2 exponential is evaluated with less than 2-23 of relative error. 


Denormal input values are treated as zeros and do not signal #DE, irrespective of MKCSR.DAZ. Denormal results 
are flushed to zeros and do not signal #UE, irrespective of MXCSR.FTZ. 


The source operand is a ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VEXP2xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 


VEXP2PS 
(KL, VL) = (16, 512) 
FOR j :=0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST{[i+31:i] = EXP2_23_SP(SRC[31:0]) 
ELSE DEST[i+31:i] = EXP2_23_SP(SRC[i+31:i]) 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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Table 6-2. Special Values Behavior 


Source Input Result Comments 

NaN QNaN(src) If (SRC = SNaN) then #1 
+0 +0 

+/-0 1.0f Exact result 

-O +0.0f 

Integral value N 2~ (N) Exact result 


Intel C/C++ Compiler Intrinsic Equivalent 

VEXP2PS __m512_mm512_exp2a23_round_ps (__m512 a, int sae); 

VEXP2PS __m512_mm512_mask_exp2a23_round_ps (__m512 a,__mmask16 m,_m512 }, int sae); 
VEXP2PS __m512 _mm512_maskz_exp2a23_round_ps (__mmask16 m,__m512 b, int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Overflow 


Other Exceptions 
See Table 2-46, “Type E2 Class Exception Conditions”. 
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VGATHERPFODPS/VGATHERPFOQPS/VGATHERPFODPD/VGATHERPFOQPD-—Sparse Prefetch 
Packed SP/DP Data Values with Signed Dword, Signed Qword Indices Using TO Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.512.66.0F38.W0 C6 /1 /vsib A VV AVX512PF | Using signed dword indices, prefetch sparse byte 
VGATHERPFODPS vm32z {k1} memory locations containing single-precision data 
using opmask k1 and TO hint. 
EVEX.512.66.0F38.W0O C7 /1 /vsib A VV AVX512PF | Using signed qword indices, prefetch sparse byte 
VGATHERPFOQPS vm64z {k1} memory locations containing single-precision data 
using opmask k1 and TO hint. 
EVEX.512.66.0F38.W1 C6 /1 /vsib A VV AVX512PF_ | Using signed dword indices, prefetch sparse byte 
VGATHERPFODPD vm32y {k1} memory locations containing double-precision data 
using opmask k1 and TO hint. 
EVEX.512.66.0F38.W1 C7 /1 /vsib A VV AVX512PF | Using signed qword indices, prefetch sparse byte 
VGATHERPFOQPD vm64z {k1} memory locations containing double-precision data 
using opmask k1 and TO hint. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


A Tuple1 Scalar BaseReg (R): VSIB:base, NA NA NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally prefetches up to sixteen 32-bit or eight 64-bit integer byte data elements. The 
elements are specified via the VSIB (i.e., the index register is an zmm, holding packed indices). Elements will only 
be prefetched if their corresponding mask bit is one. 


Lines prefetched are loaded into to a location in the cache hierarchy specified by a locality hint (TO): 
e TO (temporal data)—prefetch data into the first level cache. 


[PS data] For dword indices, the instruction will prefetch sixteen memory locations. For qword indices, the instruc- 
tion will prefetch eight values. 


[PD data] For dword and qword indices, the instruction will prefetch eight memory locations. 
Note that: 

(1) The prefetches may happen in any order (or not at all). The instruction is a hint. 

(2) The mask is left unchanged. 

(3) Not valid with 16-bit effective addresses. Will deliver a #UD fault. 

(4) No FP nor memory faults may be produced by this instruction. 

(5) Prefetches do not handle cache line splits 

(6) A #UD is signaled if the memory operand is encoded without the SIB byte. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 

VINDEX stands for the memory operand vector of indices (a vector register) 

SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1, 2 or 4 byte displacement 

PREFETCH(mem, Level, State) Prefetches a byte memory location pointed by ‘mem’ into the cache level specified by ‘Level’; a request 
for exclusive/ownership is done if ‘State’ is 1. Note that the memory location ignore cache line splits. This operation is considered a 
hint for the processor and may be skipped depending on implementation. 
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VGATHERPFODPS (EVEX encoded version) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+31:i]) * SCALE + DISP], Level=0, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPFODPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+31:k]) * SCALE + DISP], Level=0, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPFOOQPS (EVEX encoded version) 
(KL, VL) = (8, 256) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+63:i]) * SCALE + DISP], Level=0, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPFOQPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k :=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+63:k]) * SCALE + DISP], Level=0, RFO = 0) 
Fl; 
ENDFOR 


Intel C/C++ Compiler Intrinsic Equivalent 


VGATHERPFODPD void __mm512_mask_prefetch_i32gather_pd(__m256i vdx, __mmask8 m, void * base, int scale, int hint); 
VGATHERPFODPS void _mm512_mask_prefetch_i32gather_ps(__m512i vdx,___ mmask16 m, void * base, int scale, int hint); 
VGATHERPFOQPD void _mm512_mask_prefetch_i64gather_pd(__m512i vdx, __ mmask8 m, void * base, int scale, int hint); 
VGATHERPFOOQPS void _mm512_mask_prefetch_i64gather_ps(__m512i vdx, __mmask8 m, void * base, int scale, int hint); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-62, “Type E12NP Class Exception Conditions”. 
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VGATHERPF 1DPS/VGATHERPF 1 QPS/VGATHERPF 1 DPD/VGATHERPF1QPD—Sparse Prefetch 
Packed SP/DP Data Values with Signed Dword, Signed Qword Indices Using T1 Hint 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 

EVEX.512.66.0F38.W0 C6 /2 /vsib A VIV AVX512PF Using signed dword indices, prefetch sparse byte 

VGATHERPF1DPS vm32z {k1} memory locations containing single-precision data using 
opmask k1 and T1 hint. 

EVEX.512.66.0F38.W0 C7 /2 /vsib A VIV AVX512PF Using signed qword indices, prefetch sparse byte 

VGATHERPF1QPS vm64z {k1} memory locations containing single-precision data using 
opmask k1 and T1 hint. 

EVEX.512.66.0F38.W1 C6 /2 /vsib A VIV AVX512PF Using signed dword indices, prefetch sparse byte 

VGATHERPF1DPD vm32y {k1} memory locations containing double-precision data using 
opmask k1 and 11 hint. 

EVEX.512.66.0F38.W1 C7 /2 /vsib A VIV AVX512PF Using signed qword indices, prefetch sparse byte 

VGATHERPF1QPD vm64z {k1} memory locations containing double-precision data using 
opmask k1 and 11 hint. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


A Tuple1 Scalar BaseReg (R): VSIB:base, NA NA NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally prefetches up to sixteen 32-bit or eight 64-bit integer byte data elements. The 
elements are specified via the VSIB (i.e., the index register is an zmm, holding packed indices). Elements will only 
be prefetched if their corresponding mask bit is one. 


Lines prefetched are loaded into to a location in the cache hierarchy specified by a locality hint (T1): 
e T1 (temporal data)—prefetch data into the second level cache. 


[PS data] For dword indices, the instruction will prefetch sixteen memory locations. For qword indices, the instruc- 
tion will prefetch eight values. 


[PD data] For dword and qword indices, the instruction will prefetch eight memory locations. 
Note that: 

(1) The prefetches may happen in any order (or not at all). The instruction is a hint. 

(2) The mask is left unchanged. 

(3) Not valid with 16-bit effective addresses. Will deliver a #UD fault. 

(4) No FP nor memory faults may be produced by this instruction. 

(5) Prefetches do not handle cache line splits 

(6) A #UD is signaled if the memory operand is encoded without the SIB byte. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 

VINDEX stands for the memory operand vector of indices (a vector register) 

SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1, 2 or 4 byte displacement 

PREFETCH(mem, Level, State) Prefetches a byte memory location pointed by ‘mem’ into the cache level specified by ‘Level’; a request 
for exclusive/ownership is done if ‘State’ is 1. Note that the memory location ignore cache line splits. This operation is considered a 
hint for the processor and may be skipped depending on implementation. 
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VGATHERPF1DPS (EVEX encoded version) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+31:i]) * SCALE + DISP], Level=1, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPF1DPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+31:k]) * SCALE + DISP], Level=1, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPF10QPS (EVEX encoded version) 
(KL, VL) = (8, 256) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+63:i]) * SCALE + DISP], Level=1, RFO = 0) 
Fl; 
ENDFOR 


VGATHERPF1QPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k :=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+63:k]) * SCALE + DISP], Level=1, RFO = 0) 
Fl; 
ENDFOR 


Intel C/C++ Compiler Intrinsic Equivalent 


VGATHERPF1DPD void __mm512_mask_prefetch_i32gather_pd(__m256i vdx, __mmask8 m, void * base, int scale, int hint); 
VGATHERPF1DPS void __mm512_mask_prefetch_i32gather_ps(__m512i vdx,___ mmask16 m, void * base, int scale, int hint); 
VGATHERPF1QPD void __mm512_mask_prefetch_i64gather_pd(__m512i vdx,___ mmask8 m, void * base, int scale, int hint); 
VGATHERPF1QPS void _mm512_mask_prefetch_i64gather_ps(__m512i vdx, __mmask8 m, void * base, int scale, int hint); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-62, “Type E12NP Class Exception Conditions”. 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VP4DPWSSDS — Dot Product of Signed Words with Dword Accumulation and Saturation 
(4-iterations) 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.512.F2.0F38.W0 53 /r A VIV AVX512_4VNNIW | Multiply signed words from source register block 
VP4DPWSSDS zmm1{k1}{z}, indicated by zmm2 by signed words from m128 
zmm2+3, m128 and accumulate the resulting dword results with 
signed saturation in zmm1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1_4X ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


This instruction computes 4 sequential register source-block dot-products of two signed word operands with 
doubleword accumulation and signed saturation. The memory operand is sequentially selected in each of the four 
steps. 

In the above box, the notation of “+3” is used to denote that the instruction accesses 4 source registers based on 
that operand; sources are consecutive, start in a multiple of 4 boundary, and contain the encoded register operand. 
This instruction supports memory fault suppression. The entire memory operand is loaded if any bit of the lowest 
16-bits of the mask is set to 1 or if a “no masking” encoding is used. 


The tuple type Tuple1_4X implies that four 32-bit elements (16 bytes) are referenced by the memory operation 
portion of this instruction. 


Operation 
src_reg_id is the 5 bit index of the vector register specified in the instruction as the src1 register. 


\VP4DPWSSDS dest, src1, src2 
(KL,VL) = (16,512) 
N:=4 


ORIGDEST := DEST 
src_base := src_reg_id & ~ (N-1) // for src1 operand 


FOR i:= 0 to KL-1: 
IF k1[i] or *no writemask*: 
FOR m:= 0 to N-1: 
t:= SRC2.dword[m] 
p1dword := reg[src_base+m].word[2*i] * t.word[O] 
p2dword := reg[src_base+m].word[2*i+1] * t.word[1] 
DEST.dword[i] := SIGNED_DWORD_SATURATE(DEST.dword[i] + p1dword + p2dword) 
ELSE IF *zeroing*: 
DEST.dword[i] := 0 
ELSE 
DEST.dword[i] := ORIGDEST.dword[i] 
DEST[MAX_VL-1:VL] := 0 
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Intel C/C++ Compiler Intrinsic Equivalent 
VP4DPWSSDS __m512i_mm512_4dpwssds_epi32(__m512i, __m512ix4, __m128i *); 


VP4DPWSSDS __m512i_mm512_mask_4dpwssds_epi32(__m512i,__ mmask16,___m512ix4, __m128i *); 
VP4DPWSSDS __m512i_mm512_maskz_4dpwssds_epi32(__mmask16,___m512i,__m512ix4,__m128i *); 


SIMD Floating-Point Exceptions 


None. 

Other Exceptions 

See Type E4; additionally 

#UD If the EVEX broadcast bit is set to 1. 
#UD If the MODRM.mod = Obi1. 
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VP4DPWSSD — Dot Product of Signed Words with Dword Accumulation (4-iterations) 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En bitMode | Flag 
Support 
EVEX.512.F2.0F38.W0 52 /r A VIV AVX512_4VNNIW | Multiply signed words from source register block 
VP4DPWSSD zmm1{k1}{z}, zmm2+3, indicated by zmm2 by signed words from m128 
m128 and accumulate resulting signed dwords in zmm1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1_4X ModRM:reg (r, w) EVEX.vvvv (r) ModRM:r/m (r) NA 


Description 


This instruction computes 4 sequential register source-block dot-products of two signed word operands with 
doubleword accumulation; see Figure 7-1 below. The memory operand is sequentially selected in each of the four 


steps. 


In the above box, the notation of “+3” is used to denote that the instruction accesses 4 source registers based on 
that operand; sources are consecutive, start in a multiple of 4 boundary, and contain the encoded register operand. 


This instruction supports memory fault suppression. The entire memory operand is loaded if any bit of the lowest 
16-bits of the mask is set to 1 or if a “no masking” encoding is used. 

The tuple type Tuple1_4X implies that four 32-bit elements (16 bytes) are referenced by the memory operation 
portion of this instruction. 


Figure 7-1. 
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Register Source-Block Dot Product of Two Signed Word Operands with Doubleword Accumulation! 


NOTES: 
1. For illustration purposes, one source-block dot product instance is shown out of 
the four. 
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Operation 
src_reg_id is the 5 bit index of the vector register specified in the instruction as the src1 register. 


\VP4DPWSSD dest, src1, src2 
(KL,VL) = (16,512) 
N:= 4 


ORIGDEST := DEST 
src_base != src_reg_id & ~ (N-1) // for src1 operand 


FOR i ‘= 0 to KL-1: 
IF k1[i] or *no writemask*: 
FOR m:= 0 to N-1: 
t:= SRC2.dword[m] 
p1dword := reg[src_base+m].word[2*i] * t.word[0] 
p2dword := reg[src_base+m].word[2*i+1] * t.word[1] 
DEST.dword[i] := DEST.dword[i] + p1dword + p2dword 
ELSE IF *zeroing*: 
DEST.dword[i] := 0 
ELSE 
DEST.dword[i] ‘= ORIGDEST.dword{[i] 
DEST[MAX_VL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VP4DPWSSD __m512i_mm512_4dpwssd_epi32(__m512i,__m512ix4, __m128i *); 


VP4DPWSSD __m512i_mm512_mask_4dpwssd_epi32(__m512i,__ mmask16, __m512ix4,__m128i *); 
VP4DPWSSD __m512i__mm512_maskz_4dpwssd_epi32(__mmask16,___m512i,__m512ix4,___m128i *); 


SIMD Floating-Point Exceptions 


None. 

Other Exceptions 

See Type E4; additionally 

#UD If the EVEX broadcast bit is set to 1. 
#UD If the MODRM.mod = Ob11. 
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VRCP28PD—Approximation to the Reciprocal of Packed Double-Precision Floating-Point Values 
with Less Than 2”-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W1 CA/r | A VV AVX512ER | Computes the approximate reciprocals ( < 2-28 relative error) 
VRCP28PD zmm1 {k1}{Z}, of the packed double-precision floating-point values in 
zmm2/m512/m64bcst {sae} zmm2/m512/m64bcst and stores the results in zmm1. Under 
writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Computes the reciprocal approximation of the float64 values in the source operand (the second operand) and store 
the results to the destination operand (the first operand). The approximate reciprocal is evaluated with less than 
2-28 of maximum relative error. 

Denormal input values are treated as zeros and do not signal #DE, irrespective of MKCSR.DAZ. Denormal results 
are flushed to zeros and do not signal #UE, irrespective of MXCSR.FTZ. 

If any source element is NaN, the quietized NaN source value is returned for that element. If any source element is 
+o, +0.0 is returned for that element. Also, if any source element is £0.0, +@ is returned for that element. 

The source operand is a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VRCP28xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 


VRCP28PD (EVEX encoded versions) 
(KL, VL) = (8, 512) 


FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST{[i+63:i] := RCP_28_DP(1.0/SRC[63:0)); 
ELSE DEST[i+63:i] := RCP_28_DP(1.0/SRC[i+63:i]); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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Table 6-3. VRCP28PD Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 

O<X<« 271022 INF Positive input denormal or zero; #Z 

-2°1022 ¢ x ¢.9 -INF Negative input denormal or zero; #Z 

Ko 2'hee +0.0f 

X <2 ee -0.0f 

X= +0 +0.0f 

X = -@ -0.0f 

X=2" an Exact result (unless input/output is a denormal) 
X=-27 -2" Exact result (unless input/output is a denormal) 


Intel C/C++ Compiler Intrinsic Equivalent 


VRCP28PD __m512d_mm512_rcp28_round_pd ( 


m512d a, int sae); 


VRCP28PD __m512d_mm512_mask_rcp28_round_pd(__m512da,__ mmask8 m,___m512d , int sae); 


VRCP28PD __m512d_mm512_maskz_rcp28_round_pd(__mmask8 m, 


m512d b, int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”. 
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VRCP28SD—Approximation to the Reciprocal of Scalar Double-Precision Floating-Point Value 
with Less Than 2”-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.W1 CB /r A VIV AVX512ER | Computes the approximate reciprocal ( < 2-28 relative 
VRCP28SD xmm1 {k1}{z}, xmm2, error) of the scalar double-precision floating-point value 
xmm3/m64 {sae} in xmm3/m64 and stores the results in xmm1. Under 
writemask. Also, upper double-precision floating-point 
value (bits[127:64]) from xmm2 is copied to 
xmm1[127:64]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the reciprocal approximation of the low float64 value in the second source operand (the third operand) 
and store the result to the destination operand (the first operand). The approximate reciprocal is evaluated with 
less than 2“-28 of maximum relative error. The result is written into the low float64 element of the destination 
operand according to the writemask k1. Bits 127:64 of the destination is copied from the corresponding bits of the 
first source operand (the second operand). 


A denormal input value is treated as zero and does not signal #DE, irrespective of MKCSR.DAZ. A denormal result 
is flushed to zero and does not signal #UE, irrespective of MXCSR.FTZ. 


If any source element is NaN, the quietized NaN source value is returned for that element. If any source element is 
+o, +0.0 is returned for that element. Also, if any source element is £0.0, +@ is returned for that element. 


The first source operand is an XMM register. The second source operand is an XMM register or a 64-bit memory 
location. The destination operand is a XMM register, conditionally updated using writemask k1. 


A numerically exact implementation of VRCP28xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsgqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 
VRCP28SD ((EVEX encoded versions) 


IF k1[0] OR *no writemask* THEN 
DEST[63: 0] := RCP_28_DP(1.0/SRC2[63: 0)); 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63: 0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63: 0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[127:64] := SRC1[127: 64] 
DEST[MAXVL-1:128] := 0 
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Table 6-4. VRCP28SD Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 

O<X<« 271022 INF Positive input denormal or zero; #Z 

-2°1022 ¢ x ¢.9 -INF Negative input denormal or zero; #Z 

Ko 2'hee +0.0f 

X <2 ee -0.0f 

X= +0 +0.0f 

X = -@ -0.0f 

X=2" an Exact result (unless input/output is a denormal) 
X=-27 -2" Exact result (unless input/output is a denormal) 


Intel C/C++ Compiler Intrinsic Equivalent 
VRCP28SD __m128d_mm_rcp28_round_sd (__m128da,__m128d 5, int sae); 


VRCP28SD __m128d_mm_mask_rcp28_round_sd(__m128ds,__ mmask8 m,__m128d a, __m128d 5, int sae); 
VRCP28SD __m128d __mm_maskz_rcp28_round_sd(__mmask8 m,___m128d a,___m128d b, int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-47, “Type E3 Class Exception Conditions”. 
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VRCP28PS—Approximation to the Reciprocal of Packed Single-Precision Floating-Point Values 
with Less Than 2~-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W0O CA /r A VV AVX512ER_ | Computes the approximate reciprocals ( < 2*-28 relative 
VRCP28PS zmm1 {k1}{Z}, error) of the packed single-precision floating-point values in 
zmm2/m512/m32bcst {sae} zmm2/m512/m32bcst and stores the results in zmm1. Under 
writemask. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Computes the reciprocal approximation of the float32 values in the source operand (the second operand) and store 
the results to the destination operand (the first operand) using the writemask k1. The approximate reciprocal is 
evaluated with less than 2“-28 of maximum relative error prior to final rounding. The final results are rounded to 
< 2-23 relative error before written to the destination. 


Denormal input values are treated as zeros and do not signal #DE, irrespective of MKCSR.DAZ. Denormal results 
are flushed to zeros and do not signal #UE, irrespective of MXCSR.FTZ. 


If any source element is NaN, the quietized NaN source value is returned for that element. If any source element is 
+o, +0.0 is returned for that element. Also, if any source element is £0.0, +@ is returned for that element. 


The source operand is a ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VRCP28xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsqrt28-vexp2. 


Operation 


VRCP28PS (EVEX encoded versions) 
(KL, VL) = (16, 512) 


FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST[i+31:i] := RCP_28_SP(1.0/SRC[31:0)); 
ELSE DEST[i+31:i] = RCP_28_SP(1.0/SRC[i+31:i]); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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Table 6-5. VRCP28PS Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 

O<x<« 27126 INF Positive input denormal or zero; #Z 

-2126<X <9 -INF Negative input denormal or zero; #Z 

Koz +0.0f 

X<.2le6 -0.0f 

X= +0 +0.0f 

X = -@ -0.0f 

X=2" an Exact result (unless input/output is a denormal) 
X=-27 -2" Exact result (unless input/output is a denormal) 


Intel C/C++ Compiler Intrinsic Equivalent 


VRCP28PS __mm512_rcp28_round_ps ( 
VRCP28PS __m512_mm512_mask_rcp28_round_ps( 


m512 a, int sae); 


VRCP28PS __m512_mm512_maskz_rcp28_round_ps( 


SIMD Floating-Point Exceptions 


Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


m512s,__mmask16 m,__m512 a, int sae); 
mmask16 m,__m512 a, int sae); 


See Table 2-46, “Type E2 Class Exception Conditions”. 


VRCP28PS—Approximation to the Reciprocal of Packed Single-Precision Floating-Point Values with Less Than 2*-28 Relative Error 


Vol.2D 7-25 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VRCP28SS—Approximation to the Reciprocal of Scalar Single-Precision Floating-Point Value 
with Less Than 2”-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.LLIG.66.0F38.WO CB /r A VIV AVX512ER_ | Computes the approximate reciprocal ( < 2-28 relative 
VRCP28SS xmm1 {k1}{z}, error) of the scalar single-precision floating-point value in 
xmme2, xmm3/m32 {sae} xmm3/m32 and stores the results in xmm1. Under 
writemask. Also, upper 3 single-precision floating-point 
values (bits[127:32]) from xmm2 is copied to 
xmm1[127:32]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the reciprocal approximation of the low float32 value in the second source operand (the third operand) 
and store the result to the destination operand (the first operand). The approximate reciprocal is evaluated with 
less than 2“-28 of maximum relative error prior to final rounding. The final result is rounded to < 2-23 relative 
error before written into the low float32 element of the destination according to writemask k1. Bits 127:32 of the 
destination is copied from the corresponding bits of the first source operand (the second operand). 


A denormal input value is treated as zero and does not signal #DE, irrespective of MKCSR.DAZ. A denormal result 
is flushed to zero and does not signal #UE, irrespective of MXCSR.FTZ. 


If any source element is NaN, the quietized NaN source value is returned for that element. If any source element is 
+o, +0.0 is returned for that element. Also, if any source element is £0.0, +@ is returned for that element. 

The first source operand is an XMM register. The second source operand is an XMM register or a 32-bit memory 
location. The destination operand is a XMM register, conditionally updated using writemask k1. 


A numerically exact implementation of VRCP28xx can be found at https://software.intel.com/en-us/articles/refer- 
ence-implementations-for-IA-approximation-instructions-vrcp14-vrsgrt14-vrcp28-vrsqrt28-vexp2. 


Operation 
VRCP28SS ((EVEX encoded versions) 
IF k1[0] OR *no writemask* THEN 
DEST[31: 0] := RCP_28_SP(1.0/SRC2[31: 0)); 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31: 0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31: 0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[127:32] := SRC1[127: 32] 
DEST[MAXVL-1:128] := 0 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


Table 6-6. VRCP28SS Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 

O<x<« 27126 INF Positive input denormal or zero; #Z 

-2126<X <9 -INF Negative input denormal or zero; #Z 

Koz +0.0f 

X<.2le6 -0.0f 

X= +0 +0.0f 

X = -@ -0.0f 

X=2" an Exact result (unless input/output is a denormal) 
X=-27 -2" Exact result (unless input/output is a denormal) 


Intel C/C++ Compiler Intrinsic Equivalent 


VRCP28SS __m128 _mm_rcp28_round_ss (__m128a,__m128b, int sae); 
VRCP28SS __m128 _mm_mask_rcp28_round_ss(__m128 s,__ mmask8 m,__m128 a,__m128 , int sae); 
VRCP28SS __m128 _mm_maskz_rcp28_round_ss(__mmask8 m, __m128 a,__m128 , int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-47, “Type E3 Class Exception Conditions”. 


VRCP28SS—Approximation to the Reciprocal of Scalar Single-Precision Floating-Point Value with Less Than 2*-28 Relative Error 


Vol.2D 7-27 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VRSQRT28PD—Approximation to the Reciprocal Square Root of Packed Double-Precision 
Floating-Point Values with Less Than 2*-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W1 CC /r | A VIV AVX512ER | Computes approximations to the Reciprocal square root (<2*- 
VRSQRT28PD zmm1 {k1}{Z}, 28 relative error) of the packed double-precision floating-point 
zmm2/m512/m64bcst {sae} values from zmm2/m512/m64bcst and stores result in 
zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En | Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Computes the reciprocal square root of the float64 values in the source operand (the second operand) and store 
the results to the destination operand (the first operand). The approximate reciprocal is evaluated with less than 
2-28 of maximum relative error. 

If any source element is NaN, the quietized NaN source value is returned for that element. Negative (non-zero) 
source numbers, as well as -®, return the canonical NaN and set the Invalid Flag (#1). 


A value of -O must return -® and set the DivByZero flags (#Z). Negative numbers should return NaN and set the 
Invalid flag (#1). Note however that the instruction flush input denormals to zero of the same sign, so negative 
denormals return -® and set the DivByZero flag. 


The source operand is a ZMM register, a 512-bit memory location or a 512-bit vector broadcasted from a 64-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VRSQRT28xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 


Operation 


VRSQRT28PD (EVEX encoded versions) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST{[i+63:i] := (1.0/ SORT(SRC[63:0))); 
ELSE DEST[i+63:i] := (1.0/ SQRT(SRC[i+63:i])); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+63:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+63:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


Table 6-7. VRSQRT28PD Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 
X= 2-en 2n 

X<0 QNaN_Indefinite Including -INF 

X = -0 or negative denormal | -INF #Z 

X= +0 or positive denormal | +INF #Z 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRSQRT28PD __m512d_mm512_rsqrt28_round_pd(__m512d a, int sae); 


VRSQRT28PD __m512d_mm512_mask_rsqrt28_round_pd(__m512ds, 


mmask8 m,__m512d a, int sae); 


VRSQRT28PD __m512d __mm512_maskz_rsqrt28_round_pd(__mmask8 m,__m512d a, int sae); 


SIMD Floating-Point Exceptions 


Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”. 


VRSQRT28PD—Approximation to the Reciprocal Square Root of Packed Double-Precision Floating-Point Values with Less Than 2*-28 Vol.2D 7-29 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VRSQRT28SD—Approximation to the Reciprocal Square Root of Scalar Double-Precision 
Floating-Point Value with Less Than 2~-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support Flag 
EVEX.LLIG.66.0F38.W1 CD /r A VIV AVX512ER_ | Computes approximate reciprocal square root (<2*-28 
VRSQRT28SD xmm1 {k1}{Z}, relative error) of the scalar double-precision floating-point 
xmm_2, xmm3/m64 {sae} value from xmm3/m64 and stores result in xmm1 with 
writemask k1. Also, upper double-precision floating-point 
value (bits[127:64]) from xmm2 is copied to 
xmm1[127:64]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the reciprocal square root of the low float64 value in the second source operand (the third operand) and 
store the result to the destination operand (the first operand). The approximate reciprocal square root is evaluated 
with less than 2“-28 of maximum relative error. The result is written into the low float64 element of xmm1 
according to the writemask k1. Bits 127:64 of the destination is copied from the corresponding bits of the first source operand (the 
second operand). 


If any source element is NaN, the quietized NaN source value is returned for that element. Negative (non-zero) 
source numbers, as well as -®, return the canonical NaN and set the Invalid Flag (#1). 


A value of -0 must return -® and set the DivByZero flags (#Z). Negative numbers should return NaN and set the 
Invalid flag (#1). Note however that the instruction flush input denormals to zero of the same sign, so negative 
denormals return -® and set the DivByZero flag. 


The first source operand is an XMM register. The second source operand is an XMM register or a 64-bit memory 
location. The destination operand is a XMM register. 


A numerically exact implementation of VRSQRT28xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 


Operation 
VRSQRT28SD (EVEX encoded versions) 


IF k1[0] OR *no writemask* THEN 
DEST[63: 0] := (1.0/ SQRT(SRC[63: 0))); 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[63: 0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[63: 0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[127:64] := SRC1[127: 64] 
DEST[MAXVL-1:128] := 0 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


Table 6-8. VRSQRTZ8SD Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 
X= 2-en 2n 

X<0 QNaN_Indefinite Including -INF 

X =-0 or negative denormal | -INF #Z 

X= +0 or positive denormal | +INF #Z 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRSQRT28SD __m128d_mm_rsqrt28_round_sd(__m128d a, __m128d b, int rounding); 
VRSQRT28SD __m128d __mm_mask_rsqrt28_round_sd(__m128ds,___ mmask8 m,__m128d a, __m128d b, int rounding); 
VRSQRT28SD __m128d __mm_maskz_rsqrt28_round_sd( ___mmask8 m,__m128d a, __m128d b, int rounding); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-47, “Type E3 Class Exception Conditions”. 


VRSQRT28SD—Approximation to the Reciprocal Square Root of Scalar Double-Precision Floating-Point Value with Less Than 2*-28 Vol.2D 7-31 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VRSQRT28PS—Approximation to the Reciprocal Square Root of Packed Single-Precision 
Floating-Point Values with Less Than 2*-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bitMode | Feature 
Support | Flag 
EVEX.512.66.0F38.W0 CC /r A VIV AVX512ER | Computes approximations to the Reciprocal square root 
VRSQRT28PS zmm1 {k1}{Z}, (<2*-28 relative error) of the packed single-precision 
zmm2/m512/m32bcst {sae} floating-point values from zmm2/m512/m32bcst and stores 
result in zmm1 with writemask k1. 


Instruction Operand Encoding 


Op/En | Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) ModRM:r/m (r) NA NA 
Description 


Computes the reciprocal square root of the float32 values in the source operand (the second operand) and store 
the results to the destination operand (the first operand). The approximate reciprocal is evaluated with less than 
2-28 of maximum relative error prior to final rounding. The final results is rounded to < 2-23 relative error 
before written to the destination. 


If any source element is NaN, the quietized NaN source value is returned for that element. Negative (non-zero) 
source numbers, as well as -®, return the canonical NaN and set the Invalid Flag (#1). 


A value of -O0 must return -® and set the DivByZero flags (#Z). Negative numbers should return NaN and set the 
Invalid flag (#1). Note however that the instruction flush input denormals to zero of the same sign, so negative 
denormals return -® and set the DivByZero flag. 


The source operand is a ZMM register, a 512-bit memory location, or a 512-bit vector broadcasted from a 32-bit 
memory location. The destination operand is a ZMM register, conditionally updated using writemask k1. 


EVEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. 


A numerically exact implementation of VRSQRT28xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 


Operation 


VRSQRT28PS (EVEX encoded versions) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1[j] OR *no writemask* THEN 
IF (EVEX.b = 1) AND (SRC *is memory*) 
THEN DEST{[i+31:i] := (1.0/ SQRT(SRC[31:0])); 
ELSE DEST[i+31:i] := (1.0/ SQRT(SRC[i+31:i])); 


Fl; 
ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[i+31:i] remains unchanged* 
ELSE ; zeroing-masking 
DEST[i+31:i] := 0 
Fl; 
Fl; 
ENDFOR; 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


Table 6-9. VRSQRT28PS Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 
X= aren Qn 

X<0 QNaN_Indefinite Including -INF 

X = -0 or negative denormal -INF #Z 

X = +0 or positive denormal +INF #Z 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRSQRT28PS __m512 _mm512_rsqrt28_round_ps(__m512 a, int sae); 
VRSQRT28PS __m512 __mm512_mask_rsqrt28_round_ps(__m512 s,__mmask16 m,__m512 a, int sae); 
VRSQRT28PS __m512 __mm512_maskz_rsqrt28_round_ps(__mmask16 m,__m512 a, int sae); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-46, “Type E2 Class Exception Conditions”. 


VRSQRT28PS—Approximation to the Reciprocal Square Root of Packed Single-Precision Floating-Point Values with Less Than 2*-28 


Vol.2D 7-33 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VRSQRT28SS—Approximation to the Reciprocal Square Root of Scalar Single-Precision Floating- 
Point Value with Less Than 2-28 Relative Error 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support Flag 
EVEX.LLIG.66.0F38.WO CD /r A VIV AVX512ER | Computes approximate reciprocal square root (<2*-28 
VRSQRT28SS xmm1 {k1}{Z}, relative error) of the scalar single-precision floating-point 
xmm2, xmm3/m32 {sae} value from xmm3/m32 and stores result in xmm1 with 
writemask k1. Also, upper 3 single-precision floating-point 
value (bits[127:32]) from xmm2 is copied to 
xmm1[127:32]. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) NA 
Description 


Computes the reciprocal square root of the low float32 value in the second source operand (the third operand) and 
store the result to the destination operand (the first operand). The approximate reciprocal square root is evaluated 
with less than 24-28 of maximum relative error prior to final rounding. The final result is rounded to < 2“-23 rela- 
tive error before written to the low float32 element of the destination according to the writemask k1. Bits 127:32 of 
the destination is copied from the corresponding bits of the first source operand (the second operand). 


If any source element is NaN, the quietized NaN source value is returned for that element. Negative (non-zero) 
source numbers, as well as -®, return the canonical NaN and set the Invalid Flag (#1). 


A value of -0 must return -® and set the DivByZero flags (#Z). Negative numbers should return NaN and set the 
Invalid flag (#1). Note however that the instruction flush input denormals to zero of the same sign, so negative 
denormals return -® and set the DivByZero flag. 


The first source operand is an XMM register. The second source operand is an XMM register or a 32-bit memory 
location. The destination operand is a XMM register. 


A numerically exact implementation of VRSQRT28xx can be found at https://software.intel.com/en-us/arti- 
cles/reference-implementations-for-IA-approximation-instructions-vrcp14-vrsqrt14-vrcp28-vrsgrt28-vexp2. 


Operation 
VRSQRTZ28SS (EVEX encoded versions) 


IF k1[0] OR *no writemask* THEN 
DEST[31: 0] := (1.0/ SQRT(SRC[31: 0))); 


ELSE 
IF *merging-masking* ; merging-masking 
THEN *DEST[31: 0] remains unchanged* 
ELSE ; zeroing-masking 
DEST[31: 0] := 0 
Fl; 
Fl; 
ENDFOR; 


DEST[127:32] := SRC1[127: 32] 
DEST[MAXVL-1:128] := 0 


7-34 Vol. 2D VRSQRT28SS—Approximation to the Reciprocal Square Root of Scalar Single-Precision Floating-Point Value with Less Than 2*-28 Rel- 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


Table 6-10. VRSQRT28SS Special Cases 


Input value Result value Comments 

NAN QNAN(input) If (SRC = SNaN) then #1 
X= 2-en 2n 

X<0 QNaN_Indefinite Including -INF 

X = -0 or negative denormal | -INF #Z 

X = +0 or positive denormal | +INF #Z 

X = +INF +0 


Intel C/C++ Compiler Intrinsic Equivalent 


VRSQRT28SS __m128 _mm_rsqrt28_round_ss(__m128 a, __m128 b, int rounding); 
VRSQRT28SS __m128 __mm_mask_rsqrt28_round_ss(__m128 s,___mmask8 m,__m128 a,_m128 b, int rounding); 
VRSQRT28SS __m128 __mm_maskz_rsqrt28_round_ss(__mmask8 m,__m128 a,__m128 b, int rounding); 


SIMD Floating-Point Exceptions 
Invalid (if SNaN input), Divide-by-zero 


Other Exceptions 


See Table 2-47, “Type E3 Class Exception Conditions”. 


VRSQRT28SS—Approximation to the Reciprocal Square Root of Scalar Single-Precision Floating-Point Value with Less Than 2*-28 Rel- 


Vol.2D 7-35 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VSCATTERPFODPS/VSCATTERPFOQPS/VSCATTERPFODPD/VSCATTERPFOQPD—Sparse Prefetch 
Packed SP/DP Data Values with Signed Dword, Signed Qword Indices Using TO Hint with Intent 
to Write 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W0O C6 /5 /vsib A VIV AVX512PF | Using signed dword indices, prefetch sparse byte 
VSCATTERPFODPS vm32z {k1} memory locations containing single-precision data using 
writemask k1 and TO hint with intent to write. 
EVEX.512.66.0F38.W0 C7 /5 /vsib A VIV AVX512PF | Using signed qword indices, prefetch sparse byte 
VSCATTERPFOQPS vm64z {k1} memory locations containing single-precision data using 
writemask k1 and TO hint with intent to write. 
EVEX.512.66.0F38.W1 C6 /5 /vsib A VIV AVX512PF | Using signed dword indices, prefetch sparse byte 
VSCATTERPFODPD vm32y {k1} memory locations containing double-precision data 
using writemask k1 and TO hint with intent to write. 
EVEX.512.66.0F38.W1 C7 /5 /vsib A VIV AVX512PF | Using signed qword indices, prefetch sparse byte 
VSCATTERPFOQPD vm64z {k1} memory locations containing double-precision data 
using writemask k1 and TO hint with intent to write. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


A Tuple1 Scalar BaseReg (R): VSIB:base, NA NA NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally prefetches up to sixteen 32-bit or eight 64-bit integer byte data elements. The 
elements are specified via the VSIB (i.e., the index register is an zmm, holding packed indices). Elements will only 
be prefetched if their corresponding mask bit is one. 


cache lines will be brought into exclusive state (RFO) specified by a locality hint (TO): 
e TO (temporal data)—prefetch data into the first level cache. 


[PS data] For dword indices, the instruction will prefetch sixteen memory locations. For qword indices, the instruc- 
tion will prefetch eight values. 


[PD data] For dword and qword indices, the instruction will prefetch eight memory locations. 
Note that: 

(1) The prefetches may happen in any order (or not at all). The instruction is a hint. 

(2) The mask is left unchanged. 

(3) Not valid with 16-bit effective addresses. Will deliver a #UD fault. 

(4) No FP nor memory faults may be produced by this instruction. 

(5) Prefetches do not handle cache line splits 

(6) A #UD is signaled if the memory operand is encoded without the SIB byte. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 

VINDEX stands for the memory operand vector of indices (a vector register) 

SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1, 2 or 4 byte displacement 

PREFETCH(mem, Level, State) Prefetches a byte memory location pointed by ‘mem’ into the cache level specified by ‘Level’; a request 
for exclusive/ownership is done if ‘State’ is 1. Note that the memory location ignore cache line splits. This operation is considered a 
hint for the processor and may be skipped depending on implementation. 
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INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VSCATTERPFODPS (EVEX encoded version) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+31:i]) * SCALE + DISP], Level=0, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPFODPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+31:k]) * SCALE + DISP], Level=0, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPFOQPS (EVEX encoded version) 
(KL, VL) = (8, 256) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+63:i]) * SCALE + DISP], Level=0, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPFOQPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k :=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+63:k]) * SCALE + DISP], Level=0, RFO = 1) 
Fl; 
ENDFOR 


Intel C/C++ Compiler Intrinsic Equivalent 
VSCATTERPFODPD void_mm512_prefetch_i32scatter_pd(void *base, _ m256i vdx, int scale, int hint); 


VSCATTERPFODPD void __mm512_mask_prefetch_i32scatter_pd(void *base,__ mmask8 m, ___m256i vd, int scale, int hint); 
VSCATTERPFODPS void __mm512_prefetch_i32scatter_ps(void *base, __m512i vdx, int scale, int hint); 
VSCATTERPFODPS void __mm512_mask_prefetch_i32scatter_ps(void *base,__ mmask16 m,__m512i vdx, int scale, int hint); 


VSCATTERPFOQPD void __mm512_prefetch_i64scatter_pd(void * base, __m512i vdx, int scale, int hint); 
VSCATTERPFOQPD void __mm512_mask_prefetch_i64scatter_pd(void * base, _mmask8 m,___m512i vdx, int scale, int hint); 
VSCATTERPFOOPS void __mm512_prefetch_i64scatter_ps(void * base, __m512i vdx, int scale, int hint); 
VSCATTERPFOOPS void __mm512_mask_prefetch_i64scatter_ps(void * base, __mmask8 m, __m512i vdx, int scale, int hint); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-62, “Type E12NP Class Exception Conditions”. 


VSCATTERPFODPS/VSCATTERPFOQPS/VSCATTERPFODPD/VSCAT TERPFOQPD—Sparse Prefetch Packed SP/DP Data Values with Vol.2D 7-37 


INSTRUCTION SET REFERENCE UNIQUE TO INTEL® XEON PHI™ PROCESSORS 


VSCATTERPF 1 DPS/VSCATTERPF1 QPS/VSCATTERPF1 DPD/VSCATTERPF 1QPD—Sparse Prefetch 
Packed SP/DP Data Values with Signed Dword, Signed Qword Indices Using T1 Hint with Intent 
to Write 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En bit Mode | Feature 
Support | Flag 
EVEX.512.66.0F38.W0 C6 /6 /vsib A VIV AVX512PF | Using signed dword indices, prefetch sparse byte memory 
VSCATTERPF1DPS vm32z {k1} locations containing single-precision data using writemask 
k1 and T1 hint with intent to write. 
EVEX.512.66.0F38.W0 C7 /6 /vsib A VIV AVX512PF | Using signed qword indices, prefetch sparse byte memory 
VSCATTERPF1QPS vm64z {k1} locations containing single-precision data using writemask 
k1 and T1 hint with intent to write. 
EVEX.512.66.0F38.W1 C6 /6 /vsib A VIV AVX512PF | Using signed dword indices, prefetch sparse byte memory 
VSCATTERPF1DPD vm32y {k1} locations containing double-precision data using 
writemask k1 and T1 hint with intent to write. 
EVEX.512.66.0F38.W1 C7 /6 /vsib A VV AVX512PF | Using signed qword indices, prefetch sparse byte memory 
VSCATTERPF1QPD vm64z {k1} locations containing double-precision data using 
writemask k1 and T1 hint with intent to write. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 


A Tuple1 Scalar BaseReg (R): VSIB:base, NA NA NA 
VectorReg(R): VSIB:index 


Description 


The instruction conditionally prefetches up to sixteen 32-bit or eight 64-bit integer byte data elements. The 
elements are specified via the VSIB (i.e., the index register is an zmm, holding packed indices). Elements will only 
be prefetched if their corresponding mask bit is one. 


cache lines will be brought into exclusive state (RFO) specified by a locality hint (T1): 
e T1 (temporal data)—prefetch data into the second level cache. 


[PS data] For dword indices, the instruction will prefetch sixteen memory locations. For qword indices, the instruc- 
tion will prefetch eight values. 


[PD data] For dword and qword indices, the instruction will prefetch eight memory locations. 
Note that: 

(1) The prefetches may happen in any order (or not at all). The instruction is a hint. 

(2) The mask is left unchanged. 

(3) Not valid with 16-bit effective addresses. Will deliver a #UD fault. 

(4) No FP nor memory faults may be produced by this instruction. 

(5) Prefetches do not handle cache line splits 

(6) A #UD is signaled if the memory operand is encoded without the SIB byte. 


Operation 


BASE_ADDR stands for the memory operand base address (a GPR); may not exist 

VINDEX stands for the memory operand vector of indices (a vector register) 

SCALE stands for the memory operand scalar (1, 2, 4 or 8) 

DISP is the optional 1, 2 or 4 byte displacement 

PREFETCH(mem, Level, State) Prefetches a byte memory location pointed by ‘mem’ into the cache level specified by ‘Level’; a request 
for exclusive/ownership is done if ‘State’ is 1. Note that the memory location ignore cache line splits. This operation is considered a 
hint for the processor and may be skipped depending on implementation. 
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VSCATTERPF1DPS (EVEX encoded version) 
(KL, VL) = (16, 512) 
FOR j := 0 TO KL-1 
i:=j* 32 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+31:i]) * SCALE + DISP], Level=1, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPF1DPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k:=j* 32 
IF k1[j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+31:k]) * SCALE + DISP], Level=1, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPF1QPS (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[i+63:i]) * SCALE + DISP], Level=1, RFO = 1) 
Fl; 
ENDFOR 


VSCATTERPF1QPD (EVEX encoded version) 
(KL, VL) = (8, 512) 
FOR j := 0 TO KL-1 
i:=j* 64 
k :=j* 64 
IF k1{j] 
Prefetch( [BASE_ADDR + SignExtend(VINDEX[k+63:k]) * SCALE + DISP], Level=1, RFO = 1) 
Fl; 
ENDFOR 


Intel C/C++ Compiler Intrinsic Equivalent 
VSCATTERPF1DPD void _mm512_prefetch_i32scatter_pd(void *base, __m256i vdx, int scale, int hint); 


VSCATTERPF1DPD void __mm512_mask_prefetch_i32scatter_pd(void *base,__ mmask8 m, ___m256i vd, int scale, int hint); 
VSCATTERPF1DPS void __mm512_prefetch_i32scatter_ps(void *base, __m512i vdx, int scale, int hint); 
VSCATTERPF1DPS void __mm512_mask_prefetch_i32scatter_ps(void *base,__ mmask16 m,_m512i vdx, int scale, int hint); 


VSCATTERPF1QPD void_mm512_prefetch_i64scatter_pd(void * base, __m512i vdx, int scale, int hint); 
VSCATTERPF1QPD void __mm512_mask_prefetch_i64scatter_pd(void * base, _mmask8 m,___m512i vdx, int scale, int hint); 
VSCATTERPF1QPS void __mm512_prefetch_i64scatter_ps(void *base, __m512i vdx, int scale, int hint); 
VSCATTERPF1QPS void __mm512_mask_prefetch_i64scatter_ps(void *base, __mmask8 m, __m512i vdx, int scale, int hint); 


SIMD Floating-Point Exceptions 
None 


Other Exceptions 
See Table 2-62, “Type E12NP Class Exception Conditions”. 
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APPENDIX A 
OPCODE MAP 


Use the opcode tables in this chapter to interpret IA-32 and Intel 64 architecture object code. Instructions are 
divided into encoding groups: 


e 1-byte, 2-byte and 3-byte opcode encodings are used to encode integer, system, MMX technology, 
SSE/SSE2/SSE3/SSSE3/SSE4, and VMX instructions. Maps for these instructions are given in Table A-2 
through Table A-6. 


¢ Escape opcodes (in the format: ESC character, opcode, ModR/M byte) are used for floating-point instructions. 
The maps for these instructions are provided in Table A-7 through Table A-22. 


NOTE 


All blanks in opcode maps are reserved and must not be used. Do not depend on the operation of 
undefined or blank opcodes. 


A.1 USING OPCODE TABLES 


Tables in this appendix list opcodes of instructions (including required instruction prefixes, opcode extensions in 
associated ModR/M byte). Blank cells in the tables indicate opcodes that are reserved or undefined. Cells marked 
“Reserved-NOP” are also reserved but may behave as NOP on certain processors. Software should not use opcodes 
corresponding blank cells or cells marked “Reserved-NOP” nor depend on the current behavior of those opcodes. 


The opcode map tables are organized by hex values of the upper and lower 4 bits of an opcode byte. For i-byte 
encodings (Table A-2), use the four high-order bits of an opcode to index a row of the opcode table; use the four 
low-order bits to index a column of the table. For 2-byte opcodes beginning with OFH (Table A-3), skip any instruc- 
tion prefixes, the OFH byte (OFH may be preceded by 66H, F2H, or F3H) and use the upper and lower 4-bit values 
of the next opcode byte to index table rows and columns. Similarly, for 3-byte opcodes beginning with OF38H or 
OF3AH (Table A-4), skip any instruction prefixes, OF38H or OF3AH and use the upper and lower 4-bit values of the 
third opcode byte to index table rows and columns. See Section A.2.4, “Opcode Look-up Examples for One, Two, 
and Three-Byte Opcodes.” 


When a ModR/M byte provides opcode extensions, this information qualifies opcode execution. For information on 
how an opcode extension in the ModR/M byte modifies the opcode map in Table A-2 and Table A-3, see Section A.4. 


The escape (ESC) opcode tables for floating point instructions identify the eight high order bits of opcodes at the 
top of each page. See Section A.5. If the accompanying ModR/M byte is in the range of OOH-BFH, bits 3-5 (the top 
row of the third table on each page) along with the reg bits of ModR/M determine the opcode. ModR/M bytes 
outside the range of OOH-BFH are mapped by the bottom two tables on each page of the section. 


A.2 KEY TO ABBREVIATIONS 


Operands are identified by a two-character code of the form Zz. The first character, an uppercase letter, specifies 
the addressing method; the second character, a lowercase letter, specifies the type of operand. 


A.2.1 Codes for Addressing Method 


The following abbreviations are used to document addressing methods: 


A Direct address: the instruction has no ModR/M byte; the address of the operand is encoded in the instruc- 
tion. No base register, index register, or scaling factor can be applied (for example, far JMP (EA)). 


B The VEX.vvvv field of the VEX prefix selects a general purpose register. 
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The reg field of the ModR/M byte selects a control register (for example, MOV (OF20, OF22)). 


The reg field of the ModR/M byte selects a debug register (for example, 
MOV (0F21,0F23)). 


A ModR/M byte follows the opcode and specifies the operand. The operand is either a general-purpose 
register or a memory address. If it is a memory address, the address is computed from a segment register 
and any of the following values: a base register, an index register, a scaling factor, a displacement. 


EFLAGS/RFLAGS Register. 
The reg field of the ModR/M byte selects a general register (for example, AX (000)). 


The VEX.vvvv field of the VEX prefix selects a 128-bit XMM register or a 256-bit YMM register, determined 
by operand type. For legacy SSE encodings this operand does not exist, changing the instruction to 
destructive form. 


Immediate data: the operand value is encoded in subsequent bytes of the instruction. 


The instruction contains a relative offset to be added to the instruction pointer register (for example, JMP 
(OE9), LOOP). 


The upper 4 bits of the 8-bit immediate selects a 128-bit XMM register or a 256-bit YMM register, deter- 
mined by operand type. (the MSB is ignored in 32-bit mode) 


The ModR/M byte may refer only to memory (for example, BOUND, LES, LDS, LSS, LFS, LGS, 
CMPXCHG8B). 


The R/M field of the ModR/M byte selects a packed-quadword, MMX technology register. 


The instruction has no ModR/M byte. The offset of the operand is coded as a word or double word 
(depending on address size attribute) in the instruction. No base register, index register, or scaling factor 
can be applied (for example, MOV (A0-A3)). 


The reg field of the ModR/M byte selects a packed quadword MMX technology register. 


A ModR/M byte follows the opcode and specifies the operand. The operand is either an MMX technology 
register or a memory address. If it is a memory address, the address is computed from a segment register 
and any of the following values: a base register, an index register, a scaling factor, and a displacement. 


The R/M field of the ModR/M byte may refer only to a general register (for example, MOV (OF20-0F23)). 
The reg field of the ModR/M byte selects a segment register (for example, MOV (8C,8E)). 


The R/M field of the ModR/M byte selects a 128-bit XMM register or a 256-bit YMM register, determined by 
operand type. 


The reg field of the ModR/M byte selects a 128-bit XMM register or a 256-bit YMM register, determined by 
operand type. 


A ModR/M byte follows the opcode and specifies the operand. The operand is either a 128-bit XMM register, 
a 256-bit YMM register (determined by operand type), or a memory address. If it is a memory address, the 
address is computed from a segment register and any of the following values: a base register, an index 
register, a scaling factor, and a displacement. 


Memory addressed by the DS:rSI register pair (for example, MOVS, CMPS, OUTS, or LODS). 
Memory addressed by the ES:rDI register pair (for example, MOVS, CMPS, INS, STOS, or SCAS). 


Codes for Operand Type 


The following abbreviations are used to document operand types: 


a 


Two one-word operands in memory or two double-word operands in memory, depending on operand-size 
attribute (used only by the BOUND instruction). 


Byte, regardless of operand-size attribute. 
Byte or word, depending on operand-size attribute. 
Doubleword, regardless of operand-size attribute. 
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dq Double-quadword, regardless of operand-size attribute. 

p 32-bit, 48-bit, or 80-bit pointer, depending on operand-size attribute. 
pd 128-bit or 256-bit packed double-precision floating-point data. 

pi Quadword MMX technology register (for example: mm0O). 

ps 128-bit or 256-bit packed single-precision floating-point data. 

q Quadword, regardless of operand-size attribute. 


qq Quad-Quadword (256-bits), regardless of operand-size attribute. 


Ss 6-byte or 10-byte pseudo-descriptor. 

sd Scalar element of a 128-bit double-precision floating data. 

ss Scalar element of a 128-bit single-precision floating data. 

si Doubleword integer register (for example: eax). 

Vv Word, doubleword or quadword (in 64-bit mode), depending on operand-size attribute. 
Ww Word, regardless of operand-size attribute. 

x dq or qq based on the operand-size attribute. 

y Doubleword or quadword (in 64-bit mode), depending on operand-size attribute. 

Z Word for 16-bit operand-size or doubleword for 32 or 64-bit operand-size. 


A.2.3 Register Codes 
When an opcode requires a specific register as an operand, the register is identified by name (for example, AX, CL, 
or ESI). The name indicates whether the register is 64, 32, 16, or 8 bits wide. 


A register identifier of the form eXX or rXX is used when register width depends on the operand-size attribute. exx 
is used when 16 or 32-bit sizes are possible; rXX is used when 16, 32, or 64-bit sizes are possible. For example: 
eAX indicates that the AX register is used when the operand-size attribute is 16 and the EAX register is used when 
the operand-size attribute is 32. rAX can indicate AX, EAX or RAX. 


When the REX.B bit is used to modify the register specified in the reg field of the opcode, this fact is indicated by 
adding “/x” to the register name to indicate the additional possibility. For example, rCX/r9 is used to indicate that 
the register could either be rCX or r9. Note that the size of r9 in this case is determined by the operand size attri- 
bute (just as for rCX). 


A.2.4 Opcode Look-up Examples for One, Two, and Three-Byte Opcodes 


This section provides examples that demonstrate how opcode maps are used. 


A.2.4.1 One-Byte Opcode Instructions 


The opcode map for 1-byte opcodes is shown in Table A-2. The opcode map for 1-byte opcodes is arranged by row 
(the least-significant 4 bits of the hexadecimal value) and column (the most-significant 4 bits of the hexadecimal 
value). Each entry in the table lists one of the following types of opcodes: 


¢ Instruction mnemonics and operand types using the notations listed in Section A.2 
* Opcodes used as an instruction prefix 


For each entry in the opcode map that corresponds to an instruction, the rules for interpreting the byte following 

the primary opcode fall into one of the following cases: 

¢ AModR/M byte is required and is interpreted according to the abbreviations listed in Section A.1 and Chapter 
2, “Instruction Format,” of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. 
Operand types are listed according to notations listed in Section A.2. 
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¢ AModR/M byte is required and includes an opcode extension in the reg field in the ModR/M byte. Use Table A-6 
when interpreting the ModR/M byte. 


e Use of the ModR/M byte is reserved or undefined. This applies to entries that represent an instruction prefix or 
entries for instructions without operands that use ModR/M (for example: 60H, PUSHA; 06H, PUSH ES). 


Example A-1. Look-up Example for 1-Byte Opcodes 
Opcode 030500000000H for an ADD instruction is interpreted using the 1-byte opcode map (Table A-2) as follows: 


¢ = The first digit (0) of the opcode indicates the table row and the second digit (3) indicates the table column. This 
locates an opcode for ADD with two operands. 


¢ The first operand (type Gv) indicates a general register that is a word or doubleword depending on the operand- 
size attribute. The second operand (type Ev) indicates a ModR/M byte follows that specifies whether the 
operand is a word or doubleword general-purpose register or a memory address. 


° The ModR/M byte for this instruction is 05H, indicating that a 32-bit displacement follows (OOOO0000H). The 
reg/opcode portion of the ModR/M byte (bits 3-5) is 000, indicating the EAX register. 


The instruction for this opcode is ADD EAX, mem_op, and the offset of mem_op is OOOOOOOOH. 


Some 1- and 2-byte opcodes point to group numbers (shaded entries in the opcode map table). Group numbers 
indicate that the instruction uses the reg/opcode bits in the ModR/M byte as an opcode extension (refer to Section 
A.4). 


A.2.4.2 Two-Byte Opcode Instructions 


The two-byte opcode map shown in Table A-3 includes primary opcodes that are either two bytes or three bytes in 
length. Primary opcodes that are 2 bytes in length begin with an escape opcode OFH. The upper and lower four bits 
of the second opcode byte are used to index a particular row and column in Table A-3. 


Two-byte opcodes that are 3 bytes in length begin with a mandatory prefix (66H, F2H, or F3H) and the escape 
opcode (OFH). The upper and lower four bits of the third byte are used to index a particular row and column in Table 
A-3 (except when the second opcode byte is the 3-byte escape opcodes 38H or 3AH; in this situation refer to 
Section A.2.4.3). 


For each entry in the opcode map, the rules for interpreting the byte following the primary opcode fall into one of 
the following cases: 


¢ A ModR/M byte is required and is interpreted according to the abbreviations listed in Section A.1 and Chapter 
2, “Instruction Format,” of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. 
The operand types are listed according to notations listed in Section A.2. 


¢ AModR/M byte is required and includes an opcode extension in the reg field in the ModR/M byte. Use Table A-6 
when interpreting the ModR/M byte. 


¢ Use of the ModR/M byte is reserved or undefined. This applies to entries that represent an instruction without 
operands that are encoded using ModR/M (for example: OF77H, EMMS). 


Example A-2. Look-up Example for 2-Byte Opcodes 
Look-up opcode OFA4050000000003H for a SHLD instruction using Table A-3. 


° The opcode is located in row A, column 4. The location indicates a SHLD instruction with operands Ev, Gv, and 
Ib. Interpret the operands as follows: 


— Ev: The ModR/M byte follows the opcode to specify a word or doubleword operand. 
— Gv: The reg field of the ModR/M byte selects a general-purpose register. 
— Ib: Immediate data is encoded in the subsequent byte of the instruction. 


° The third byte is the ModR/M byte (05H). The mod and opcode/reg fields of ModR/M indicate that a 32-bit 
displacement is used to locate the first operand in memory and eAX as the second operand. 


° The next part of the opcode is the 32-bit displacement for the destination memory operand (OQOOQ0000H). The 
last byte stores immediate byte that provides the count of the shift (03H). 
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¢ By this breakdown, it has been shown that this opcode represents the instruction: SHLD DS:00000000H, EAX, 
3. 


A.2.4.3 Three-Byte Opcode Instructions 


The three-byte opcode maps shown in Table A-4 and Table A-5 includes primary opcodes that are either 3 or 4 
bytes in length. Primary opcodes that are 3 bytes in length begin with two escape bytes OF38H or OF3A. The upper 
and lower four bits of the third opcode byte are used to index a particular row and column in Table A-4 or Table A-5. 


Three-byte opcodes that are 4 bytes in length begin with a mandatory prefix (66H, F2H, or F3H) and two escape 
bytes (OF38H or OF3AH). The upper and lower four bits of the fourth byte are used to index a particular row and 
column in Table A-4 or Table A-5. 


For each entry in the opcode map, the rules for interpreting the byte following the primary opcode fall into the 
following case: 


° AModR/M byte is required and is interpreted according to the abbreviations listed in A.1 and Chapter 2, 
“Instruction Format,” of the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. The 
operand types are listed according to notations listed in Section A.2. 


Example A-3. Look-up Example for 3-Byte Opcodes 
Look-up opcode 660F3A0FC108H for a PALIGNR instruction using Table A-5. 


® 66H is a prefix and OF3AH indicate to use Table A-5. The opcode is located in row 0, column F indicating a 
PALIGNR instruction with operands Vdq, Wdq, and Ib. Interpret the operands as follows: 


— Vdq: The reg field of the ModR/M byte selects a 128-bit XMM register. 
— Wddq: The R/M field of the ModR/M byte selects either a 128-bit XMM register or memory location. 
— Ib: Immediate data is encoded in the subsequent byte of the instruction. 
¢ The next byte is the ModR/M byte (C1H). The reg field indicates that the first operand is XMMO. The mod shows 
that the R/M field specifies a register and the R/M indicates that the second operand is XMM1. 
° The last byte is the immediate byte (08H). 
¢ By this breakdown, it has been shown that this opcode represents the instruction: PALIGNR XMMO, XMM1, 8. 


A.2.4.4 VEX Prefix Instructions 


Instructions that include a VEX prefix are organized relative to the 2-byte and 3-byte opcode maps, based on the 
VEX.mmmmm field encoding of implied OF, OF38H, OF3AH, respectively. Each entry in the opcode map of a VEX- 
encoded instruction is based on the value of the opcode byte, similar to non-VEX-encoded instructions. 


A VEX prefix includes several bit fields that encode implied 66H, F2H, F3H prefix functionality (VEX.pp) and 
operand size/opcode information (VEX.L). See chapter 4 for details. 


Opcode tables A2-A6 include both instructions with a VEX prefix and instructions without a VEX prefix. Many entries 
are only made once, but represent both the VEX and non-VEX forms of the instruction. If the VEX prefix is present 
all the operands are valid and the mnemonic is usually prefixed with a “v”. If the VEX prefix is not present the 
VEX.vvvv operand is not available and the prefix “v” is dropped from the mnemonic. 


A few instructions exist only in VEX form and these are marked with a superscript “v”. 


Operand size of VEX prefix instructions can be determined by the operand type code. 128-bit vectors are indicated 
by 'dq', 256-bit vectors are indicated by 'qq', and instructions with operands supporting either 128 or 256-bit, 
determined by VEX.L, are indicated by 'x'. For example, the entry "VMOVUPD Vx,Wx" indicates both VEX.L=0 and 
VEX.L=1 are supported. 
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A.2.5 Superscripts Utilized in Opcode Tables 


Table A-1 contains notes on particular encodings. These notes are indicated in the following opcode maps by super- 
scripts. Gray cells indicate instruction groupings. 


Table A-1. Superscripts Utilized in Opcode Tables 


Superscript Meaning of Symbol 
Symbol 


1A Bits 5, 4, and 3 of ModR/M byte used as an opcode extension (refer to Section A.4, “Opcode Extensions For One-Byte 
And Two-byte Opcodes"). 

1B Use the OFOB opcode (UD2 instruction), the OFB9H opcode (UD1 instruction), or the OFFFH opcode (UDO instruction) 
when deliberately trying to generate an invalid opcode exception (#UD). 

1C Some instructions use the same two-byte opcode. If the instruction has variations, or the opcode represents 


different instructions, the ModR/M byte will be used to differentiate the instruction. For the value of the ModR/M 
byte needed to decode the instruction, see Table A-6. 


The instruction is invalid or not encodable in 64-bit mode. 40 through 4F (single-byte INC and DEC) are REX prefix 
combinations when in 64-bit mode (use FE/FF Grp 4 and 5 for INC and DEC). 


Instruction is only available when in 64-bit mode 


The operand size is forced to a 64-bit operand size when in 64-bit mode (prefixes that change operand size are 
ignored for this instruction in 64-bit mode). 


VEX form only exists. There is no legacy SSE form of the instruction. For Integer GPR instructions it means VEX 
prefix required. 


VEX128 & SSE forms only exist (no VEX256), when can't be inferred from the data size. 


When in 64-bit mode, instruction defaults to 64-bit operand size and cannot encode 32-bit operand size. 
v1 


A.3 ONE, TWO, AND THREE-BYTE OPCODE MAPS 


See Table A-2 through Table A-5 below. The tables are multiple page presentations. Rows and columns with 
sequential relationships are placed on facing pages to make look-up tasks easier. Note that table footnotes are not 
presented on each page. Table footnotes for each table are presented on the last page of the table. 
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Table A-2. One-byte Opcode Map: (OOH — F7H) * 


Gy, Ev AL, 


Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, rAX, Iz 


Gb, Eb Gv, Ev AL, Ib rAX, Iz 


Eb, Gb Ev, Gv 
INC'e4 general register / REX°® Prefixes 


eBP eSl eDl 


eAX eCxX eDX eBX eSP 
REX REX.B REX.X REX.XB REX.R REX.RB REX.RX REX.RXB 


PUSH* general register 
rAX/r8 rCX/r9 rDX/r10 rBX/r11 rSP/r12 rBP/r13 rSi/r14 rDI/r15 


PUSHA'®4/ POPA'4/ BOUND®4 ARPL'64 SEG=FS SEG=GS Operand Address 


PUSHAD!64 POPAD!®4 Gv, Ma Ew, Gw (Prefix) (Prefix) Size Size 
MOVSxD°64 (Prefix) (Prefix) 


Gv, Ev 
f64 Jb - Short-displacement jump on condition 


NO B/NAE/C NB/AE/NC Z/E NZ/NE 


Immediate Grp fs 


Ey, Iz Eb, Ib'®4 Ey, Ib Eb, Gb Ev, Gv 


Eb, Ib 


XCHG word, double-word or quad-word register with rAX 


NOP 
rSP/r12 rBP/r13 rSi/r14 


PAUSE(F3) 
XCHG r8, rAX BAM 


rDI/r15 


MOVS/B MOVS/W/D/Q CMPS/B CMPS/W/D 
AL, Ob TAX, Ov Ob, AL Ov, rAX erm ~ aie stad 
MOV immediate byte into byte register 


AL/R8B, Ib CLIR9B, Ib DL/R10B, Ib BL/R11B, Ib AH/R12B, Ib CH/R13B, Ib DH/R14B, Ib 
Shift Grp 214 near RET'®4 near RET!©4 Lesi64 Lbs! Grp 1118 - MOV 
ee Gz, Mp Eb, Ib Ey, Iz 


lw 
215, Us Bee lb VEX+2byte VEX+byte 


AAM'®4 AAD'®4 XLAT/ 
Ib Ib XLATB 


BH/R15B, Ib 


Shift Grp 214 


Eb, 1 Ev, 1 Eb, CL Ev, CL 


LOOPNE"4, LOOPE4/ Loopf4 Jrcxz'e4/ 


LOOPNz‘®4 Loopz'64 Jb Jb 
Jb Jb 


LOCK INT1 REPNE REP/REPE 
(Prefix) XACQUIRE XRELEASE 
(Prefix) (Prefix) 


Vol.2D A-7 


OPCODE MAP 


Table A-2. One-byte Opcode Map: (O8H — FFH) * 


PUSH 2-byte 
csi64 escape 
(Table A-3) 


PUSH POP 
psi64 psi64 


Eb, Gb Gb, Eb AL, rAX, Iz 


SEG=CS DAs!®4 
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, rAX, Iz (Prefix) 
CMP SEG=DS AAsi64 
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib rAX, Iz (Prefix) 
DEC'®4 general register / REX°® Prefixes 


eAX eCX eDX eBX eSP eBP eSl eDl 
REX.W REX.WB REX.WX REX.WXB REX.WR REX.WRB REX.WRX REX.WRXB 


POP“ into general register 
rAX/r8 rCX/r9 rDX/r10 rBX/r11 rSP/r12 rBP/r13 rSi/r14 rDI/r15 


IMUL PUSH*“4 IMUL INS/ INS/ OUTS/ OUTS/ 
Gy, Ey, Iz Ib Gy, Ev, Ib INSB INSW/ OUTSB OUTSW/ 
Yb, DX INSD DX, Xb OUTSD 
Yz, DX DX, Xz 


ft 


Jec'®4 | Jb- Short displacement jump on condition 


NP/PO LINGE NL/GE NLE/G 


MOV LEA Grp 1A14 pops64 
Ev, Sw Gv, M 


Eb, Gb Ev, Gv Gb, Eb Gv, Ev 


CBW/ CWD/ far CALL'64 FWAIT/ PUSHF/D/Q 464/ | POPF/D/Q 44; 
CWDE/ cCDaQ/ Ap WAIT Fv Fv 
CDQE cao 


STOS/B STOS/W/D/Q LODS/B LODS/W/D/Q SCAS/B SCAS/W/D/Q 


AL, Ib rAX, Iz Yb, AL Yv, rAX AL, Xb rAX, Xv AL, Yb rAX, Yv 


MOV immediate word or double into word, double, or quad register 
rAX/r8, lv rCX/r9, lv rDX/r10, lv rBX/r11, lv rSP/r12, Iv rBP/r13, Iv rSi/r14, lv rDI/r15 , lv 
far RET far RET INT3 IRET/D/Q 


lw 


ESC (Escape to coprocessor instruction set 


near CALL4 
Jz DX, AL DX, eAX 


CLC INC/DEC. INC/DEC. 
Grp AWA Grp 514 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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vmovups 
Vps, Wps 


Table A-3. Two-byte Opcode Map: OOH — 77H (First Byte is OFH) * 


vmovups 
Wps, Vps 


vmovips 
Va, Ha, Mq 
vmovhips 
Vq, Ha, Uq 


vmovips 
Ma, Vq 


vunpcklips 
Vx, Hx, Wx 


SYSCALL°* 


vunpckhps 
Vx, Hx, Wx 


vmovhps”! 

Vdq, Hq, Mq 
vmovihps 

Vdq, Hq, Uq 


OPCODE MAP 


SYSRET°©* 


vmovhps*! 
Mq, Vq 


for) 
o 


vmovupd 
Vpd, Wpd 


vmovupd 
Wpd,Vpd 


vmovipd 
Vq, Hq, Mq 


vmovipd 
Mq, Vq 


vunpckipd 
Vx,Hx,Wx 


vunpckhpd 
Vx,Hx,Wx 


vmovhpd"1 
Vdq, Hq, Mq 


vmovhpd" 
Mq, Vq 


vmovss 
Vx, Hx, Wss 


vmovss 
Wss, Hx, Vss 


vmovslidup 
Vx, Wx 


vmovshdup 
Vx, Wx 


F3 
F2 


vmovsd 
Vx, Hx, Wsd 


vmovmskps 
Gy, Ups 


vmovsd 
Wsd, Hx, Vsd 


vsqrtps 
Vps, Wps 


vmovddup 
Vx, Wx 


B/C/NAE 


vrsqrtps 
Vps, Wps 


CMOVcce, (Gv, Ev) - Conditional Move 


AE/NB/NC 


vrcpps 
Vps, Wps 


SYSENTER 


E/Z 


vandps 
Vps, Hps, Wps 


SYSEXIT 


vandnps 
Vps, Hps, Wps 


vorps 
Vps, Hps, Wps 


GETSEC 


vxorps 
Vps, Hps, Wps 


vmovmskpd 
Gy,Upd 


vsqrtpd 
Vpd, Wpd 


vandpd 
Vpd, Hpd, Wed 


vandnpd 
Vpd, Hpd, Wpd 


vorpd 
Vpd, Hpd, Wed 


vxorpd 
Vpd, Hpd, Wed 


vsqrtss 
Vss, Hss, Wss 


vrsqrtss 
Vss, Hss, Wss 


vrcpss 
Vss, Hss, Wss 


punpcklbw 
Pq, Qd 


vpunpcklbw 
Vx, Hx, Wx 


vsqrtsd 
Vsd, Hsd, Wsd 


punpcklwd 
Pq, Qd 


vpunpcklwd 
Vx, Hx, Wx 


punpckldq 
Pq, Qd 


vpunpckldq 
Vx, Hx, Wx 


packsswb 
Pq, Qq 


vpacksswb 
Vx, Hx, Wx 


pcmpgtb 
Pq, Qq 


vpcmpgtb 
Vx, Hx, Wx 


vpcmpgtw 
Vx, Hx, Wx 


pcmpgtd 
Pq, Qq 


vpcmpgtd 
Vx, Hx, Wx 


packuswb 
Pq, Qq 


vpackuswb 
Vx, Hx, Wx 


pshufw 
Pq, Qaq, Ib 


vpshufd 
Vx, Wx, Ib 


vpshufhw 
Vx, Wx, Ib 


vpshuflw 
Vx, Wx, Ib 


pcmpeqb 
Pq, Qq 


pcmpeqw 
Pq, Qq 


pcmpeqd 
Pq, Qq 


emms 
vzeroupper’ 
vzeroallY 


vpcmpeqb 
Vx, Hx, Wx 


vpcmpeqw 
Vx, Hx, Wx 


vpcmpeqd 
Vx, Hx, Wx 
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OPCODE MAP 


vmovaps 
Vps, Wps 


Table A-3. Two-byte Opcode Map: 08H — 7FH (First Byte is OFH) * 


WBINVD 


Reserved-NOP 


vmovaps 
Wps, Vps 


bndidx 


2-byte Illegal 
Opcodes 
up2'8 


bndstx 


bndmov 


bndmov 


bndcl 


bndmk 


bndcu 


cvtpi2ps 
Vps, Qpi 


bndcn 


vmovntps 
Mps, Vps 


cevttps2pi 
Ppi, Wps 


prefetchw(/1) 
Ev 


Reserved-NOP 


cvtps2pi 
Ppi, Wps 


vucomiss 
Vss, Wss 


vcomiss 
Vss, Wss 


vmovapd 
Vpd, Wed 


vmovapd 
Wpd,Vpd 


cvtpi2pd 
Vpd, Qpi 


vmovntpd 
Mpd, Vpd 


evttpd2pi 
Ppi, Wpd 


cvtpd2pi 
Qpi, Wpd 


vucomisd 
Vsd, Wsd 


vcomisd 
Vsd, Wsd 


vevtsi2ss 
Vss, Hss, Ey 


vevttss2si 
Gy, Wss 


vevtss2si 
Gy, Wss 


3-byte escape 
(Table A-4) 


vaddps 
Vps, Hps, Wps 


vmulps 
Vps, Hps, Wps 


vevtsi2sd 
Vsd, Hsd, Ey 
3-byte escape 
(Table A-5) 


vevips2pd 
Vpd, Wps 


vevttsd2si 
Gy, Wsd 


CMOVcc(Gv, Ev) - Conditional Move 


NP/PO 


vevidq2ps 
Vps, Wdq 


LINGE 


vsubps 
Vps, Hps, Wps 


vevtsd2si 
Gy, Wsd 


vminps 
Vps, Hps, Wps 


vdivps 
Vps, Hps, Wps 


vmaxps 
Vps, Hps, Wps 


vaddpd 
Vpd, Hpd, Wed 


vmulpd 
Vpd, Hpd, Wpd 


vevipd2ps 
Vps, Wpd 


vevips2dq 
Vdq, Wps 


vsubpd 
Vpd, Hpd, Wpd 


vminpd 
Vpd, Hpd, Wpd 


vdivpd 
Vpd, Hpd, Wpd 


vmaxpd 
Vpd, Hpd, Wed 


vaddss 
Vss, Hss, Wss 


vmulss 
Vss, Hss, Wss 


vevtss2sd 
Vsd, Hx, Wss 


vevitps2dq 
Vdq, Wps 


vsubss 
Vss, Hss, Wss 


vminss 
Vss, Hss, Wss 


vdivss 
Vss, Hss, Wss 


vmaxss 
Vss, Hss, Wss 


vaddsd 
Vsd, Hsd, Wsd 


punpckhbw 
Pq, Qd 


vmulsd 
Vsd, Hsd, Wsd 


punpckhwd 
Pq, Qd 


vevtsd2ss 
Vss, Hx, Wsd 


punpckhdq 
Pq, Qd 


packssdw 
Pq, Qd 


vsubsd 
Vsd, Hsd, Wsd 


vminsd 
Vsd, Hsd, Wsd 


vdivsd 
Vsd, Hsd, Wsd 


movd/q 
Pd, Ey 


vmaxsd 
Vsd, Hsd, Wsd 


movq 
Pq, Qq 


vpunpckhbw 
Vx, Hx, Wx 


vpunpckhwd 
Vx, Hx, Wx 


vpunpckhdq 
Vx, Hx, Wx 


vpackssdw 
Vx, Hx, Wx 


vpunpcklqdq 
Vx, Hx, Wx 


vpunpckhqdq 
Vx, Hx, Wx 


vmovd/q 
vy, Ey 


vmovdga 
Vx, Wx 


VMREAD 
Ey, Gy 


VMWRITE 
Gy, Ey 


movd/q 
Ey, Pd 


vmovdqu 
Vx, Wx 


movq 
Qq, Pq 


vhaddpd 
Vpd, Hpd, Wed 


vhsubpd 
Vpd, Hpd, Wpd 


vmovd/q 
Ey, Vy 


vmovdga 
Wx,Vx 


vmovq 
Vq, Wq 


vmovdqu 
Wx,Vx 
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vhaddps 
Vps, Hps, Wps 


vhsubps 
Vps, Hps, Wps 


3 
x 


Table A-3. Two-byte Opcode Map: 80H — F7H (First Byte is OFH) * 


Jcc' 
B/CNAE 


B/C/NAE 


vempps 
Vps,Hps,Wps, Ib 


AE/NB/NC 


SETcc, Eb - Byte 
AE/NB/NC 


movnti 
My, Gy 


4 Jz - Long-displacement jump on conditi 


E/Z 


Set on condition 
E/Z 


pinsrw 
Pq,Ry/Mw, |b 


pextrw 
Gd, Nq, Ib 


vshufps 
Vps,Hps,Wps, |b 


vcmppd 
Vpd,Hpd,Wpd, |b 


vpinsrw 
Vdq,Hdq,Ry/Mw, |b 


vpextrw 
Gd, Udq, Ib 


vshufpd 
Vpd,Hpd,Wpd, Ib 


vempss 
Vss,Hss,Wss, |b 


psrlw 
Pq, Qq 


vcmpsd 
Vsd,Hsd,Wsd,|Ib 


psrid 
Pq, Qq 


psrlq 
Pq, Qq 


pmullw 
Pq, Qq 


OPCODE MAP 


pmovmskb 
Gd, Nq 


vaddsubpd 
Vpd, Hpd, Wpd 


vpsrlw 
Vx, Hx, Wx 


vpsrid 
Vx, Hx, Wx 


vpsriq 
Vx, Hx, Wx 


vpmullw 
Vx, Hx, Wx 


movq2dq 
Vdq, Nq 


vpmovmskb 
Gd, Ux 


vaddsubps 
Vps, Hps, Wps 
pavgb 
Pq, Qq 


psraw 
Pq, Qq 


psrad 
Pq, Qq 


pavgw 
Pq, Qq 


pmulhuw 
Pq, Qq 


pmulhw 
Pq, Qq 


movdq2q 
Pq, Uq 


movntq 
Mq, Pq 


vpavgb 
Vx, Hx, Wx 


vpsraw 
Vx, Hx, Wx 


vpsrad 
Vx, Hx, Wx 


vpavgw 
Vx, Hx, Wx 


vpmulhuw 
Vx, Hx, Wx 


vpmulhw 
Vx, Hx, Wx 


vevitpd2dq 
Vx, Wpd 


vmovntdq 
Mx, Vx 


vevidq2pd 
Vx, Wpd 


pmuludg 
Pq, Qq 


pmaddwd 
Pq, Qq 


vevipd2dq 
Vx, Wpd 


psadbw 
Pq, Qq 


maskmovq 
Pq, Nq 


vpmuludq 
Vx, Hx, Wx 


vpmaddwd 
Vx, Hx, Wx 


vpsadbw 
Vx, Hx, Wx 


vmaskmovdqu 
Vdq, Udq 


viddqu 
Vx, Mx 
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Table A-3. Two-byte Opcode Map: 88H — FFH (First Byte is OFH) * 


Jec!®4, Jz - Long-displacement jump on condition 
Ss NS P/PE NP/PO LINGE NL/GE LE/NG NLE/G 
SETcc, Eb - Byte Set on condition 
Ss NS P/PE NP/PO LINGE NL/GE LE/NG NLE/G 
A PUSH" Pops RSM BTS SHRD SHRD (Grp 15")! IMUL 
GS GS Ev, Gv Ev, Gv, Ib Ev, Gv, CL Gv, Ev 
JMPE Grp 1014 Grp 8'* BTC BSF BSR MOVSX 
(reserved for Invalid Opcode’® Ev, Ib Ev, Gv Gv, Ev Gv, Ev Gv Eb Cv E 
B emulator on IPF) Me Ynew 
F3 POPCNT TZCNT LZCNT 
Gv, Ev Gv, Ev Gv, Ev 
BSWAP 
RAX/EAX/ RCX/ECX/ RDX/EDX/ RBX/EBX/ RSP/ESP/ RBP/EBP/ RSI/ESI/ RDI/EDI/ 
R8/R8D R9/R9D R10/R10D R11/R11D R12/R12D R13/R13D R14/R14D R15/R15D 
Cc 
psubusb psubusw pminub pand paddusb paddusw pmaxub pandn 
Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq 
66 vpsubusb vpsubusw vpminub vpand vpaddusb vpaddusw vpmaxub vpandn 
D Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx 
F3 
F2 
psubsb psubsw pminsw por paddsb paddsw pmaxsw pxor 
Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq 
66 vpsubsb vpsubsw vpminsw vpor vpaddsb vpaddsw vpmaxsw vpxor 
E Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx 
F3 
F2 
psubb psubw psubd psubq paddb paddw paddd 
Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq Pq, Qq oP 
F 66 vpsubb vpsubw vpsubd vpsubq vpaddb vpaddw vpaddd 
Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx Vx, Hx, Wx 
F2 
NOTES: 


* 


A-12 Vol. 2D 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


Table A-4. Three-byte Opcode Map: OOH — F7H (First Two Bytes are OF 38H) * 


pshufb 
Pq, Qq 


phaddw 
Pq, Qq 


phaddd 
Pq, Qq 


phaddsw 
Pq, Qq 


pmaddubsw 
Pq, Qq 


phsubw 
Pq, Qq 


phsubd 
Pq, Qq 


OPCODE MAP 


phsubsw 
Pq, Qq 


vpshufb 
Vx, Hx, Wx 


pblendvb 
Vdq, Wdq 


vphaddw 
Vx, Hx, Wx 


vphaddd 
Vx, Hx, Wx 


vphaddsw 
Vx, Hx, Wx 
vevtph2ps” 
Vx, Wx, Ib 


vpmaddubsw 
Vx, Hx, Wx 


blendvps 
Vdq, Wdq 


vphsubw 
Vx, Hx, Wx 


blendvpd 
Vdq, Wdq 


vphsubd 
Vx, Hx, Wx 
vpermps” 
Vqa, Haq, Waq 


vphsubsw 
Vx, Hx, Wx 


vpmovsxbw 
Vx, Ux/Mq 


vpmovsxbd 
Vx, Ux/Md 


vpmovsxbq 
Vx, Ux/Mw 


vpmovsxwd 
Vx, Ux/Mq 


vpmovsxwq 
Vx, Ux/Md 


vpmovsxdq 
Vx, Ux/Mq 


vpmovzxbw 
Vx, Ux/Mq 


vpmovzxbd 
Vx, Ux/Md 


vpmovzxbq 
Vx, Ux/Mw 


vpmovzxwd 
Vx, Ux/Mq 


vpmovzxwq 
Vx, Ux/Md 


vpmovzxdq 
Vx, Ux/Mq 


vpermdY 
Vaq, Haq, Waq 


vpcmpgtq 
Vx, Hx, Wx 


vpmulld 
Vx, Hx, Wx 


vphminposuw 
Vdq, Wdq 


vpsrlvd/qY 
Vx, Hx, Wx 


vpsravdY 
Vx, Hx, Wx 


vpsllvd/qY 
Vx, Hx, Wx 


INVEPT 
Gy, Mdq 


INVVPID 
Gy, Mdq 


INVPCID 
Gy, Mdq 


vgatherdd/qY 
Vx,Hx,Wx 


vgatherqd/qY 
Vx,Hx,Wx 


vgatherdps/dY 
Vx,Hx,Wx 


vgatherqps/dY 
Vx,Hx,Wx 


vfimaddsub132ps/dY 
Vx,Hx,Wx 


vfimsubadd132ps/dY 
Vx,Hx,Wx 


vfimaddsub213ps/d¥ 
Vx,Hx,Wx 


vfimsubadd213ps/dY 
Vx,Hx,Wx 


vfimaddsub231ps/dY 
Vx,Hx,Wx 


vfimsubadd231ps/dY 
Vx,Hx,Wx 


ADCX 
Gy, Ey 


ADOX 
Gy, Ey 


MULXY 
By,Gy,rDX,Ey 
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OPCODE MAP 


Table A-4. Three-byte Opcode Map: 08H — FFH (First Two Bytes are OF 38H) * 


psignb 
Pq, Qq 


psignw 
Pq, Qq 


psignd 
Pq, Qq 


pmulhrsw 
Pq, Qq 


vpsignb 
Vx, Hx, Wx 


vpsignw 
Vx, Hx, Wx 


vpsignd 
Vx, Hx, Wx 


vpmulhrsw 
Vx, Hx, Wx 


vpermilps” 
Vx,Hx,Wx 


vpermilpdY 
Vx,Hx,Wx 


vtestps” 
Vx, Wx 


vtestpdY 
Vx, Wx 


vbroadcastss” 
Vx, Wd 


vpmuldq 
Vx, Hx, Wx 


vbroadcastsd” Vaqq, 
Wa 


vpcmpeqq 
Vx, Hx, Wx 


\vbroadcastf128” Vqq, 
Mdq 


vmovntdga 
Vx, Mx 


vpackusdw 
Vx, Hx, Wx 


vmaskmovps” 
Vx,Hx,Mx 


vmaskmovpdY 
Vx,Hx,Mx 


vmaskmovpsY 
Mx,Hx,Vx 


vmaskmovpdY 
Mx,Hx,Vx 


vpminsb 
Vx, Hx, Wx 


vpminsd 
Vx, Hx, Wx 


vpminuw 
Vx, Hx, Wx 


vpminud 
Vx, Hx, Wx 


vpmaxsb 
Vx, Hx, Wx 


vpmaxsd 
Vx, Hx, Wx 


vpmaxuw 
Vx, Hx, Wx 


vpmaxud 
Vx, Hx, Wx 


vpbroadcastdY 
Vx, Wx 


vpbroadcastq’ 
Vx, Wx 


vbroadcasti128” 
Vaq, Mdq 


vpbroadcastbY 
Vx, Wx 


vpbroadcastwY 
Vx, Wx 


vpmaskmovd/q" 
Vx,Hx,Mx 


vpmaskmovd/qY 
Mx,Vx,Hx 


vimadd132ps/dY 
Vx, Hx, Wx 


vimadd132ss/d¥ 
Vx, Hx, Wx 


vfmsub132ps/d” 
Vx, Hx, Wx 


vimsub132ss/d” 
Vx, Hx, Wx 


vinmadd132ps/d” 
Vx, Hx, Wx 


vinmadd132ss/d” 
Vx, Hx, Wx 


vinmsub132ps/dY 
Vx, Hx, Wx 


vfnmsub132ss/d” 
Vx, Hx, Wx 


vimadd213ps/dY 
Vx, Hx, Wx 


vimadd213ss/dY 
Vx, Hx, Wx 


vimsub213ps/d” 
Vx, Hx, Wx 


vfimsub213ss/dY 
Vx, Hx, Wx 


vinmadd213ps/d” 
Vx, Hx, Wx 


vinmadd213ss/dY 
Vx, Hx, Wx 


vinmsub213ps/dY 
Vx, Hx, Wx 


vfnmsub213ss/dY 
Vx, Hx, Wx 


vimadd231ps/dY 
Vx, Hx, Wx 


shatnexte 
Vdq,Wdq 


vimadd231ss/dY 
Vx, Hx, Wx 


shaimsg1 
Vdq,Wdq 


vimsub231ps/d” 
Vx, Hx, Wx 


sha1msg2 
Vdgq,Wdq 


vfimsub231ss/dY 
Vx, Hx, Wx 


sha256rnds2 
Vdq,Wdq 


vinmadd231ps/d” 
Vx, Hx, Wx 


sha256msg1 
Vdq,Wdq 


vinmadd231ss/dY 
Vx, Hx, Wx 


sha256msg2 
Vdq,Wdq 


vinmsub231ps/dY 
Vx, Hx, Wx 


vfnmsub231ss/dY 
Vx, Hx, Wx 


VAESIMC 
Vdq, Wdq 


VAESENC 
Vdq,Hdgq,Wdq 


VAESENCLAST 
Vdq,Hdq,Wdq 


VAESDEC 
Vdq,Hdq,Wdq 


VAESDECLAST 
Vdq,Hdq,Wdq 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-5. Three-byte Opcode Map: OOH — F7H (First two bytes are OF 3AH) * 


vpermq” 
Vqq, Waq, Ib 


vpermpd” 
Vaq, Waq, |b 


vpblenddY 
Vx,Hx,Wx, Ib 


vpermilps” 
Vx, Wx, Ib 


vpermilpd” 
Vx, Wx, Ib 


vperm2f128Y 
Vqq,Hqq,Waq,|b 


OPCODE MAP 


vpextrb 
Rd/Mb, Vdq, Ib 


vpextrw 
Rd/Mw, Vdq, Ib 


vpextrd/q 
Ey, Vdq, Ib 


vextractps 
Ed, Vdq, Ib 


vpinsrb 
Vdq,Hdq,Ry/Mb, Ib 


vinsertps 
Vdq,Hdgq,Udq/Md, Ib 


vpinsrd/q 
Vdq,Hdq,Ey,|Ib 


vdpps 
Vx,Hx,Wx, Ib 


vdppd 
Vdq,Hdg,Wdq,Ib 


vmpsadbw 
Vx,Hx,Wx, Ib 


vpclmulqdq 
Vdq,Hdq,Wdq, |b 


vperm2i128” 
Vaqq,Hqq,Waq,lb 


vpcmpestrm 
Vdq, Wag, Ib 


vpcmpestri 
Vdq, Wag, Ib 


vpcmpistrm 
Vdq, Wag, Ib 


vpcmpistri 
Vdq, Wdg, Ib 


Tim) O JO}W]YS |oOlao}n 
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OPCODE MAP 


Table A-5. Three-byte Opcode Map: 08H — FFH (First Two Bytes are OF 3AH) * 
pix 


vroundps 
Vx,Wx,Ib 


vinsertf128” 
Vqq,Hqq,Waq,lb 


vroundpd 
Vx,Wx, Ib 


vextractf128” 
Wdq,Vqq,lb 


vroundss 
Vss,Wss, Ib 


vroundsd 
Vsd,Wsd,|b 


vblendps 
Vx,Hx,Wx,Ib 


vblendpd 
Vx,Hx,Wx,Ib 
vevtps2phY 
Wx, Vx, Ib 


vpblendw 
Vx,Hx,Wx, Ib 


palignr 
Pq, Qaq, Ib 
vpalignr 
Vx,Hx,Wx,Ib 


vinserti128” 
Vaq,Hqq,Waq, Ib 


vextracti128” 
Wdq,Vqq,lb 


vblendvps” 
Vx,Hx,Wx,Lx 


vblendvpdY 
Vx,Hx,Wx,Lx 


vpblendvbY 
Vx,Hx,Wx,Lx 


shatrnds4 
Vdq,Wdq,Ib 


VAESKEYGEN 
Vdq, Wdgq, Ib 


NOTES: 


* 
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All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


OPCODE MAP 


A.4 OPCODE EXTENSIONS FOR ONE-BYTE AND TWO-BYTE OPCODES 


Some 1-byte and 2-byte opcodes use bits 3-5 of the ModR/M byte (the nnn field in Figure A-1) as an extension of 
the opcode. 


mod nnn R/M 


Figure A-1. ModR/M Byte nnn Field (Bits 5, 4, and 3) 


Opcodes that have opcode extensions are indicated in Table A-6 and organized by group number. Group numbers 
(from 1 to 16, second column) provide a table entry point. The encoding for the r/m field for each instruction can 
be established using the third column of the table. 


A.4.1 Opcode Look-up Examples Using Opcode Extensions 


An Example is provided below. 


Example A-4. Interpreting an ADD Instruction 
An ADD instruction with a 1-byte opcode of 80H is a Group 1 instruction: 
¢ Table A-6 indicates that the opcode extension field encoded in the ModR/M byte for this instruction is OOOB. 


° The r/m field can be encoded to access a register (11B) or a memory address using a specified addressing 
mode (for example: mem = OOB, 01B, 10B). 


Example A-5. Looking Up OF01C3H 

Look up opcode OF01C3 for a VMRESUME instruction by using Table A-2, Table A-3 and Table A-6: 
° OF tells us that this instruction is in the 2-byte opcode map. 

* 01 (row O, column 1 in Table A-3) reveals that this opcode is in Group 7 of Table A-6. 


° C3 is the ModR/M byte. The first two bits of C3 are 11B. This tells us to look at the second of the Group 7 rows 
in Table A-6. 


° The Op/Reg bits [5,4,3] are OOOB. This tells us to look in the 000 column for Group 7. 
e Finally, the R/M bits [2,1,0] are 011B. This identifies the opcode as the VMRESUME instruction. 


A.4.2 Opcode Extension Tables 
See Table A-6 below. 


Vol.2D A-17 


OPCODE MAP 


Table A-6. Opcode Extensions for One- and Two-byte Opcodes by Group Number * 


8F 1A 


CO0,C1 reg, imm SHL/SAL 
DO, D1 reg, 1 
D2, D3 reg, CL 


TEST MUL DIV IDIV 
Ib/Iz AL/rAX AL/rAX AL/rAX 


INC DEC 
Eb Eb 


INC DEC near CALL'4 far CALL near JMP‘64 PUSH%4 
Ev Ev Ev Ev Ev 


SLDT STR LLDT VERR 
Rv/Mw Rv/Mw Ew Ew 


SGDT SIDT LGDT SMSW INVLPG 
Ms Ms Ms Mw/Rv Mb 


F6, F7 


FE 


FF 


VMCALL (001)} MONITOR [XGETBV (000) SWAPGS 
VMLAUNCH (000) — |XSETBV (001) 064/900) 
(010) MWAIT (001) 
VMRESUME | CLAC (010) vNt00) 
(011) VMXOFF| STAC (011) 
(100) ENCLS (111) 


RDTSCP (001) 


ENCLU(111) 


ICMPXCH8B Mq VMPTRLD VMPTRST 
CMPXCHG16B Mq Mq 
Mdq 


VMCLEAR 


RDSEED 


XABORT (000) Ib 


XBEGIN (000) Jz 


psraw 
Nq, Ib 


vpsraw 
Hx, Ux, Ib 


psrid psrad 
Nq, Ib Nq, Ib 


vpsrid vpsrad 
Hx, Ux, Ib Hx,Ux, Ib 


psrlq psl 

Nq, Ib Nq, 

vpsriq vpsridq vps! vpslldq 
Hx, Ux, Ib Hx, Ux, Ib Hx,Ux, Ib Hx,Ux,|Ib 


A-18 Vol. 2D 


OPCODE MAP 


Table A-6. Opcode Extensions for One- and Two-byte Opcodes by Group Number * (Contd.) 


Encoding of Bits 5,4,3 of the ModR/M Byte (bits 2,1,0 in parenthesis) 
Opcode Group | Mod 7,6 


fxsave fxrstor Idmxcsr stmxcsr XRSTOR | XSAVEOPT clflush 


lfence mfence sfence 


RDFSBASE | RDGSBASE | WRFSBASE | WRGSBASE 
Ry Ry Ry Ry 


prefetch prefetch prefetch prefetch Reserved NOP 
NTA TO 11 T2 


Reserved NOP 


BLSMSK’ 
VEX.0F38 F3 By, Ey 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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A.5 ESCAPE OPCODE INSTRUCTIONS 


Opcode maps for coprocessor escape instruction opcodes (x87 floating-point instruction opcodes) are in Table A-7 
through Table A-22. These maps are grouped by the first byte of the opcode, from D8-DF. Each of these opcodes 
has a ModR/M byte. If the ModR/M byte is within the range of OOH-BFH, bits 3-5 of the ModR/M byte are used as 
an opcode extension, similar to the technique used for 1-and 2-byte opcodes (see A.4). If the ModR/M byte is 
outside the range of OOH through BFH, the entire ModR/M byte is used as an opcode extension. 


A.5.1 Opcode Look-up Examples for Escape Instruction Opcodes 


Examples are provided below. 


Example A-6. Opcode with ModR/M Byte in the OOH through BFH Range 
DD0504000000H can be interpreted as follows: 


¢ The instruction encoded with this opcode can be located in Section . Since the ModR/M byte (05H) is within the 
OOH through BFH range, bits 3 through 5 (000) of this byte indicate the opcode for an FLD double-real 
instruction (see Table A-9). 


¢ The double-real value to be loaded is at OOO00004H (the 32-bit displacement that follows and belongs to this 
opcode). 


Example A-7. Opcode with ModR/M Byte outside the OOH through BFH Range 
D8C1H can be interpreted as follows: 


¢ This example illustrates an opcode with a ModR/M byte outside the range of OOH through BFH. The instruction 
can be located in Section A.4. 


¢ In Table A-8, the ModR/M byte C1H indicates row C, column 1 (the FADD instruction using ST(0), ST(1) as 
operands). 


A.5.2 Escape Opcode Instruction Tables 


Tables are listed below. 


A.5.2.1 Escape Opcodes with D8 as First Byte 


Table A-7 and A-8 contain maps for the escape instruction opcodes that begin with D8H. Table A-7 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


Table A-7. D8 Opcode Map When ModR/M Byte is Within OOH to BFH * 


nnn Field of ModR/M Byte (refer to Figure A.4) 
000B 001B 010B 011B 100B 101B 110B 111B 


FADD FMUL FCOM FCOMP FSUB FSUBR FDIV FDIVR 
single-real single-real single-real single-real single-real single-real single-real single-real 


NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-8 shows the map if the ModR/M byte is outside the range of OOH-BFH. Here, the first digit of the ModR/M byte selects the 
table row and the second digit selects the column. 


FADD 


Table A-8. D8 Opcode Map When ModR/M Byte is Outside OOH to BFH * 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FCOM 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),T(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FSUB 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FDIV 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


FM 


ST(0),ST(4) 


UL 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FCOMP 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),T(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FSUBR 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


NOTES: 


* 


A.5.2.2 


FDI 


VR 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


Escape Opcodes with D9 as First Byte 


Table A-9 and A-10 contain maps for escape instruction opcodes that begin with DOH. Table A-9 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


Table A-9. D9 Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 
011B 100B 


000B 001B 010B 101B 110B 111B 


FLD FST FSTP FLDENV FLDCW FSTENV FSTCW 
single-real single-real single-real 14/28 bytes 2 bytes 14/28 bytes 2 bytes 
NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-10 shows the map if the ModR/M byte is outside the range of OOH-BFH. Here, the first digit of the ModR/M byte selects 
the table row and the second digit selects the column. 


ST(0),ST(0) 


Table A-10. D9 Opcode Map When ModR/M Byte is Outside OOH to BFH * 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(7) 


FNOP 


FCHS 


FTST 


FXAM 


F2XM1 


FPATAN 


FXTRACT 


FPREM1 


FDECSTP 


FINCSTP 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FLDL2T 


FLDL2E 


FLDPI 


FLDLG2 


FLDLN2 


FYL2XP1 


FSQRT 


FSINCOS 


FRNDINT 


FSCALE 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.3 Escape Opcodes with DA as First Byte 
Table A-11 and A-12 contain maps for escape instruction opcodes that begin with DAH. Table A-11 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 
Table A-11. DA Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 
000B 001B 010B 011B 100B 101B 


110B 111B 


FIADD FIMUL FICOM FICOMP FISUB FISUBR FIDIV FIDIVR 
dword-integer dword-integer dword-integer dword-integer dword-integer dword-integer dword-integer dword-integer 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-12 shows the map if the ModR/M byte is outside the range of OOH-BFH. Here, the first digit of the ModR/M byte selects 
the table row and the second digit selects the column. 


Table A-12. DA Opcode Map When ModR/M Byte is Outside OOH to BFH * 


FCM 


OVB 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FCMOVBE 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FCM 


OVE 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FCM 


OVU 


ST(0),ST(0) 


ST(0),ST(1) 


ST(0),ST(2) 


ST(0),ST(3) 


ST(0),ST(4) 


ST(0),ST(5) 


ST(0),ST(6) 


ST(0),ST(7) 


FUCOMPP 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.4 Escape Opcodes with DB as First Byte 


Table A-13 and A-14 contain maps for escape instruction opcodes that begin with DBH. Table A-13 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


Table A-13. DB Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 


000B 001B 010B 011B 100B 101B 110B 111B 


FILD FISTTP FIST FISTP FLD FSTP 
dword-integer dword-integer dword-integer dword-integer extended-real extended-real 


NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-14 shows the map if the ModR/M byte is outside the range of OOH-BFH. Here, the first digit of the ModR/M byte selects 
the table row and the second digit selects the column. 


Table A-14. DB Opcode Map When ModR/M Byte is Outside OOH to BFH * 


FCMOVNB 
ST(0),ST(0) | ST(0),ST(1) | ST(0),ST(2) | ST(O),ST(3) | ST(0),ST(4) | ST(O),ST(5) | ST(O),ST(6) | ST(0),ST(7) 
FCMOVNBE 
ST(0),ST(0) | ST(0),ST(1) | ST(O),ST(2) | ST(0),ST(3) | ST(O),ST(4) | ST(O),ST(5) | ST(O),ST(6) | ST(0),ST(7) 
FCLEX FINIT 


ST(0),ST(0) | ST(0),ST(1) | ST(0),ST(2) ST(0),ST(5) | ST(0),ST(6) | ST(0),ST(7) 


FCMOVNE 
ST(0),ST(0) | ST(0),ST(1) | ST(O),ST(2) | ST(0),ST(3) | ST(O),ST(4) | ST(O),ST(5) | ST(O),ST(6) | ST(0),ST(7) 
FCMOVNU 
ST(0),ST(0) | ST(0),ST(1) | ST(O),ST(2) | ST(0),ST(3) | ST(O),ST(4) | ST(O),ST(5) | ST(O),ST(6) | ST(0),ST(7) 
FUCOMI 
ST(0),ST(0) | ST(0),ST(1) | ST(0),ST(2) | ST(0),ST(3) | ST(O),ST(4) | ST(O),ST(5) | ST(O),ST(6) | ST(0),ST(7) 


NOTES: 
* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.5 Escape Opcodes with DC as First Byte 


Table A-15 and A-16 contain maps for escape instruction opcodes that begin with DCH. Table A-15 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


Table A-15. DC Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte (refer to Figure A-1) 


000B 001B 010B 011B 100B 101B 110B 111B 


FADD FMUL FCOM FCOMP FSUB FSUBR FDIV FDIVR 
double-real double-real double-real double-real double-real double-real double-real double-real 


NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-16 shows the map if the ModR/M byte is outside the range of OOH-BFH. In this case the first digit of the ModR/M byte 
selects the table row and the second digit selects the column. 


FADD 


Table A-16. DC Opcode Map When ModR/M Byte is Outside OOH to BFH * 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FSUBR 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FDI 


VR 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(7),ST(0) 


FS 


UB 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FDIV 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


NOTES: 
* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.6 Escape Opcodes with DD as First Byte 


Table A-17 and A-18 contain maps for escape instruction opcodes that begin with DDH. Table A-17 shows the map if the ModR/M 
byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


Table A-17. DD Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 


000B 001B 010B 011B 100B 101B 110B 111B 


FLD FISTTP FST FSTP FRSTOR FSAVE FSTSW 
double-real integer64 double-real double-real 98/108bytes 98/108bytes 2 bytes 
NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-18 shows the map if the ModR/M byte is outside the range of OOH-BFH. The first digit of the ModR/M byte selects the table 
row and the second digit selects the column. 


Table A-18. DD Opcode Map When ModR/M Byte is Outside OOH to BFH * 


ST(4) ST(5) 


ST(4) ST(5) 


FUCOM 


ST(0),ST(0) ST(1),ST(0) ST(2),ST(0) ST(3),ST(0) ST(4),ST(0) ST(5),ST(0) ST(6),ST(0) ST(7),ST(0) 


NOTES: 


* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.7 Escape Opcodes with DE as First Byte 
Table A-19 and A-20 contain opcode maps for escape instruction opcodes that begin with DEH. Table A-19 shows the opcode map 
if the ModR/M byte is in the range of OOH-BFH. In this case, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruc- 
tion. 
Table A-19. DE Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 
000B 001B 010B 011B 100B 101B 110B 111B 


FIADD FIMUL FICOM FICOMP FISUB FISUBR FIDIV FIDIVR 
word-integer word-integer word-integer word-integer word-integer word-integer word-integer word-integer 


NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-20 shows the opcode map if the ModR/M byte is outside the range of OOH-BFH. The first digit of the ModR/M byte selects 
the table row and the second digit selects the column. 


Table A-20. DE Opcode Map When ModR/M Byte is Outside OOH to BFH * 


FADDP 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FSUBRP 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FDIVRP 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(5),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


ST(0),ST(0) 


ST(1),ST(0) 


ST(2),ST(0) 


ST(3),ST(0) 


ST(4),ST(0) 


ST(6),ST(0) 


ST(7),ST(0) 


FCOMPP 


FSUBP 
ST(3),ST(0) ST(4),ST(0) 
FDIVP 
ST(3),ST(0) ST(4),ST(0) 


ST(0),ST(0) | ST(1),ST(O) | ST(2),ST(O) ST(5),ST(0) | ST(6),ST(0) | ST(7),ST(O) 


ST(0),ST(0) 
NOTES: 


* 


ST(1),ST(0) ST(2),ST(0). ST(5),ST(0) ST(6),ST(0) ST(7),ST(0) 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 


A.5.2.8 Escape Opcodes with DF As First Byte 


Table A-21 and A-22 contain the opcode maps for escape instruction opcodes that begin with DFH. Table A-21 shows the opcode 
map if the ModR/M byte is in the range of OOH-BFH. Here, the value of bits 3-5 (the nnn field in Figure A-1) selects the instruction. 


Table A-21. DF Opcode Map When ModR/M Byte is Within OOH to BFH * 
nnn Field of ModR/M Byte 


000B 001B 010B 011B 100B 101B 110B 111B 


FILD FISTTP FIST FISTP FBLD FILD FBSTP FISTP 
word-integer word-integer word-integer word-integer packed-BCD qword-integer packed-BCD qword-integer 


NOTES: 


* 


All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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Table A-22 shows the opcode map if the ModR/M byte is outside the range of OOH-BFH. The first digit of the ModR/M byte selects 
the table row and the second digit selects the column. 


Table A-22. DF Opcode Map When ModR/M Byte is Outside OOH to BFH © 


FCOMIP 


ST(0),ST(1) ; ST(0),ST(3) ST(0),ST(4) ST(0),ST(5) ST(0),ST(6) ST(0),ST(7) 


FUCOMIP 
ST(0),ST(0) ST(0),ST(1) ; ST(0),ST(3) ST(0),ST(4) ST(0),ST(5) ST(0),ST(6) ST(0),ST(7) 


NOTES: 
* All blanks in all opcode maps are reserved and must not be used. Do not depend on the operation of undefined or reserved locations. 
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APPENDIX B 
INSTRUCTION FORMATS AND ENCODINGS 


This appendix provides machine instruction formats and encodings of IA-32 instructions. The first section describes 
the IA-32 architecture’s machine instruction format. The remaining sections show the formats and encoding of 
general-purpose, MMX, P6 family, SSE/SSE2/SSE3, x87 FPU instructions, and VMX instructions. Those instruction 
formats also apply to Intel 64 architecture. Instruction formats used in 64-bit mode are provided as supersets of 
the above. 


B.1 MACHINE INSTRUCTION FORMAT 


All Intel Architecture instructions are encoded using subsets of the general machine instruction format shown in 
Figure B-1. Each instruction consists of: 


® an opcode 


* aregister and/or address mode specifier consisting of the ModR/M byte and sometimes the scale-index-base 
(SIB) byte (if required) 
¢ adisplacement and an immediate data field (if required) 


76543210 76543210 76543210 
Legacy Prefixes | REX Prefixes [TTTTTTTT TTTTTTTT | TTTTTTTT 


Grp 1,Grp 2, (optional) 
Grp 3, Grp 4 1, 2, or 3 Byte Opcodes (T = Opcode 


7-6 5-3. 2:0 7-6 5-3 2-0 
—_ Mod Reg* R/M_ |Scale Index Base | d32|16|8|None d32|16|8|None 


ModR/M Byte SIB Byte Address Displacement Immediate Data 
NN (4,2, 1 Bytes or None) (4,2,1 Bytes or None) 
Register and/or Address NOTE: 
Mode Specifier 


* The Reg Field may be used as an 
opcode extension field (TTT) and as a 
way to encode diagnostic registers 
(eee). 


Figure B-1. General Machine Instruction Format 


The following sections discuss this format. 


B.1.1 Legacy Prefixes 


The legacy prefixes noted in Figure B-1 include 66H, 67H, F2H and F3H. They are optional, except when F2H, F3H 
and 66H are used in new instruction extensions. Legacy prefixes must be placed before REX prefixes. 


Refer to Chapter 2, “Instruction Format,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 2A, for more information on legacy prefixes. 


Vol.2D B-1 


INSTRUCTION FORMATS AND ENCODINGS 


B.1.2 REX Prefixes 


REX prefixes are a set of 16 opcodes that span one row of the opcode map and occupy entries 40H to 4FH. These 
opcodes represent valid instructions (INC or DEC) in IA-32 operating modes and in compatibility mode. In 64-bit 
mode, the same opcodes represent the instruction prefix REX and are not treated as individual instructions. 


Refer to Chapter 2, “Instruction Format,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 2A, for more information on REX prefixes. 


B.1.3 Opcode Fields 


The primary opcode for an instruction is encoded in one to three bytes of the instruction. Within the primary 
opcode, smaller encoding fields may be defined. These fields vary according to the class of operation being 
performed. 


Almost all instructions that refer to a register and/or memory operand have a register and/or address mode byte 
following the opcode. This byte, the ModR/M byte, consists of the mod field (2 bits), the reg field (3 bits; this field 
is sometimes an opcode extension), and the R/M field (3 bits). Certain encodings of the ModR/M byte indicate that 
a second address mode byte, the SIB byte, must be used. 


If the addressing mode specifies a displacement, the displacement value is placed immediately following the 
ModR/M byte or SIB byte. Possible sizes are 8, 16, or 32 bits. If the instruction specifies an immediate value, the 
immediate value follows any displacement bytes. The immediate, if specified, is always the last field of the instruc- 
tion. 


Refer to Chapter 2, “Instruction Format,” in the Inte/® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 2A, for more information on opcodes. 


B.1.4 Special Fields 


Table B-1 lists bit fields that appear in certain instructions, sometimes within the opcode bytes. All of these fields 
(except the d bit) occur in the general-purpose instruction formats in Table B-13. 


Table B-1. Special Fields Within Instruction Encodings 


Field Name Description sat - 

reg General-register specifier (see Table B-4 or B-5). 3 

Ww Specifies if data is byte or full-sized, where full-sized is 16 or 32 bits (see Table B-6). 1 

Ss Specifies sign extension of an immediate field (see Table B-7). 1 
sreg2 Segment register specifier for CS, SS, DS, ES (see Table B-8). 2 
sreg3 Segment register specifier for CS, SS, DS, ES, FS, GS (see Table B-8). 3 
eee Specifies a special-purpose (control or debug) register (see Table B-9). 3 
tttn For conditional instructions, specifies a condition asserted or negated (see Table B-12). 4 

d Specifies direction of data operation (see Table B-11). 1 
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Reg Field (reg) for Non-64-Bit Modes 


INSTRUCTION FORMATS AND ENCODINGS 


The reg field in the ModR/M byte specifies a general-purpose register operand. The group of registers specified is 
modified by the presence and state of the w bit in an encoding (refer to Section B.1.4.3). Table B-2 shows the 

encoding of the reg field when the w bit is not present in an encoding; Table B-3 shows the encoding of the reg field 
when the w bit is present. 


Table B-2. Encoding of reg Field When w Field is Not Present in Instruction 


reg Field Register Selected during Register Selected during 

16-Bit Data Operations 32-Bit Data Operations 
000 AX EAX 
001 CX ECX 
010 DX EDX 
011 BX EBX 
100 SP ESP 
101 BP EBP 
110 Sl ESI 
111 DI EDI 


Table B-3. Encoding of reg Field When w Field is Present in Instruction 


Register Specified by reg Field 
During 16-Bit Data Operations 


reg 


000 
001 
010 
011 
100 
101 
110 
111 


Function of w Field 


When w=0 When w= 1 
AL AX 
CL CX 
DL DX 
BL BX 
AH SP 
CH BP 
DH Sl 
BH DI 


reg 


000 
001 
010 
011 
100 
101 
110 
111 


Register Specified by reg Field 
During 32-Bit Data Operations 
Function of w Field 
When w=0 When w= 1 

AL EAX 

CL ECX 

DL EDX 

BL EBX 

AH ESP 

CH EBP 

DH ESI 

BH EDI 
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B.1.4.2 Reg Field (reg) for 64-Bit Mode 


Just like in non-64-bit modes, the reg field in the ModR/M byte specifies a general-purpose register operand. The 
group of registers specified is modified by the presence of and state of the w bit in an encoding (refer to Section 
B.1.4.3). Table B-4 shows the encoding of the reg field when the w bit is not present in an encoding; Table B-5 
shows the encoding of the reg field when the w bit is present. 


Table B-4. Encoding of reg Field When w Field is Not Present in Instruction 


reg Field Register Selected during Register Selected during Register Selected during 
16-Bit Data Operations 32-Bit Data Operations 64-Bit Data Operations 
000 AX EAX RAX 
001 CX ECX RCX 
010 DX EDX RDX 
011 BX EBX RBX 
100 SP ESP RSP 
101 BP EBP RBP 
110 Sl ESI RSI 
111 DI EDI RDI 


Table B-5. Encoding of reg Field When w Field is Present in Instruction 


Register Specified by reg Field Register Specified by reg Field 
During 16-Bit Data Operations During 32-Bit Data Operations 
Function of w Field Function of w Field 
ve When w =0 When w= 1 a When w=0 When w=1 
000 AL AX 000 AL EAX 
001 CL CX 001 CL ECX 
010 DL DX 010 DL EDX 
011 BL BX 011 BL EBX 
100 AH! SP 100 AH* ESP 
101 CH? BP 101 CH* EBP 
110 DH Sl 110 DH* ESI 
111 BH DI 111 BH* EDI 
NOTES: 


1. AH, CH, DH, BH can not be encoded when REX prefix is used. Such an expression defaults to the low byte. 


B.1.4.3 Encoding of Operand Size (w) Bit 


The current operand-size attribute determines whether the processor is performing 16-bit, 32-bit or 64-bit opera- 
tions. Within the constraints of the current operand-size attribute, the operand-size bit (w) can be used to indicate 
operations on 8-bit operands or the full operand size specified with the operand-size attribute. Table B-6 shows the 
encoding of the w bit depending on the current operand-size attribute. 


Table B-6. Encoding of Operand Size (w) Bit 


w Bit 


Operand Size When 


Operand-Size Attribute is 16 Bits 


8 Bits 
16 Bits 


Operand Size When 


Operand-Size Attribute is 32 Bits 


8 Bits 
32 Bits 
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INSTRUCTION FORMATS AND ENCODINGS 


The sign-extend (s) bit occurs in instructions with immediate data fields that are being extended from 8 bits to 16 


or 32 bits. See Table B-7. 


Table B-7. Encoding of Sign-Extend (s) Bit 


Effect on 8-Bit 
Immediate Data 


Effect on 16- or 32-Bit 
Immediate Data 


0 None 


1 Sign-extend to fill 16-bit or 32-bit destination 


None 


None 


B.1.4.5 Segment Register (sreg) Field 


When an instruction operates on a segment register, the reg field in the ModR/M byte is called the sreg field and is 
used to specify the segment register. Table B-8 shows the encoding of the sreg field. This field is sometimes a 2-bit 
field (Ssreg2) and other times a 3-bit field (sreg3). 


Table B-8. Encoding of the Segment Register (sreg) Field 


2-Bit sreg2 Field Segment Register Selected 3-Bit sreg3 Field Segment Register Selected 
00 ES 000 ES 
01 cs 001 cs 
10 SS 010 Ss 
11 DS 011 DS 
100 FS 
101 GS 
110 Reserved! 
111 Reserved 
NOTES: 


1. Do not use reserved encodings. 


B.1.4.6 Special-Purpose Register (eee) Field 


When control or debug registers are referenced in an instruction they are encoded in the eee field, located in bits 5 
though 3 of the ModR/M byte (an alternate encoding of the sreg field). See Table B-9. 


Table B-9. Encoding of Special-Purpose Register (eee) Field 


eee Control Register Debug Register 
000 CRO DRO 

001 Reserved? DR1 

010 CR2 DR2 

011 CR3 DR3 

100 CR4 Reserved 
101 Reserved Reserved 
110 Reserved DR6 

111 Reserved DR7 


NOTES: 
1. Do not use reserved encodings. 
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B.1.4.7 Condition Test (tttn) Field 


For conditional instructions (such as conditional jumps and set on condition), the condition test field (tttn) is 
encoded for the condition being tested. The ttt part of the field gives the condition to test and the n part indicates 
whether to use the condition (n = 0) or its negation (n = 1). 


¢ For i-byte primary opcodes, the tttn field is located in bits 3, 2, 1, and 0 of the opcode byte. 
° For 2-byte primary opcodes, the tttn field is located in bits 3, 2, 1, and 0 of the second opcode byte. 
Table B-10 shows the encoding of the tttn field. 


Table B-10. Encoding of Conditional Test (tttn) Field 


tttn Mnemonic Condition 
0000 0 Overflow 

0001 NO No overflow 

0010 B, NAE Below, Not above or equal 

0011 NB, AE Not below, Above or equal 

0100 E;Z Equal, Zero 

0101 NE, NZ Not equal, Not zero 

0110 BE, NA Below or equal, Not above 

0111 NBE, A Not below or equal, Above 

1000 S Sign 

1001 NS Not sign 

1010 P, PE Parity, Parity Even 

1011 NP, PO Not parity, Parity Odd 

1100 L, NGE Less than, Not greater than or equal to 
1101 NL, GE Not less than, Greater than or equal to 
1110 LE, NG Less than or equal to, Not greater than 
1111 NLE, G Not less than or equal to, Greater than 


B.1.4.8 Direction (d) Bit 


In many two-operand instructions, a direction bit (d) indicates which operand is considered the source and which 
is the destination. See Table B-11. 


¢ When used for integer instructions, the d bit is located at bit 1 of a 1-byte primary opcode. Note that this bit 
does not appear as the symbol “d” in Table B-13; the actual encoding of the bit as 1 or 0 is given. 


¢ When used for floating-point instructions (in Table B-16), the d bit is shown as bit 2 of the first byte of the 
primary opcode. 


Table B-11. Encoding of Operation Direction (d) Bit 


d Source Destination 
0 reg Field ModR/M or SIB Byte 
1 ModR/M or SIB Byte reg Field 


B.1.5 Other Notes 


Table B-12 contains notes on particular encodings. These notes are indicated in the tables shown in the following 
sections by superscripts. 
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Table B-12. Notes on Instruction Encoding 
Symbol Note 
A value of 11B in bits 7 and 6 of the ModR/M byte is reserved. 
A value of 01B (or 108) in bits 7 and 6 of the ModR/M byte is reserved. 


B.2 GENERAL-PURPOSE INSTRUCTION FORMATS AND ENCODINGS FOR NON- 
64-BIT MODES 


Table B-13 shows machine instruction formats and encodings for general purpose instructions in non-64-bit 
modes. 


Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes 


Instruction and Format Encoding 
AAA - ASCII Adjust after Addition 00110111 
AAD - ASCII Adjust AX before Division 1101 0101 : 0000 1010 
AAM - ASCII Adjust AX after Multiply 1101 0100 : 0000 1010 
AAS - ASCII Adjust AL after Subtraction 00111111 
ADC - ADD with Carry 
register1 to register2 0001 O0Ow : 11 reg] reg2 
register2 to register1 0001 001w: 11 reg] reg2 
memory to register 0001 001w: mod reg r/m 
register to memory 0001 O0Ow : mod reg r/m 
immediate to register 1000 OOsw: 11 010 reg: immediate data 
immediate to AL, AX, or EAX 0001 010w: immediate data 
immediate to memory 1000 OOsw : mod 010 r/m: immediate data 
ADD - Add 
register1 to register2 0000 O00w : 11 reg] reg2 
register2 to register1 0000 001w: 11 reg] reg2 
memory to register 0000 001w: mod reg r/m 
register to memory 0000 O00w : mod reg r/m 
immediate to register 1000 OOsw: 11 000 reg: immediate data 
immediate to AL, AX, or EAX 0000 010w: immediate data 
immediate to memory 1000 OOsw : mod 000 r/m: immediate data 
AND - Logical AND 
register1 to register2 0010 O000w: 11 reg] reg2 
register2 to register 0010 001w: 11 reg] reg2 
memory to register 0010 001w: mod reg r/m 
register to memory 0010 O0Ow : mod reg r/m 
immediate to register 1000 OOsw: 11 100 reg: immediate data 
immediate to AL, AX, or EAX 0010 010w: immediate data 
immediate to memory 1000 OOsw : mod 100 r/m: immediate data 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


ARPL - Adjust RPL Field of Selector 


from register 0110 0011: 11 reg] reg2 
from memory 0110 0011 : mod reg r/m 
BOUND - Check Array Against Bounds 0110 0010: mod’ reg r/m 
BSF - Bit Scan Forward 
register1, register2 0000 1111: 1011 1100: 11 reg] reg2 
memory, register 0000 1111: 1011 1100: mod reg r/m 
BSR - Bit Scan Reverse 
register1, register2 0000 1111: 1011 1101:11 reg] reg2 
memory, register 0000 1111: 1011 1101 :modregr/m 
BSWAP - Byte Swap 0000 1111:1100 1 reg 
BT - Bit Test 
register, immediate 0000 1111: 1011 1010: 11 100 reg: imm8 data 
memory, immediate 0000 1111: 1011 1010: mod 100 r/m: imm8 data 
register1, register2 0000 1111: 10100011:11 reg2 reg] 
memory, reg 0000 1111: 10100011 : mod reg r/m 
BTC - Bit Test and Complement 
register, immediate 0000 1111: 1011 1010: 11 111 reg: imm8 data 
memory, immediate 0000 1111: 1011 1010: mod 111 r/m: imm8 data 
register1, register2 0000 1111: 1011 1011:11 reg2 reg] 
memory, reg 0000 1111: 1011 1011 :modregr/m 
BTR - Bit Test and Reset 
register, immediate 0000 1111: 1011 1010: 11 110 reg: imm8 data 
memory, immediate 0000 1111: 1011 1010: mod 110 r/m: imm8 data 
register1, register2 0000 1111: 1011 0011:11 reg2 reg] 
memory, reg 0000 1111: 1011 0011: mod reg r/m 
BTS - Bit Test and Set 
register, immediate 0000 1111: 1011 1010: 11 101 reg: imm8 data 
memory, immediate 0000 1111: 1011 1010: mod 101 r/m: imm8 data 
register1, register2 0000 1111: 1010 1011:11 reg2 reg] 
memory, reg 0000 1111: 1010 1011: mod reg r/m 
CALL - Call Procedure (in same segment) 
direct 1110 1000: full displacement 
register indirect 1111 1111:11010reg 
memory indirect 1111 1111:mod010r/m 
CALL - Call Procedure (in other segment) 
direct 1001 1010: unsigned full offset, selector 
indirect 1111 1111:mod 011 r/m 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format Encoding 

CBW - Convert Byte to Word 1001 1000 

CDQ - Convert Doubleword to Qword 1001 1001 

CLC - Clear Carry Flag 1111 1000 

CLD - Clear Direction Flag 1111 1100 

CLI - Clear Interrupt Flag 1111 1010 

CLTS - Clear Task-Switched Flag in CRO 0000 1111 : 0000 0110 

CMC - Complement Carry Flag 1111 0101 

CMP - Compare Two Operands 

register] with register2 0011 100w: 11 reg1 reg2 


register2 with register] 0011 101w: 11 reg1 reg2 

memory with register 0011 100w: mod reg r/m 

register with memory 0011 101w: mod reg r/m 

immediate with register 1000 OOsw: 11 111 reg: immediate data 


immediate with AL, AX, or EAX 


0011 110w: 


immediate data 


immediate with memory 1000 OOsw : mod 111 r/m: immediate data 
CMPS/CMPSB/CMPSW/CMPSD - Compare String Operands 1010 011w 
CMPXCHG - Compare and Exchange 

register1, register2 0000 1111: 1011 O00w: 11 reg2 reg] 


memory, register 0000 1111: 1011 O0Ow: mod reg r/m 
CPUID - CPU Identification 0000 1111: 10100010 
CWD - Convert Word to Doubleword 1001 1001 
CWDE - Convert Word to Doubleword 1001 1000 
DAA - Decimal Adjust AL after Addition 00100111 
DAS - Decimal Adjust AL after Subtraction 00101111 
DEC - Decrement by 1 

register 1111 111w:11 001 reg 

register (alternate encoding) 0100 1 reg 

memory 1111 111w: mod 001 r/m 
DIV - Unsigned Divide 

AL, AX, or EAX by register 1111 011w:11110reg 

AL, AX, or EAX by memory 1111 011w: mod 110 r/m 
HLT - Halt 11110100 
IDIV - Signed Divide 

AL, AX, or EAX by register 1111 011w: 11111 reg 

AL, AX, or EAX by memory 1111 011w: mod 111 r/m 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


IMUL - Signed Multiply 


AL, AX, or EAX with register 


1111 011w: 11 101 reg 


AL, AX, or EAX with memory 


1111 011w: mod 101 reg 


register1 with register2 


0000 1111: 1010 1111:11:reg1 reg2 


register with memory 


0000 1111: 1010 1111: modregr/m 


register1 with immediate to register2 


0110 10s1: 11 reg] reg2 : immediate data 


memory with immediate to register 


0110 10s1 : mod reg r/m: immediate data 


IN - Input From Port 


fixed port 


1110 010w: port number 


variable port 


1110 110w 


INC - Increment by 1 


reg 1111 111w: 11 000 reg 
reg (alternate encoding) 0100 Oreg 
memory 1111 111w: mod 000 r/m 
INS - Input from DX Port 0110 110Ww 
INT n - Interrupt Type n 1100 1101: type 
INT - Single-Step Interrupt 3 1100 1100 
INTO - Interrupt 4 on Overflow 1100 1110 


INVD - Invalidate Cache 


0000 1111 : 0000 1000 


INVLPG - Invalidate TLB Entry 


0000 1111 : 0000 0001 : mod 111 r/m 


INVPCID - Invalidate Process-Context Identifier 


0110 0110:0000 1111:0011 1000:1000 0010: mod reg r/m 


IRET/IRETD - Interrupt Return 


1100 1111 


Jcc - Jump if Condition is Met 


8-bit displacement 


0111 tttn: 8-bit displacement 


full displacement 


0000 1111 : 1000 tttn: full displacement 


JCXZ/JECXZ - Jump on CX/ECX Zero 
Address-size prefix differentiates JCXZ 


and JECXZ 


1110 0011 : 8-bit displacement 


JMP - Unconditional Jump (to same segment) 


short 


1110 1011 : 8-bit displacement 


direct 


1110 1001 : full displacement 


register indirect 


1111 1111:11 100 reg 


memory indirect 


11111111 :mod 100 r/m 


JMP - Unconditional Jump (to other segment) 


direct intersegment 


1110 1010: unsigned full offset, selector 


indirect intersegment 


11111111 :mod 101 r/m 


LAHF - Load Flags into AHRegister 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


LAR - Load Access Rights Byte 


from register 0000 1111 : 0000 0010: 11 reg] reg2 
from memory 0000 1111 : 0000 0010: mod reg r/m 
LDS - Load Pointer to DS 1100 0101 : mod“ reg r/m 
LEA - Load Effective Address 1000 1101 : mod’ reg r/m 
LEAVE - High Level Procedure Exit 1100 1001 
LES - Load Pointer to ES 1100 0100: mod“® reg r/m 
LFS - Load Pointer to FS 0000 1111: 1011 0100: mod’ reg r/m 
LGDT - Load Global Descriptor Table Register 0000 1111 : 0000 0001 : mod’ 010 r/m 
LGS - Load Pointer to GS 0000 1111: 1011 0101 : mod’ reg r/m 
LIDT - Load Interrupt Descriptor Table Register 0000 1111 : 0000 0001 : mod’ 011 r/m 
LLDT - Load Local Descriptor Table Register 
LDTR from register 0000 1111: 0000 0000: 11010 reg 
LDTR from memory 0000 1111 : 0000 0000 : mod 010 r/m 
LMSW - Load Machine Status Word 
from register 0000 1111: 0000 0001:11 110 reg 
from memory 0000 1111 : 0000 0001 : mod 110 r/m 
LOCK - Assert LOCK# Signal Prefix 1111 0000 
LODS/LODSB/LODSW/LODSD - Load String Operand 1010 110w 
LOOP - Loop Count 1110 0010: 8-bit displacement 
LOOPZ/LOOPE - Loop Count while Zero/Equal 1110 0001 : 8-bit displacement 
LOOPNZ/LOOPNE - Loop Count while not Zero/Equal 1110 0000 : 8-bit displacement 
LSL - Load Segment Limit 
from register 0000 1111 : 0000 0011: 11 reg] reg2 
from memory 0000 1111 : 0000 0011 : mod reg r/m 
LSS - Load Pointer to SS 0000 1111: 1011 0010: mod’ reg r/m 
LTR - Load Task Register 
from register 0000 1111 : 0000 0000: 11 011 reg 
from memory 0000 1111 : 0000 0000: mod 011 r/m 
MOV - Move Data 
register1 to register2 1000 100w: 11 reg1 reg2 
register2 to register1 1000 101w: 11 reg! reg2 
memory to reg 1000 101w: mod reg r/m 
reg to memory 1000 100w: mod reg r/m 
immediate to register 1100 011w: 11 000 reg: immediate data 
immediate to register (alternate encoding) 1011 wreg: immediate data 
immediate to memory 1100 011w: mod 000 r/m: immediate data 
memory to AL, AX, or EAX 1010 000w : full displacement 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


AL, AX, or EAX to memory 


1010 001w: full displacement 


MOV - Move to/from Control Registers 


CRO from register 


0000 1111 : 0010 0010: -- 000 reg 


CR2 from register 


0000 1111 : 0010 0010: -- 010reg 


CR3 from register 


0000 1111: 0010 0010: -- 011 reg 


CR4 from register 


0000 1111: 0010 0010: -- 100 reg 


register from CRO-CR4 


0000 1111 :0010 0000: -- eee reg 


MOV - Move to/from Debug Registers 


DRO-DR3 from register 


0000 1111:0010 0011 : -- eee reg 


DR4-DR5 from register 


0000 1111 :0010 0011 : -- eee reg 


DR6-DR7 from register 


0000 1111 :0010 0011 : -- eee reg 


register from DR6-DR7 


0000 1111 :0010 0001 : -- eee reg 


register from DR4-DR5 


0000 1111 :0010 0001 : -- eee reg 


register from DRO-DR3 


0000 1111 :0010 0001 : -- eee reg 


MOV - Move to/from Segment Registers 


register to segment register 


1000 1110: 11 sreg3 reg 


register to SS 


1000 1110: 11 sreg3 reg 


memory to segment reg 


1000 1110: mod sreg3 r/m 


memory to SS 


1000 1110: mod sreg3 r/m 


segment register to register 


1000 1100: 11 sreg3 reg 


segment register to memory 


1000 1100: mod sreg3 r/m 


MOVBE - Move data after swapping bytes 


memory to register 


0000 1111: 0011 1000:1111 0000: mod reg r/m 


register to memory 


0000 1111: 0011 1000:1111 0001 : mod reg r/m 


MOVS/MOVSB/MOVSW/MOVSD - Move Data from String to 
String 


MOVSX - Move with Sign-Extend 


1010 010w 


memory to reg 


0000 1111: 1011 111w: mod reg r/m 


MOVZX - Move with Zero-Extend 


register2 to register1 


0000 1111: 1011 011w: 11 reg] reg2 


memory to register 


0000 1111: 1011 011w: mod reg r/m 


MUL - Unsigned Multiply 


AL, AX, or EAX with register 


1111 011w:11 100 reg 


AL, AX, or EAX with memory 


1111 011w: mod 100 r/m 


NEG - Two’s Complement Negation 


register 


1111 011w:11011 reg 


memory 


1111 011w: mod 011 r/m 


NOP - No Operation 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


NOP - Multi-byte No Operation! 


register 


0000 1111 0001 1111: 11 O00 reg 


memory 


0000 1111 0001 1111: mod 000 r/m 


NOT - One’s Complement Negation 


register 


1111 011w:11010reg 


memory 


1111 011w:mod010r/m 


OR - Logical Inclusive OR 


register1 to register2 


0000 100w: 11 reg] reg2 


register2 to register 1 


0000 101w: 11 reg] reg2 


memory to register 


0000 101w: mod reg r/m 


register to memory 


0000 100w : mod reg r/m 


immediate to register 


1000 OOsw: 11 001 reg: immediate data 


immediate to AL, AX, or EAX 


0000 110w: immediate data 


immediate to memory 


1000 OOsw: mod 001 r/m: immediate data 


OUT - Output to Port 


fixed port 1110 011w: port number 
variable port 1110111w 
OUTS - Output to DX Port 0110 111w 


POP - Pop a Word from the Stack 


register 


1000 1111: 11 000 reg 


register (alternate encoding) 


0101 1 reg 


memory 


1000 1111: mod 000 r/m 


POP - Pop a Segment Register from the Stack (Note: CS cannot be sreg2 in this usage.) 


segment register DS, ES 


000 sreg2 111 


segment register SS 


000 sreg2 111 


segment register FS, GS 
POPA/POPAD - Pop All General Registers 


0000 1111: 10 sreg3 001 
01100001 


POPF/POPFD - Pop Stack into FLAGS or EFLAGS Register 


1001 1101 


PUSH - Push Operand onto the Stack 


register 


1111 1111:11110reg 


register (alternate encoding) 


0101 Oreg 


memory 


1111 1111:mod 110 r/m 


immediate 


0110 10sO0 : immediate data 


PUSH - Push Segment Register onto the Stack 


segment register CS,DS,ES,SS 


000 sreg2 110 


segment register FS,GS 


0000 1111: 10 sreg3 000 


PUSHA/PUSHAD - Push All General Registers 


0110 0000 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format Encoding 

PUSHF/PUSHFD - Push Flags Register onto the Stack 1001 1100 
RCL - Rotate thru Carry Left 

register by 1 1101 000w: 11 010 reg 

memory by 1 1101 O000w : mod 010 r/m 

register by CL 1101 001w: 11010 reg 

memory by CL 1101 001w: mod 010 r/m 

register by immediate count 1100 000w: 11 010 reg: imm8 data 

memory by immediate count 1100 O00w : mod 010 r/m: imm8 data 


RCR - Rotate thru Carry Right 


register by 1 1101 000w: 11 011 reg 
memory by 1 1101 O00w : mod 011 r/m 
register by CL 1101 001w: 11011 reg 
memory by CL 1101 001w: mod 011 r/m 
register by immediate count 1100 O000w: 11 011 reg: imm8 data 
memory by immediate count 1100 O00w : mod 011 r/m: imm8 data 
RDMSR - Read from Model-Specific Register 0000 1111: 0011 0010 
RDPMC - Read Performance Monitoring Counters 0000 1111 :0011 0011 
RDTSC - Read Time-Stamp Counter 0000 1111 :0011 0001 
RDTSCP - Read Time-Stamp Counter and Processor ID 0000 1111 : 0000 0001: 1111 1001 
REP INS - Input String 1111 0011 :0110 110w 
REP LODS - Load String 1111 0011: 1010 110w 
REP MOVS - Move String 1111 0011: 1010 010w 
REP OUTS - Output String 1111 0011:0110111w 
REP STOS - Store String 1111 0011: 1010 101w 
REPE CMPS - Compare String 11110011: 1010 011w 
REPE SCAS - Scan String 1111 0011:1010 111w 
REPNE CMPS - Compare String 11110010: 1010 011w 
REPNE SCAS - Scan String 1111 0010: 1010 111w 
RET - Return from Procedure (to same segment) 
no argument 1100 0011 
adding immediate to SP 1100 0010: 16-bit displacement 
RET - Return from Procedure (to other segment) 
intersegment 1100 1011 
adding immediate to SP 1100 1010: 16-bit displacement 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format Encoding 
ROL - Rotate Left 
register by 1 1101 000w: 11 000 reg 
memory by 1 1101 O00w : mod 000 r/m 
register by CL 1101 001w: 11 000 reg 
memory by CL 1101 001w: mod 000 r/m 
register by immediate count 1100 000w : 11 000 reg: imm8 data 


memory by immediate count 


1100 000w : 


mod 000 r/m: imm8 data 


ROR - Rotate Right 


register by 1 1101 000w: 11 001 reg 

memory by 1 1101 O00w : mod 001 r/m 

register by CL 1101 001w: 11 001 reg 

memory by CL 1101 001w: mod 001 r/m 

register by immediate count 1100 000w : 11 001 reg: imm8 data 


memory by immediate count 1100 O00w : mod 001 r/m: imm8 data 
RSM - Resume from System Management Mode 0000 1111: 1010 1010 
SAHF - Store AH into Flags 1001 1110 


SAL - Shift Arithmetic Left 


same instruction as SHL 


SAR - Shift Arithmetic Right 


register by 1 1101 000w: 11 111 reg 

memory by 1 1101 O000w : mod 111 r/m 

register by CL 1101 001w:11 111 reg 

memory by CL 1101 001w: mod 111 r/m 

register by immediate count 1100 O00w: 11 111 reg: imm8 data 


memory by immediate count 


1100 000w : 


mod 111 r/m:immé8 data 


SBB - Integer Subtraction with Borrow 


register1 to register2 


0001 100w : 


11 reg] reg2 


register2 to register 0001 101w: 11 reg] reg2 

memory to register 0001 101w: mod reg r/m 

register to memory 0001 100w : mod reg r/m 

immediate to register 1000 OOsw: 11 011 reg: immediate data 


immediate to AL, AX, or EAX 


0001 110w: 


immediate data 


immediate to memory 1000 OOsw : mod 011 r/m: immediate data 
SCAS/SCASB/SCASW/SCASD - Scan String 1010 111w 
SETcc - Byte Set on Condition 

register 0000 1111: 1001 tttn: 11 000 reg 

memory 0000 1111: 1001 tttn : mod 000 r/m 
SGDT - Store Global Descriptor Table Register 0000 1111 : 0000 0001 : mod“ 000 r/m 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format Encoding 
SHL - Shift Left 
register by 1 1101 000w: 11 100 reg 
memory by 1 1101 O00w: mod 100 r/m 
register by CL 1101 001w:11 100 reg 
memory by CL 1101 001w: mod 100 r/m 
register by immediate count 1100 000w: 11 100 reg: imm8 data 
memory by immediate count 1100 O00w : mod 100 r/m: imm8 data 
SHLD - Double Precision Shift Left 
register by immediate count 0000 1111: 10100100: 11 reg2 reg] : imm8 
memory by immediate count 0000 1111: 10100100: mod reg r/m: imm8 
register by CL 0000 1111: 10100101: 11 reg2 reg] 
memory by CL 0000 1111: 10100101 : mod reg r/m 
SHR - Shift Right 
register by 1 1101 000w: 11 101 reg 
memory by 1 1101 O00w: mod 101 r/m 
register by CL 1101 001w: 11 101 reg 
memory by CL 1101 001w: mod 101 r/m 
register by immediate count 1100 000w: 11 101 reg: imm8 data 
memory by immediate count 1100 O00w : mod 101 r/m: imm8 data 
SHRD - Double Precision Shift Right 
register by immediate count 0000 1111: 1010 1100: 11 reg2 reg] : imm8 
memory by immediate count 0000 1111: 1010 1100: mod reg r/m: imm8 
register by CL 0000 1111: 1010 1101:11 reg2 reg] 
memory by CL 0000 1111: 1010 1101 : mod reg r/m 
SIDT - Store Interrupt Descriptor Table Register 0000 1111 : 0000 0001 : mod’ 001 r/m 
SLDT - Store Local Descriptor Table Register 
to register 0000 1111 : 0000 0000: 11 000 reg 
to memory 0000 1111 : 0000 0000 : mod 000 r/m 
SMSW - Store Machine Status Word 
to register 0000 1111: 0000 0001 : 11 100 reg 
to memory 0000 1111 : 0000 0001 : mod 100 r/m 
STC - Set Carry Flag 1111 1001 
STD - Set Direction Flag 11111101 
STI - Set Interrupt Flag 11111011 
STOS/STOSB/STOSW/STOSD - Store String Data 1010 101w 
STR - Store Task Register 
to register 0000 1111 : 0000 0000: 11 001 reg 
to memory 0000 1111 : 0000 0000 : mod 001 r/m 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


SUB - Integer Subtraction 


register1 to register2 


0010 100w: 11 reg] reg2 


register2 to register 


0010 101w: 11 reg] reg2 


memory to register 


0010 101w: mod reg r/m 


register to memory 


0010 100w: mod reg r/m 


immediate to register 


1000 OOsw: 11 101 reg: immediate data 


immediate to AL, AX, or EAX 


0010 110w: immediate data 


immediate to memory 


1000 OOsw: mod 101 r/m: immediate data 


TEST - Logical Compare 


register] and register2 


1000 010w: 11 reg1 reg2 


memory and register 


1000 010w: mod reg r/m 


immediate and register 


1111 011w: 11 000 reg: immediate data 


immediate and AL, AX, or EAX 


1010 100w: immediate data 


immediate and memory 


1111 011w: mod 000 r/m: immediate data 


UDO - Undefined instruction 


0000 1111:1111 1111 


UD1 - Undefined instruction 


0000 1111 : 0000 1011 


UD2 - Undefined instruction 


0000 FFFF : 0000 1011 


VERR - Verify a Segment for Reading 


register 0000 1111: 0000 0000:11 100 reg 

memory 0000 1111 : 0000 0000: mod 100 r/m 
VERW - Verify a Segment for Writing 

register 0000 1111: 0000 0000: 11 101 reg 

memory 0000 1111 : 0000 0000: mod 101 r/m 
WAIT - Wait 1001 1011 


WBINVD - Writeback and Invalidate Data Cache 


0000 1111 : 0000 1001 


WRMSR - Write to Model-Specific Register 
XADD - Exchange and Add 


0000 1111 : 0011 0000 


register1, register2 


0000 1111: 1100 000w: 11 reg2 reg] 


memory, reg 


0000 1111: 1100 O00w: mod reg r/m 


XCHG - Exchange Register/Memory with Register 


register] with register2 


1000 011w: 11 reg1 reg2 


AX or EAX with reg 1001 Oreg 
memory with reg 1000 011w: mod reg r/m 
XLAT/XLATB - Table Look-up Translation 11010111 


XOR - Logical Exclusive OR 


register1 to register2 


0011 O0Ow : 11 reg] reg2 


register2 to register1 


0011 001w: 11 reg] reg2 


memory to register 


0011 001w: mod reg r/m 
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Table B-13. General Purpose Instruction Formats and Encodings for Non-64-Bit Modes (Contd.) 


Instruction and Format 


Encoding 


register to memory 


0011 O0Ow : mod reg r/m 


immediate to register 


1000 OOsw: 11 110 reg: immediate data 


immediate to AL, AX, or EAX 


0011 010w: immediate data 


immediate to memory 


1000 OOsw: mod 110 r/m: immediate data 


Prefix Bytes 
address size 01100111 
LOCK 1111 0000 
operand size 01100110 
CS segment override 0010 1110 
DS segment override 00111110 
ES segment override 0010 0110 
FS segment override 01100100 
GS segment override 01100101 
SS segment override 00110110 


NOTES: 


1. The multi-byte NOP instruction does not alter the content of the register and will not issue a memory operation. 


B.2.1 General Purpose Instruction Formats and Encodings for 64-Bit Mode 


Table B-15 shows machine instruction formats and encodings for general purpose instructions in 64-bit mode. 
Table B-14. Special Symbols 


Symbol Application 
S If the value of REX.W. is 1, it overrides the presence of 66H. 
w The value of bit W. in REX is has no effect. 


Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode 


Instruction and Format 


Encoding 


ADC - ADD with Carry 


register1 to register2 


qwordregister1 to qwordregister2 


0100 OROB: 0001 O00w: 11 reg] reg2 
0100 1ROB: 0001 0001: 11 qwordreg] qwordreg2 


register2 to register1 


0100 OROB: 0001 001w: 11 reg] reg2 


qwordregister1 to qwordregister2 


memory to register 


0100 1ROB: 0001 0011: 11 qwordreg] qwordreg2 
0100 ORXB: 0001 001w: mod reg r/m 


memory to qwordregister 


0100 1RXB: 0001 0011 : mod qwordreg r/m 


register to memory 


qwordregister to memory 


0100 ORXB : 0001 O00Ow : mod reg r/m 
0100 1RXB: 0001 0001 : mod qwordreg r/m 


immediate to register 


0100 000B: 1000 OOsw: 11 010 reg: immediate 


immediate to qwordregister 


immediate to qwordregister 


0100 100B: 1000 0001 : 11 010 qwordreg : imm32 
0100 1ROB: 1000 0011: 11 010 qwordreg: imm8 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


immediate to AL, AX, or EAX 


0001 010w: immediate data 


immediate to RAX 


0100 1000 : 0000 0101 : imm32 


immediate to memory 


0100 OOXB: 1000 OOsw : mod 010 r/m: immediate 


immediate32 to memory64 


0100 10XB: 1000 0001 : mod 010 r/m: imm32 


immediate8 to memory64 


0100 10XB : 1000 0031 : mod 010 r/m: imm8 


ADD - Add 


register] to register2 


0100 OROB: 0000 000w: 11 reg] reg2 


qwordregister1 to qwordregister2 


0100 1ROB 0000 0000: 11 qwordreg1 qwordreg2 


register2 to register 


0100 OROB: 0000 001w: 11 reg] reg2 


qwordregister1 to qwordregister2 


0100 1ROB 0000 0010: 11 qwordreg1 qwordreg2 


memory to register 


0100 ORXB : 0000 001w: mod reg r/m 


memory64 to qwordregister 


0100 1RXB : 0000 0000 : mod qwordreg r/m 


register to memory 


0100 ORXB : 0000 O00w : mod reg r/m 


qwordregister to memory64 


0100 1RXB: 0000 0011 : mod qwordreg r/m 


immediate to register 


0100 OOO0B: 1000 OOsw: 11 000 reg: immediate data 


immediate32 to qwordregister 


0100 100B: 1000 0001 : 11 010 qwordreg: imm 


immediate to AL, AX, or EAX 


0000 010w: immediate8 


immediate to RAX 


0100 1000 : 0000 0101 : imm32 


immediate to memory 


0100 OOXB: 1000 OOsw : mod 000 r/m: immediate 


immediate32 to memory64 


0100 10XB: 1000 0001 : mod 010 r/m: imm32 


immediate8 to memory64 


0100 10XB: 1000 0011 : mod 010 r/m: imm8 


AND - Logical AND 


register1 to register2 


0100 OROB 0010 000w: 11 reg1 reg2 


qwordregister1 to qwordregister2 


0100 1ROB 0010 0001 : 11 qwordreg1 qwordreg2 


register2 to register 


0100 OROB 0010 001w: 11 reg1 reg2 


register1 to register2 


memory to register 


0100 1ROB 0010 0011 : 11 qwordreg1 qwordreg2 
0100 ORXB 0010 001w: mod reg r/m 


memory64 to qwordregister 


0100 1RXB: 0010 0011 : mod qwordreg r/m 


register to memory 


0100 ORXB : 0010 O00w : mod reg r/m 


qwordregister to memory64 


0100 1RXB: 0010 0001 : mod qwordreg r/m 


immediate to register 


0100 OOOB: 1000 00sw: 11 100 reg: immediate 


immediate32 to qwordregister 


0100 100B 1000 0001 : 11 100 qwordreg: imm32 


immediate to AL, AX, or EAX 


0010 010w: immediate 


immediate32 to RAX 


0100 1000 0010 1001 : imm32 


immediate to memory 


immediate32 to memory64 


0100 OOXB: 1000 OOsw: mod 100 r/m: immediate 
0100 10XB: 1000 0001 : mod 100 r/m: immediate32 


immediate8 to memory64 


0100 10XB : 1000 0011 : mod 100 r/m: imm8 


BSF - Bit Scan Forward 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


register1, register2 


0100 OROB 0000 1111: 


1011 1100: 


11 reg] reg2 


qwordregister1, qwordregister2 


0100 1ROB 0000 1111: 
qwordreg2 


1011 1100 


:11 qwordreg1 


memory, register 


0100 ORXB 0000 1111: 


10111100: 


mod reg r/m 


memory64, qwordregister 


0100 1RXB 0000 1111: 


10111100: 


mod qwordreg r/m 


BSR - Bit Scan Reverse 


register1, register2 0100 OROB 0000 1111: 1011 1101: 11 reg] reg2 

qwordregister1, qwordregister2 0100 1ROB 0000 1111: 1011 1101: 11 qwordreg1 
qwordreg2 

memory, register 0100 ORXB 0000 1111: 1011 1101: mod reg r/m 

memory64, qwordregister 0100 1RXB 0000 1111: 1011 1101 : mod qwordreg r/m 


BSWAP - Byte Swap 


0000 1111: 1100 1 reg 


BSWAP - Byte Swap 


0100 100B 0000 1111: 


1100 1 qwordreg 


BT - Bit Test 


register, immediate 


0100 OOOB 0000 1111: 


1011 1010: 


11 100 reg: imm8 


qwordregister, immediate8 


0100 100B 1111: 1011 


1010: 11 100 qwordreg: imm8 data 


memory, immediate 


0100 OOXB 0000 1111: 


1011 1010: 


mod 100 r/m: imm8 


memory64, immediate8 


0100 10XB 0000 1111: 


1011 1010: 


mod 100 r/m: imm8 data 


register1, register2 0100 OROB 0000 1111: 1010 0011: 11 reg2 reg 
qwordregister1, qwordregister2 0100 1ROB 0000 1111 : 1010 0011: 11 qwordreg2 
qwordreg1 
memory, reg 0100 ORXB 0000 1111: 1010 0011 : mod reg r/m 
memory, qwordreg 0100 1RXB 0000 1111: 1010 0011 : mod qwordreg r/m 
BTC - Bit Test and Complement 
register, immediate 0100 OOOB 0000 1111: 1011 1010:11 111 reg: imm8 
qwordregister, immediate8 0100 100B 0000 1111: 1011 1010: 11 111 qwordreg: imm8 
memory, immediate 0100 OOXB 0000 1111: 1011 1010: mod 111 r/m: imm8 
memory64, immediate8 0100 10XB 0000 1111: 1011 1010: mod 111 r/m: imm8 
register1, register2 0100 OROB 0000 1111: 1011 1011: 11 reg2 reg] 
qwordregister1, qwordregister2 0100 1ROB 0000 1111: 1011 1011: 11 qwordreg2 
qwordreg1 
memory, register 0100 ORXB 0000 1111: 1011 1011: mod reg r/m 
memory, qwordreg 0100 1RXB 0000 1111: 1011 1011 : mod qwordreg r/m 
BTR - Bit Test and Reset 
register, immediate 0100 000B 0000 1111: 1011 1010:11 110 reg: imm8 
qwordregister, immediate8 0100 100B 0000 1111: 1011 1010: 11 110 qwordreg: imm8 
memory, immediate 0100 OOXB 0000 1111: 1011 1010: mod 110 r/m: imm8 
memory64, immediate8 0100 10XB 0000 1111: 1011 1010: mod 110 r/m: imm8 
register1, register2 0100 OROB 0000 1111: 1011 0011: 11 reg2 reg] 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


qwordregister1, qwordregister2 


0100 1ROB 0000 1111: 1011 0011: 11 qwordreg2 
qwordreg1 


memory, register 


0100 ORXB 0000 1111: 1011 0011 : mod reg r/m 


memory64, qwordreg 


0100 1RXB 0000 1111: 1011 0011 : mod qwordreg r/m 


BTS - Bit Test and Set 


register, immediate 


0100 OOOB 0000 1111: 1011 1010: 11 101 reg: imm8s 


qwordregister, immediate8 


0100 100B 0000 1111: 1011 1010: 11 101 qwordreg: imm8 


memory, immediate 


0100 OOXB 0000 1111: 1011 1010: mod 101 r/m: imm8 


memory64, immediate8 


0100 10XB 0000 1111: 1011 1010: mod 101 r/m: imm8 


register1, register2 


0100 OROB 0000 1111: 1010 1011: 11 reg2 reg! 


qwordregister1, qwordregister2 


0100 1ROB 0000 1111: 1010 1011: 11 qwordreg2 
qwordreg1 


memory, register 


0100 ORXB 0000 1111: 1010 1011 : mod reg r/m 


memory64, qwordreg 


0100 1RXB 0000 1111: 1010 1011 : mod qwordreg r/m 


CALL - Call Procedure (in same segment) 


direct 


1110 1000: displacement32 


register indirect 


0100 WROO” 1111 1111:11 010 reg 


memory indirect 


0100 WOXBY 1111 1111: mod 010 r/m 


CALL - Call Procedure (in other segment) 


indirect 1111 .1111:mod 011 r/m 
indirect 0100 10XB 0100 1000 1111 1111: mod 011 r/m 
CBW - Convert Byte to Word 1001 1000 
CDQ - Convert Doubleword to Qword+ 1001 1001 
CDQE - RAX, Sign-Extend of EAX 0100 1000 1001 1001 
CLC - Clear Carry Flag 1111 1000 
CLD - Clear Direction Flag 1111 1100 
CLI - Clear Interrupt Flag 1111 1010 
CLTS - Clear Task-Switched Flag in CRO 0000 1111 : 0000 0110 
CMC - Complement Carry Flag 11110101 


CMP - Compare Two Operands 


register] with register2 


0100 OROB 0011 100w: 11 reg1 reg2 


qwordregister1 with qwordregister2 


0100 1ROB 0011 1001: 11 qwordreg1 qwordreg2 


register2 with register] 


0100 OROB 0011 101w: 11 reg! reg2 


qwordregister2 with qwordregister1 


0100 1ROB 0011 101w: 11 qwordreg1 qwordreg2 


memory with register 


0100 ORXB 0011 100w: mod reg r/m 


memory64 with qwordregister 


register with memory 


0100 1RXB 0011 1001 : mod qwordreg r/m 
0100 ORXB 0011 101w: mod reg r/m 


qwordregister with memory64 


0100 1RXB 0011 101w1 : mod qwordreg r/m 


immediate with register 


0100 OOOB 1000 OOsw: 11 111 reg: imm 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


immediate32 with qwordregister 


0100 100B 1000 0001 : 11 111 qwordreg : imm64 


immediate with AL, AX, or EAX 


0011 110w: imm 


immediate32 with RAX 


0100 1000 0011 1101 : imm32 


immediate with memory 


0100 OOXB 1000 OOsw: mod 111 r/m: imm 


immediate32 with memory64 


0100 1RXB 1000 0001 : mod 111 r/m: imm64 


immediate8 with memory64 


0100 1RXB 1000 0011 : mod 111 r/m: imm8 


CMPS/CMPSB/CMPSW/CMPSD/CMPSQ - Compare String Operands 


compare string operands [ X at DS:(€)SI with Y at €S:(€)DI J 


1010 011w 


qword at address RSI with qword at address RDI 


0100 1000 1010 0111 


CMPXCHG - Compare and Exchange 


register1, register2 


0000 1111: 1011 O00w: 11 reg2 reg] 


byteregister1, byteregister2 0100 OOOB 0000 1111: 1011 0000: 11 bytereg2 reg1 


qwordregister1, qwordregister2 0100 100B 0000 1111: 1011 0001 : 11 qwordreg2 reg] 


memory, register 0000 1111: 1011 O00w: mod reg r/m 


memory8, byteregister 0100 OOXB 0000 1111: 1011 0000: mod bytereg r/m 


memory64, qwordregister 0100 10XB 0000 1111 : 1011 0001 : mod qwordreg r/m 


CPUID - CPU Identification 


0000 1111: 10100010 


CQO - Sign-Extend RAX 


0100 1000 1001 1001 


CWD - Convert Word to Doubleword 


1001 1001 


CWDE - Convert Word to Doubleword 


1001 1000 


DEC - Decrement by 1 


register 


0100 0OOB 1111 111w: 11 001 reg 


qwordregister 


0100 100B 1111 1111:11 001 qwordreg 


memory 


0100 OOXB 1111 111w: mod 001 r/m 


memory64 


0100 10XB 1111 1111: mod 001 r/m 


DIV - Unsigned Divide 
AL, AX, or EAX by register 


0100 OOOB 1111 011w: 11110 reg 


Divide RDX:RAX by qwordregister 


0100 100B 1111 0111: 11 110 qwordreg 


AL, AX, or EAX by memory 


0100 OOXB 1111 011w: mod 110 r/m 


Divide RDX:RAX by memory64 


0100 10XB 1111 0111: mod 110 r/m 


ENTER - Make Stack Frame for High Level Procedure 


1100 1000: 16-bit displacement : 8-bit level (L) 


HLT - Halt 


11110100 


IDIV - Signed Divide 


AL, AX, or EAX by register 


0100 0OOB 1111 011w: 11111 reg 


RDX:RAX by qwordregister 0100 100B 1111 0111:11 111 qwordreg 
AL, AX, or EAX by memory 0100 OOXB 1111 011w: mod 111 r/m 
RDX:RAX by memory64 0100 10XB 1111 0111 :mod 111 r/m 


IMUL - Signed Multiply 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


AL, AX, or EAX with register 


0100 000B 1111 011w:11 101 reg 


RDX:RAX := RAX with qwordregister 


0100 100B 1111 0111: 11 101 qwordreg 


AL, AX, or EAX with memory 


0100 OOXB 1111 011w: mod 101 r/m 


RDX:RAX := RAX with memory64 


0100 10XB 1111 0111: mod 101 r/m 


register] with register2 


0000 1111:10101111:11:reg1 reg2 


qwordregister1 := qwordregister1 with qwordregister2 


0100 1ROB 0000 1111: 1010 1111: 11 : qwordreg1 
qwordreg2 


register with memory 


0100 ORXB 0000 1111: 10101111 : mod reg r/m 


qwordregister := qwordregister with memory64 


0100 1RXB 0000 1111: 1010 1111 : mod qwordreg r/m 


register1 with immediate to register2 


0100 OROB 0110 10s1: 11 reg] reg2 : imm 


qwordregister1 := qwordregister2 with sign-extended 
immediate8 


0100 1ROB 0110 1011 : 11 qwordreg1 qwordreg2 : imm8 


qwordregister1 := qwordregister2 with immediate32 


0100 1ROB 0110 1001 : 11 qwordreg1 qwordreg2 : imm32 


memory with immediate to register 


0100 ORXB 0110 10s1 : mod reg r/m: imm 


qwordregister := memory64 with sign-extended immediate8 


0100 1RXB 0110 1011 : mod qwordreg r/m: imm8 


qwordregister := memory64 with immediate32 


0100 1RXB 0110 1001 : mod qwordreg r/m : imm32 


IN - Input From Port 


fixed port 


1110 010w: port number 


variable port 


1110 110w 


INC - Increment by 1 


reg 0100 000B 1111 111w: 11 000 reg 
qwordreg 0100 100B 1111 1111: 11 000 qwordreg 
memory 0100 OOXB 1111 111w: mod 000 r/m 
memory64 0100 10XB 1111 1111: mod 000 r/m 

INS - Input from DX Port 0110 110w 

INT n - Interrupt Type n 1100 1101: type 

INT - Single-Step Interrupt 3 1100 1100 

INTO - Interrupt 4 on Overflow 1100 1110 


INVD - Invalidate Cache 


0000 1111 : 0000 1000 


INVLPG - Invalidate TLB Entry 


0000 1111 : 0000 0001 : mod 111 r/m 


INVPCID - Invalidate Process-Context Identifier 


0110 0110:0000 1111:0011 1000:1000 0010: mod reg r/m 


IRETO - Interrupt Return 


1100 1111 


Jcc - Jump if Condition is Met 


8-bit displacement 


0111 tttn : 8-bit displacement 


displacements (excluding 16-bit relative offsets) 


0000 1111: 1000 tttn : displacement32 


JCXZ/JECXZ - Jump on CX/ECX Zero 
Address-size prefix differentiates JCXZ and JECXZ 


1110 0011 : 8-bit displacement 


JMP - Unconditional Jump (to same segment) 


short 


1110 1011 : 8-bit displacement 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


direct 


1110 1001 : displacement32 


register indirect 


0100 WOOB” : 1111 1111: 11 100 reg 


memory indirect 


0100 WOXB™ : 1111 1111: mod 100 r/m 


JMP - Unconditional Jump (to other segment) 


indirect intersegment 


0100 OOXB: 1111 1111: mod 101 r/m 


64-bit indirect intersegment 


0100 10XB: 1111 1111: mod 101 r/m 


LAR - Load Access Rights Byte 


from register 


0100 OROB : 0000 1111 : 0000 0010: 11 regi reg2 


from dwordregister to qwordregister, masked by OOFxFFOOH 


from memory 


0100 WROB: 0000 1111 : 0000 0010: 11 qwordreg1 
dwordreg2 


0100 ORXB : 0000 1111 : 0000 0010: mod reg r/m 


from memory32 to qwordregister, masked by OOFxFFOOH 


0100 WRXB 0000 1111 : 0000 0010: mod r/m 


LEA - Load Effective Address 


in wordregister/dwordregister 


0100 ORXB: 1000 1101 : mod“ reg r/m 


in qwordregister 


0100 1RXB: 1000 1101 : mod4 qwordreg r/m 


LEAVE - High Level Procedure Exit 
LFS - Load Pointer to FS 


1100 1001 


FS:r16/r32 with far pointer from memory 


0100 ORXB : 0000 1111: 1011 0100: mod’ reg r/m 


FS:r64 with far pointer from memory 
LGDT - Load Global Descriptor Table Register 


0100 1RXB: 0000 1111: 1011 0100: mod’ qwordreg r/m 
0100 10XB : 0000 1111 : 0000 0001 : mod’ 010 r/m 


LGS - Load Pointer to GS 


GS:r16/r32 with far pointer from memory 


GS:r64 with far pointer from memory 


0100 ORXB : 0000 1111: 1011 0101 : mod’ reg r/m 
0100 1RXB: 0000 1111: 1011 0101 : mod’ qwordreg r/m 


LIDT - Load Interrupt Descriptor Table Register 


0100 10XB : 0000 1111 : 0000 0001 : mod’ 011 r/m 


LLDT - Load Local Descriptor Table Register 


LDTR from register 


0100 O00B : 0000 1111 : 0000 0000: 11 010 reg 


LDTR from memory 


0100 OOXB :0000 1111 : 0000 0000 : mod 010 r/m 


LMSW - Load Machine Status Word 


from register 


0100 000B : 0000 1111 : 0000 0001 : 11 110 reg 


from memory 


0100 OOXB :0000 1111 : 0000 0001 : mod 110 r/m 


LOCK - Assert LOCK# Signal Prefix 
LODS/LODSB/LODSW/LODSD/LODSQ - Load String Operand 


1111 0000 


at DS:(€)SI to AL/EAX/EAX 


1010 110w 


at (R)SI to RAX 


0100 1000 1010 1101 


LOOP - Loop Count 


if count # O, 8-bit displacement 


1110 0010 


if count # O, RIP + 8-bit displacement sign-extended to 64-bits 


0100 1000 1110 0010 


LOOPE - Loop Count while Zero/Equal 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


if count # O & ZF =1, 8-bit displacement 


1110 0001 


if count # 0 & ZF = 1, RIP + 8-bit displacement sign-extended to 
64-bits 


0100 1000 1110 0001 


LOOPNE/LOOPNZ - Loop Count while not Zero/Equal 


if count # O & ZF = O, 8-bit displacement 


1110 0000 


if count # 0 & ZF = 0, RIP + 8-bit displacement sign-extended to 
64-bits 


0100 1000 1110 0000 


LSL - Load Segment Limit 


from register 


0000 1111: 0000 0011: 11 reg] reg2 


from qwordregister 


0100 1ROO 0000 1111 : 0000 0011: 11 qwordreg] reg2 


from memory16 


0000 1111: 0000 0011 : mod reg r/m 


from memory64 


0100 1RXB 0000 1111 : 0000 0011 : mod qwordreg r/m 


LSS - Load Pointer to SS 


SS:r16/r32 with far pointer from memory 


0100 ORXB : 0000 1111: 1011 0010: mod’ reg r/m 


SS:r64 with far pointer from memory 


0100 1WXB: 0000 1111: 1011 0010: mod’ qwordreg r/m 


LTR - Load Task Register 


from register 


0100 OROO : 0000 1111 : 0000 0000: 11 011 reg 


from memory 


0100 OOXB : 0000 1111 : 0000 0000 : mod 011 r/m 


MOV - Move Data 


register1 to register2 


0100 OROB: 1000 100w: 11 reg] reg2 


qwordregister1 to qwordregister2 


0100 1ROB 1000 1001 : 11 qwordeg1 qwordreg2 


register2 to register1 


0100 OROB: 1000 101w: 11 reg] reg2 


qwordregister2 to qwordregister1 


0100 1ROB 1000 1011: 11 qwordreg1 qwordreg2 


memory to reg 


0100 ORXB: 1000 101w: mod reg r/m 


memory64 to qwordregister 


0100 1RXB 1000 1011 : mod qwordreg r/m 


reg to memory 


0100 ORXB: 1000 100w : mod reg r/m 


qwordregister to memory64 


immediate to register 


0100 1RXB 1000 1001 : mod qwordreg r/m 
0100 000B: 1100 011w: 11 000 reg: imm 


immediate32 to qwordregister (zero extend) 


0100 100B 1100 0111: 11 O00 qwordreg: imm32 


immediate to register (alternate encoding) 


0100 000B: 1011 wreg: imm 


immediate64 to qwordregister (alternate encoding) 


0100 100B 1011 1000 reg : imm64 


immediate to memory 


0100 OOXB: 1100 011w: mod 000 r/m: imm 


immediate32 to memory64 (zero extend) 


0100 10XB 1100 0111 : mod 000 r/m: imm32 


memory to AL, AX, or EAX 


0100 0000: 1010 000w : displacement 


memory64 to RAX 0100 1000 1010 0001 : displacement64 
AL, AX, or EAX to memory 0100 0000: 1010 001w: displacement 
RAX to memory64 0100 1000 1010 0011 : displacement64 


MOV - Move to/from Control Registers 


CRO-CR4 from register 


0100 OROB : 0000 1111 : 0010 0010: 11 eee reg (eee = CR#) 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


CRx from qwordregister 


0100 1ROB: 0000 1111 :0010 0010: 11 eee qwordreg (Reee 
= CR#) 


register from CRO-CR4 


0100 OROB : 0000 1111 : 0010 0000: 11 eee reg (eee = CR#) 


qwordregister from CRx 


0100 1ROB 0000 1111 :0010 0000: 11 eee qwordreg 
(Reee = CR#) 


MOV - Move to/from Debug Registers 


DRO-DR7 from register 


0000 1111:0010 0011: 11 eee reg (eee = DR#) 


DRO-DR7 from quadregister 


0100 100B 0000 1111 : 0010 0011: 11 eee reg (eee = DR#) 


register from DRO-DR7 


0000 1111 :0010 0001 : 11 eee reg (eee = DR#) 


quadregister from DRO-DR7 


0100 100B 0000 1111 : 0010 0001 : 11 eee quadreg (eee = 
DR#) 


MOV - Move to/from Segment Registers 


register to segment register 


0100 WOOB” : 1000 1110: 11 sreg reg 


register to SS 


0100 000B: 1000 1110: 11 sreg reg 


memory to segment register 


0100 OOXB: 1000 1110: mod sreg r/m 


memory64 to segment register (lower 16 bits) 


0100 10XB 1000 1110: mod sreg r/m 


memory to SS 


0100 OOXB: 1000 1110: mod sreg r/m 


segment register to register 


0100 000B: 1000 1100: 11 sreg reg 


segment register to qwordregister (zero extended) 


0100 100B 1000 1100: 11 sreg qwordreg 


segment register to memory 


0100 OOXB : 1000 1100: mod sreg r/m 


segment register to memory64 (zero extended) 


0100 10XB 1000 1100: mod sreg3 r/m 


MOVBE - Move data after swapping bytes 


memory to register 


0100 ORXB : 0000 1111 :0011 1000:1111 0000: mod reg r/m 


memory64 to qwordregister 


0100 1RXB: 0000 1111 :0011 1000:1111 0000: mod reg r/m 


register to memory 


0100 ORXB :0000 1111 : 0011 1000:1111 0001 : mod reg r/m 


qwordregister to memory64 
MOVS/MOVSB/MOVSW/MOVSD/MOVSQ - Move Data from String 


0100 1RXB :0000 1111 :0011 1000:1111 0001 : mod reg r/m 


to String 


Move data from string to string 


1010 010w 


Move data from string to string (qword) 


0100 1000 1010 0101 


MOVSX/MOVSXD - Move with Sign-Extend 


register2 to register1 


0100 OROB : 0000 1111: 1011 111w: 11 regi reg2 


byteregister2 to qwordregister1 (sign-extend) 


0100 1ROB 0000 1111: 1011 1110: 11 quadreg1 bytereg2 


wordregister2 to qwordregister1 


0100 1ROB 0000 1111 :1011 1111:11 quadreg1 wordreg2 


dwordregister2 to qwordregister1 


0100 1ROB 0110 0011: 11 quadreg1 dwordreg2 


memory to register 


0100 ORXB: 0000 1111: 1011 111w: mod reg r/m 


memory8 to qwordregister (sign-extend) 


0100 1RXB 0000 1111: 1011 1110: mod qwordreg r/m 


memory16 to qwordregister 


0100 1RXB 0000 1111: 1011 1111 : mod qwordreg r/m 


memory32 to qwordregister 
MOVZX - Move with Zero-Extend 


0100 1RXB 0110 0011 : mod qwordreg r/m 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


register2 to register 


0100 OROB : 0000 1111: 1011 011w: 11 reg1 reg2 


dwordregister2 to qwordregister1 


0100 1ROB 0000 1111: 1011 0111: 11 qwordreg1 
dwordreg2 


memory to register 


0100 ORXB : 0000 1111: 1011 011w: mod reg r/m 


memory32 to qwordregister 


0100 1RXB 0000 1111: 1011 0111 : mod qwordreg r/m 


MUL - Unsigned Multiply 


AL, AX, or EAX with register 


0100 000B: 1111 011w:11 100 reg 


RAX with qwordregister (to RDX:RAX) 


0100 100B 1111 0111: 11 100 qwordreg 


AL, AX, or EAX with memory 


0100 OOXB 1111 011w: mod 100 r/m 


RAX with memory64 (to RDX:RAX) 


0100 10XB 1111 0111 : mod 100 r/m 


NEG - Two’s Complement Negation 


register 


qwordregister 


0100 0OOB: 1111 011w: 11011 reg 
0100 100B 1111 0111: 11011 qwordreg 


memory 


0100 OOXB: 1111 011w: mod 011 r/m 


memory64 
NOP - No Operation 


0100 10XB 1111 0111: mod 011 r/m 
1001 0000 


NOT - One’s Complement Negation 


register 


qwordregister 


0100 0OOB: 1111 011w: 11010 reg 
0100 OOOB 1111 0111: 11 010 qwordreg 


memory 


0100 OOXB: 1111 011w: mod 010 r/m 


memory64 


OR - Logical Inclusive OR 


0100 1RXB 1111 0111: mod 010 r/m 


register1 to register2 


0000 100w: 11 reg] reg2 


byteregister1 to byteregister2 


qwordregister1 to qwordregister2 


0100 OROB 0000 1000: 11 bytereg1 bytereg2 
0100 1ROB 0000 1001 : 11 qwordreg1 qwordreg2 


register2 to register 


0000 101w: 11 reg] reg2 


byteregister2 to byteregister1 


0100 OROB 0000 1010: 11 bytereg1 bytereg2 


qwordregister2 to qwordregister1 


0100 OROB 0000 1011 : 11 qwordreg1 qwordreg2 


memory to register 


0000 101w: mod reg r/m 


memory8 to byteregister 


memory8 to qwordregister 


0100 ORXB 0000 1010: mod bytereg r/m 
0100 ORXB 0000 1011 : mod qwordreg r/m 


register to memory 


0000 100w: mod reg r/m 


byteregister to memory8 


qwordregister to memory64 


0100 ORXB 0000 1000: mod bytereg r/m 
0100 1RXB 0000 1001 : mod qwordreg r/m 


immediate to register 


1000 OOsw: 11 001 reg: imm 


immediate8 to byteregister 


0100 O00B 1000 0000: 11 001 bytereg : imm8 


immediate32 to qwordregister 


0100 000B 1000 0001 : 11 001 qwordreg: imm32 


immediate8 to qwordregister 


0100 000B 1000 0011: 11 001 qwordreg : imm8 


immediate to AL, AX, or EAX 


0000 110w: imm 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


immediate64 to RAX 


0100 1000 0000 1101 : imm64 


immediate to memory 


1000 OOsw: mod 001 r/m: imm 


immediate8 to memory8 


0100 OOXB 1000 0000 : mod 001 r/m: imm8 


immediate32 to memory64 


0100 OOXB 1000 0001 : mod 001 r/m: imm32 


immediate8 to memory64 


0100 OOXB 1000 0011 : mod 001 r/m: imm8 


OUT - Output to Port 


fixed port 


1110 011w: port number 


variable port 


1110 111w 


OUTS - Output to DX Port 


output to DX Port 


0110111w 


POP - Pop a Value from the Stack 


wordregister 


0101 0101 :0100 OO0B: 1000 1111: 11 000 regi6 


qwordregister 


0100 WOOB®: 1000 1111: 11 000 reg64 


wordregister (alternate encoding) 


0101 0101 : 0100 O00B: 0101 1 regi6 


qwordregister (alternate encoding) 


0100 WOOB : 0101 1 reg64 


memory64 


0100 WOXBS : 1000 1111 : mod 000 r/m 


memory16 


0101 0101 : 0100 OOXB 1000 1111 : mod 000 r/m 


POP - Pop a Segment Register from the Stack 
(Note: CS cannot be sreg2 in this usage.) 


segment register FS, GS 


0000 1111: 10 sreg3 001 


POPF/POPFQ - Pop Stack into FLAGS/RFLAGS Register 


pop stack to FLAGS register 


0101 0101: 1001 1101 


pop Stack to RFLAGS register 


0100 1000 1001 1101 


PUSH - Push Operand onto the Stack 


wordregister 


0101 0101 :0100 OOOB: 1111 1111:11110regi6 


qwordregister 


wordregister (alternate encoding) 


0100 WOOB®: 1111 1111: 11 110 reg64 
0101 0101 : 0100 O00B: 0101 Oregi6 


qwordregister (alternate encoding) 


0100 WOOBS : 0101 0 reg64 


memory16 0101 0101: 0100 OO0B: 1111 1111:mod110r/m 
memory64 0100 WOOBS: 1111 1111:mod 110 r/m 
immediate8 0110 1010: imm8 

immediate16 0101 0101: 0110 1000: imm16 

immediate64 0110 1000 : imm64 


PUSH - Push Segment Register onto the Stack 


segment register FS,GS 


0000 1111: 10 sreg3 000 


PUSHF/PUSHFD - Push Flags Register onto the Stack 


1001 1100 


RCL - Rotate thru Carry Left 


register by 1 


qwordregister by 1 


0100 000B: 1101 000w: 11 010 reg 
0100 100B 1101 0001: 11 010 qwordreg 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


memory by 1 


0100 OOXB: 1101 O00w : mod 010 r/m 


memory64 by 1 


0100 10XB 1101 0001 : mod 010 r/m 


register by CL 0100 000B: 1101 001w: 11 010 reg 
qwordregister by CL 0100 100B 1101 0011: 11 010 qwordreg 
memory by CL 0100 OOXB: 1101 001w: mod 010 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 010 r/m 


register by immediate count 


0100 000B: 1100 000w : 11 010 reg: imm 


qwordregister by immediate count 


0100 100B 1100 0001 : 11 010 qwordreg : imm8 


memory by immediate count 


0100 OOXB: 1100 O00w : mod 010 r/m: imm 


memory64 by immediate count 


0100 10XB 1100 0001 : mod 010 r/m: imm8 


RCR - Rotate thru Carry Right 


register by 1 


0100 000B: 1101 000w: 11 011 reg 


qwordregister by 1 


0100 100B 1101 0001: 11 011 qwordreg 


memory by 1 


0100 OOXB: 1101 O00w: mod 011 r/m 


memory64 by 1 


0100 10XB 1101 0001 : mod 011 r/m 


register by CL 0100 000B: 1101 001w: 11 011 reg 
qwordregister by CL 0100 000B 1101 0010: 11 011 qwordreg 
memory by CL 0100 OOXB: 1101 001w: mod 011 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 011 r/m 


register by immediate count 


0100 000B: 1100 000w: 11 011 reg: imm8 


qwordregister by immediate count 


0100 100B 1100 0001 : 11 011 qwordreg : imm8 


memory by immediate count 


0100 OOXB: 1100 O00w : mod 011 r/m: imm8 


memory64 by immediate count 


0100 10XB 1100 0001 : mod 011 r/m: imm8 


RDMSR - Read from Model-Specific Register 


load ECX-specified register into EDX:EAX 


0000 1111: 0011 0010 


RDPMC - Read Performance Monitoring Counters 


load ECX-specified performance counter into EDX:EAX 


0000 1111: 0011 0011 


RDTSC - Read Time-Stamp Counter 


read time-stamp counter into EDX:EAX 


0000 1111: 0011 0001 


RDTSCP - Read Time-Stamp Counter and Processor ID 


0000 1111 : 0000 0001: 1111 1001 


REP INS - Input String 


REP LODS - Load String 


REP MOVS - Move String 


REP OUTS - Output String 


REP STOS - Store String 
REPE CMPS - Compare String 


REPE SCAS - Scan String 


REPNE CMPS - Compare String 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format Encoding 
REPNE SCAS - Scan String 
RET - Return from Procedure (to same segment) 
no argument 1100 0011 
adding immediate to SP 1100 0010: 16-bit displacement 


RET - Return from Procedure (to other segment) 


intersegment 


1100 1011 


adding immediate to SP 


1100 1010: 16-bit displacement 


ROL - Rotate Left 


register by 1 


0100 O00B 1101 O00w : 


11 000 reg 


byteregister by 1 


0100 OO0B 1101 0000: 


11 000 bytereg 


qwordregister by 1 


0100 100B 1101 0001: 


11 000 qwordreg 


memory by 1 0100 OOXB 1101 O00w : mod 000 r/m 
memory8 by 1 0100 OOXB 1101 0000: mod 000 r/m 
memory64 by 1 0100 10XB 1101 0001 : mod 000 r/m 
register by CL 0100 000B 1101 001w: 11 000 reg 
byteregister by CL 0100 OO0B 1101 0010: 11 000 bytereg 
qwordregister by CL 0100 100B 1101 0011: 11 000 qwordreg 
memory by CL 0100 OOXB 1101 001w: mod 000 r/m 
memory8 by CL 0100 OOXB 1101 0010: mod 000 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 000 r/m 


register by immediate count 


1100 000w: 11 000 reg 


:imm8s 


byteregister by immediate count 


0100 OO0B 1100 0000: 


11 000 bytereg : imm8 


qwordregister by immediate count 


0100 100B 1100 0001 : 


11 000 bytereg : imm8 


memory by immediate count 


1100 O00w : mod 000 r/m: imm8 


memory8 by immediate count 


0100 OOXB 1100 0000 : 


mod 000 r/m : imm8 


memory64 by immediate count 
ROR - Rotate Right 


0100 10XB 1100 0001 : 


mod 000 r/m : imm8 


register by 1 


0100 OO00B 1101 O00w : 


11 001 reg 


byteregister by 1 


0100 OOOB 1101 0000: 


11 001 bytereg 


qwordregister by 1 


0100 100B 1101 0001: 


11 001 qwordreg 


memory by 1 0100 OOXB 1101 O00w : mod 001 r/m 
memory8 by 1 0100 OOXB 1101 0000: mod 001 r/m 
memory64 by 1 0100 10XB 1101 0001 : mod 001 r/m 
register by CL 0100 000B 1101 001w: 11 001 reg 
byteregister by CL 0100 000B 1101 0010: 11 001 bytereg 
qwordregister by CL 0100 100B 1101 0011: 11 001 qwordreg 
memory by CL 0100 OOXB 1101 001w: mod 001 r/m 
memory8 by CL 0100 OOXB 1101 0010: mod 001 r/m 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


memory64 by CL 


0100 10XB 1101 0011 


:mod 001 r/m 


register by immediate count 


0100 OOOB 1100 000w 


:11 001 reg: imm8 


byteregister by immediate count 


0100 OO0B 1100 0000 


:11 001 reg: imm8 


qwordregister by immediate count 


0100 100B 1100 0001 


:11 001 qwordreg : imm8 


memory by immediate count 


0100 OOXB 1100 000w 


: mod 001 r/m: imm8s 


memory8 by immediate count 


0100 OOXB 1100 0000 


:mod 001 r/m: imm8 


memory64 by immediate count 


0100 10XB 1100 0001 


:mod 001 r/m: imm8 


RSM - Resume from System Management Mode 


0000 1111: 1010 1010 


SAL - Shift Arithmetic Left 


same instruction as SHL 


SAR - Shift Arithmetic Right 


register by 1 


0100 O000B 1101 O000w 


:11111 reg 


byteregister by 1 


0100 O000B 1101 0000: 


11111 bytereg 


qwordregister by 1 


0100 100B 1101 0001 


:11111 qwordreg 


memory by 1 0100 OOXB 1101 O00w : mod 111 r/m 
memory8 by 1 0100 OOXB 1101 0000: mod 111 r/m 
memory64 by 1 0100 10XB 1101 0001 : mod 111 r/m 


register by CL 0100 OOOB 1101 001w: 11 111 reg 
byteregister by CL 0100 000B 1101 0010: 11 111 bytereg 
qwordregister by CL 0100 100B 1101 0011: 11 111 qwordreg 
memory by CL 0100 OOXB 1101 001w: mod 111 r/m 
memory8 by CL 0100 OOXB 1101 0010: mod 111 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 111 r/m 


register by immediate count 


0100 OO0B 1100 000w 


:11111 reg: imm8 


byteregister by immediate count 


0100 O000B 1100 0000: 


11111 bytereg : imm8 


qwordregister by immediate count 


0100 100B 1100 0001 


:11 111 qwordreg : imm8 


memory by immediate count 


memory8 by immediate count 


0100 OOXB 1100 000w : 
0100 OOXB 1100 0000 : 


mod 111 r/m:imm8 


mod 111 r/m:imm8 


memory64 by immediate count 


0100 10XB 1100 0001 


:mod 111 r/m:imm8 


SBB - Integer Subtraction with Borrow 


register to register2 


0100 OROB 0001 100w : 


11 reg] reg2 


byteregister1 to byteregister2 


0100 OROB 0001 1000: 


11 bytereg1 bytereg2 


quadregister1 to quadregister2 


0100 1ROB 0001 1001 


: 11 quadreg1 quadreg2 


register2 to register 1 


0100 OROB 0001 101w: 


11 reg] reg2 


byteregister2 to byteregister1 


0100 OROB 0001 1010: 


11 reg] bytereg2 


byteregister2 to byteregister1 


memory to register 


0100 1ROB 0001 1011: 
0100 ORXB 0001 101w: 


11 reg] bytereg2 


mod reg r/m 


memory8 to byteregister 


0100 ORXB 0001 1010: 


mod bytereg r/m 


memory64 to byteregister 


0100 1RXB 0001 1011: 


mod quadreg r/m 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format Encoding 
register to memory 0100 ORXB 0001 100w: mod reg r/m 
byteregister to memory8 0100 ORXB 0001 1000: mod reg r/m 
quadregister to memory64 0100 1RXB 0001 1001 : mod reg r/m 


immediate to register 


0100 O00B 1000 OOsw : 


11011 reg:imm 


immediate8 to byteregister 


0100 OO0B 1000 0000: 


11011 bytereg : imm8 


immediate32 to qwordregister 


0100 100B 1000 0001 : 


11 011 qwordreg : imm32 


immediate8 to qwordregister 


0100 100B 1000 0011: 


11 011 qwordreg : imm8 


immediate to AL, AX, or EAX 


0100 OO0B 0001 110w: 


imm 


immediate32 to RAL 


0100 1000 0001 1101 


:imm32 


immediate to memory 


0100 OOXB 1000 OOsw : 


mod 011 r/m:imm 


immediate8 to memory8 


0100 OOXB 1000 0000 : 


mod 011 r/m:imm8 


immediate32 to memory64 


0100 10XB 1000 0001 


:mod 011 r/m:imm32 


immediate8 to memory64 


0100 10XB 1000 0011 


:mod 011 r/m:imm8s 


SCAS/SCASB/SCASW/SCASD - Scan String 


scan string 


1010 111w 


scan string (compare AL with byte at RDI) 


0100 1000 1010 1110 


scan string (compare RAX with qword at RDI) 


0100 1000 1010 1111 


SETcc - Byte Set on Condition 


register 0100 000B 0000 1111: 1001 tttn: 11 000 reg 
register 0100 0000 0000 1111: 1001 tttn: 11 000 reg 
memory 0100 OOXB 0000 1111 : 1001 tttn : mod 000 r/m 
memory 0100 0000 0000 1111: 1001 tttn: mod 000 r/m 
SGDT - Store Global Descriptor Table Register 0000 1111 : 0000 0001 : mod’ 000 r/m 
SHL - Shift Left 
register by 1 0100 OO0B 1101 O000w: 11 100 reg 


byteregister by 1 
qwordregister by 1 


0100 OO0B 1101 0000: 


0100 100B 1101 0001 


11 100 bytereg 


:11 100 qwordreg 


memory by 1 0100 OOXB 1101 O00w : mod 100 r/m 
memory8 by 1 0100 OOXB 1101 0000: mod 100 r/m 
memory64 by 1 0100 10XB 1101 0001 : mod 100 r/m 
register by CL 0100 000B 1101 001w: 11 100 reg 
byteregister by CL 0100 000B 1101 0010: 11 100 bytereg 
qwordregister by CL 0100 100B 1101 0011: 11 100 qwordreg 
memory by CL 0100 OOXB 1101 001w: mod 100 r/m 
memory8 by CL 0100 OOXB 1101 0010: mod 100 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 100 r/m 


register by immediate count 


0100 O00B 1100 000w : 


11 100 reg: imm8 


byteregister by immediate count 
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0100 OOOB 1100 0000: 


11 100 bytereg : imm8 


INSTRUCTION FORMATS AND ENCODINGS 


Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


quadregister by immediate count 


0100 100B 1100 0001 : 


11 100 quadreg : imm8 


memory by immediate count 


0100 OOXB 1100 000w : 


mod 100 r/m: imm8 


memory8 by immediate count 


0100 OOXB 1100 0000 : 


mod 100 r/m: imm8 


memory64 by immediate count 


0100 10XB 1100 0001 


:mod 100 r/m: imm8 


SHLD - Double Precision Shift Left 


register by immediate count 


0100 OROB 0000 1111 


: 1010 0100: 11 reg2 reg] : imm8 


qwordregister by immediate8 


0100 1ROB 0000 1111 
qwordreg1 : imm8 


: 1010 0100: 11 qworddreg2 


memory by immediate count 


0100 ORXB 0000 1111 


: 1010 0100: mod reg r/m: imm8 


memory64 by immediate8 


0100 1RXB 0000 1111 
imm8 


: 1010 0100: mod qwordreg r/m: 


register by CL 0100 OROB 0000 1111: 10100101: 11 reg2 reg 
quadregister by CL 0100 1ROB 0000 1111: 1010 0101: 11 quadreg2 quadreg1 
memory by CL 0100 OOXB 0000 1111: 1010 0101 : mod reg r/m 
memory64 by CL 0100 1RXB 0000 1111: 10100101 : mod quadreg r/m 


SHR - Shift Right 


register by 1 


0100 O000B 1101 O00w : 


11 101 reg 


byteregister by 1 


0100 O00B 1101 0000: 


11 101 bytereg 


qwordregister by 1 


0100 100B 1101 0001 


:11 101 qwordreg 


memory by 1 0100 OOXB 1101 O00w: mod 101 r/m 
memory8 by 1 0100 OOXB 1101 0000: mod 101 r/m 
memory64 by 1 0100 10XB 1101 0001 : mod 101 r/m 
register by CL 0100 OOOB 1101 001w: 11 101 reg 
byteregister by CL 0100 000B 1101 0010: 11 101 bytereg 
qwordregister by CL 0100 100B 1101 0011:11 101 qwordreg 
memory by CL 0100 OOXB 1101 001w: mod 101 r/m 
memory8 by CL 0100 OOXB 1101 0010: mod 101 r/m 
memory64 by CL 0100 10XB 1101 0011 : mod 101 r/m 


register by immediate count 


0100 OOOB 1100 000w : 


11 101 reg: imm8 


byteregister by immediate count 


0100 OOOB 1100 0000: 


11 101 reg: imm8 


qwordregister by immediate count 


0100 100B 1100 0001 


:11 101 reg: imm8 


memory by immediate count 


0100 OOXB 1100 000w : 


mod 101 r/m:imm8 


memory8 by immediate count 


0100 OOXB 1100 0000 : 


mod 101 r/m:imm8 


memory64 by immediate count 


0100 10XB 1100 0001 : 


mod 101 r/m:imm8 


SHRD - Double Precision Shift Right 


register by immediate count 


qwordregister by immediate8 


0100 OROB 0000 1111: 


0100 1ROB 0000 1111: 
qwordreg1 : imm8 


1010 1100: 11 reg2 reg1 :imm8 
1010 1100: 11 qwordreg2 


memory by immediate count 


0100 OOXB 0000 1111: 


1010 1100: mod reg r/m: imm8 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


memory64 by immediate8 


0100 1RXB 0000 1111: 
imm8 


1010 1100: mod qwordreg r/m: 


register by CL 0100 000B 0000 1111: 1010 1101: 11 reg2 reg] 

qwordregister by CL 0100 1ROB 0000 1111: 1010 1101: 11 qwordreg2 
qwordreg1 

memory by CL 0000 1111: 1010 1101: mod reg r/m 

memory64 by CL 0100 1RXB 0000 1111: 1010 1101 : mod qwordreg r/m 


SIDT - Store Interrupt Descriptor Table Register 


0000 1111 : 0000 0001 


‘mod’ 001 r/m 


SLDT - Store Local Descriptor Table Register 


to register 0100 000B 0000 1111 : 0000 0000: 11 000 reg 

to memory 0100 OOXB 0000 1111 : 0000 0000: mod 000 r/m 
SMSW - Store Machine Status Word 

to register 0100 000B 0000 1111 : 0000 0001 : 11 100 reg 

to memory 0100 OOXB 0000 1111 : 0000 0001 : mod 100 r/m 


STC - Set Carry Flag 


1111 1001 


STD - Set Direction Flag 


11111101 


STI - Set Interrupt Flag 


11111011 


STOS/STOSB/STOSW/STOSD/STOSQ - Store String Data 


store string data 


1010 101w 


store string data (RAX at address RDI) 


0100 1000 1010 1011 


STR - Store Task Register 


to register 


0100 OOOB 0000 1111: 


0000 0000: 11 001 reg 


to memory 


0100 OOXB 0000 1111: 


0000 0000: mod 001 r/m 


SUB - Integer Subtraction 


register1 from register2 


0100 OROB 0010 100w 


: 11 reg1 reg2 


byteregister1 from byteregister2 


0100 OROB 0010 1000: 


11 bytereg1 bytereg2 


qwordregister1 from qwordregister2 


register2 from register 


0100 1ROB 0010 1000 
0100 OROB 0010 101w 


:11 qwordreg1 qwordreg2 
:11 reg] reg2 


byteregister2 from byteregister1 


0100 OROB 0010 1010: 


11 bytereg] bytereg2 


qwordregister2 from qwordregister1 


0100 1ROB 0010 1011 


:11 qwordreg1 qwordreg2 


memory from register 


0100 OOXB 0010 101w 


: mod reg r/m 


memory8 from byteregister 


0100 ORXB 0010 1010: 


mod bytereg r/m 


memory64 from qwordregister 


0100 1RXB 0010 1011 


:mod qwordreg r/m 


register from memory 


0100 ORXB 0010 100w 


‘mod reg r/m 


byteregister from memory8 


0100 ORXB 0010 1000: 


mod bytereg r/m 


qwordregister from memory8 


immediate from register 


0100 1RXB 0010 1000: 


0100 O00B 1000 OOsw 


mod qwordreg r/m 


:11 101 reg: imm 


immediate8 from byteregister 


0100 OOOB 1000 0000: 


11 101 bytereg : imm8 


immediate32 from qwordregister 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


immediate8 from qwordregister 


0100 100B 1000 0011: 11 101 qwordreg: imm8 


immediate from AL, AX, or EAX 


0100 O000B 0010 110w: imm 


immediate32 from RAX 


0100 1000 0010 1101 : imm32 


immediate from memory 


0100 OOXB 1000 OOsw : mod 101 r/m: imm 


immediate8 from memory8 0100 OOXB 1000 0000 : mod 101 r/m: imm8 
immediate32 from memory64 0100 10XB 1000 0001 : mod 101 r/m: imm32 
immediate8 from memory64 0100 10XB 1000 0011 : mod 101 r/m: imm8 


SWAPGS - Swap GS Base Register 


Exchanges the current GS base register value for value in MSR 
C0000102H 


0000 1111 0000 0001 


1111 1000 


SYSCALL - Fast System Call 


fast call to privilege level O system procedures 
SYSRET - Return From Fast System Call 


0000 1111 0000 0101 


return from fast system call 


0000 1111 0000 0111 


TEST - Logical Compare 


register1 and register2 


0100 OROB 1000 010w: 


11 reg] reg2 


byteregister1 and byteregister2 


0100 OROB 1000 0100: 


11 bytereg1 bytereg2 


qwordregister1 and qwordregister2 


memory and register 


0100 1ROB 1000 0101 : 
0100 OROB 1000 010w : 


11 qwordreg1 qwordreg2 


mod reg r/m 


memory8 and byteregister 


0100 ORXB 1000 0100: 


mod bytereg r/m 


memory64 and qwordregister 


immediate and register 


0100 1RXB 1000 0101: 
0100 OOOB 1111 O11w: 


mod qwordreg r/m 


11 000 reg: imm 


immediate8 and byteregister 


0100 OOOB 1111 0110: 


11 000 bytereg : imm8 


immediate32 and qwordregister 
immediate and AL, AX, or EAX 


0100 100B 1111 0111: 
0100 OOOB 1010 100w : 


11 000 bytereg : imm8 


imm 


immediate32 and RAX 


0100 1000 1010 1001 : 


imm32 


immediate and memory 


0100 OOXB 1111 011w: 


mod 000 r/m: imm 


immediate8 and memory8 


0100 1000 1111 0110: 


mod 000 r/m : imm8 


immediate32 and memory64 


0100 1000 1111 0111: 


mod 000 r/m: imm32 


UD2 - Undefined instruction 
VERR - Verify a Segment for Reading 


0000 FFFF : 0000 1011 


register 


0100 OOOB 0000 1111: 


0000 0000: 11 100 reg 


memory 


0100 OOXB 0000 1111: 


0000 0000 : mod 100 r/m 


VERW - Verify a Segment for Writing 


register 0100 O00B 0000 1111 : 0000 0000: 11 101 reg 
memory 0100 OOXB 0000 1111 : 0000 0000: mod 101 r/m 
WAIT - Wait 1001 1011 


WBINVD - Writeback and Invalidate Data Cache 


0000 1111 : 0000 1001 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


WRMSR - Write to Model-Specific Register 


write EDX:EAX to ECX specified MSR 


0000 1111: 0011 0000 


write RDX[31:0]:RAX[31:0] to RCX specified MSR 


0100 1000 0000 1111 : 0011 0000 


XADD - Exchange and Add 


register1, register2 


0100 OROB 0000 1111: 


1100 000w: 11 reg2 reg 


byteregister1, byteregister2 


0100 OROB 0000 1111: 


1100 0000: 11 bytereg2 bytereg1 


qwordregister1, qwordregister2 


0100 OROB 0000 1111: 
qwordreg1 


1100 0001 : 11 qwordreg2 


memory, register 


0100 ORXB 0000 1111: 


1100 O00w : mod reg r/m 


memory8, bytereg 


0100 1RXB 0000 1111: 


1100 0000: mod bytereg r/m 


memory64, qwordreg 


0100 1RXB 0000 1111: 


1100 0001 : mod qwordreg r/m 


XCHG - Exchange Register/Memory with Register 


register1 with register2 


1000 011w: 11 reg! reg2 


AX or EAX with register 


1001 Oreg 


memory with register 
XLAT/XLATB - Table Look-up Translation 


1000 011w: mod reg r/m 


AL to byte DS:[(€)BX + unsigned AL] 


1101 0111 


AL to byte DS:[RBX + unsigned AL] 
XOR - Logical Exclusive OR 


0100 1000 1101 0111 


register1 to register2 


0100 ORXB 0011 O00w : 


11 reg] reg2 


byteregister1 to byteregister2 


qwordregister1 to qwordregister2 


0100 OROB 0011 0000: 
0100 1ROB 0011 0001 


11 bytereg] bytereg2 


:11 qwordreg1 qwordreg2 


register2 to register1 


0100 OROB 0011 OO1w: 


11 reg] reg2 


byteregister2 to byteregister1 


qwordregister2 to qwordregister1 


0100 OROB 0011 0010: 
0100 1ROB 0011 0011 


11 bytereg1 bytereg2 


:11 qwordreg1 qwordreg2 


memory to register 


0100 ORXB 0011 O0O01w: 


mod reg r/m 


memory8 to byteregister 


0100 ORXB 0011 0010: 


mod bytereg r/m 


memory64 to qwordregister 


0100 1RXB 0011 0011 


: mod qwordreg r/m 


register to memory 


0100 ORXB 0011 O00w : 


mod reg r/m 


byteregister to memory8 


qwordregister to memory8 


0100 ORXB 0011 0000 : 
0100 1RXB 0011 0001 


mod bytereg r/m 


:mod qwordreg r/m 


immediate to register 


0100 O00B 1000 OOsw : 


11110 reg:imm 


immediate8 to byteregister 


immediate32 to qwordregister 


0100 O00B 1000 0000 
0100 100B 1000 0001 : 


:11 110 bytereg : imm8 


11 110 qwordreg : imm32 


immediate8 to qwordregister 


0100 100B 1000 0011: 


11 110 qwordreg : imm8 


immediate to AL, AX, or EAX 


0100 OO0B 0011 010w: 


imm 


immediate to RAX 


0100 1000 0011 0101 


: immediate data 


immediate to memory 


0100 OOXB 1000 OOsw : 


mod 110 r/m:imm 


immediate8 to memory8 


0100 OOXB 1000 0000 : 


mod 110 r/m: imm8 
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Table B-15. General Purpose Instruction Formats and Encodings for 64-Bit Mode (Contd.) 


Instruction and Format 


Encoding 


immediate32 to memory64 


0100 10XB 1000 0001 : mod 110 r/m: imm32 


immediate8 to memory64 


0100 10XB 1000 0011 : mod 110 r/m: imm8 


Prefix Bytes 
address size 01100111 
LOCK 1111 0000 
operand size 01100110 
CS segment override 0010 1110 
DS segment override 00111110 
ES segment override 0010 0110 
FS segment override 01100100 
GS segment override 01100101 
SS segment override 00110110 


B.3 PENTIUM® PROCESSOR FAMILY INSTRUCTION FORMATS AND ENCODINGS 


The following table shows formats and encodings introduced by the Pentium processor family. 


Table B-16. Pentium Processor Family Instruction Formats and Encodings, Non-64-Bit Modes 


Instruction and Format 


Encoding 


CMPXCHG8B - Compare and Exchange 8 Bytes 
EDX:EAX with memory64 


0000 1111: 1100 0111 : mod 001 r/m 


Table B-17. Pentium Processor Family Instruction Formats and Encodings, 64-Bit Mode 


Instruction and Format 


Encoding 


CMPXCHG8B/CMPXCHG16B - Compare and Exchange Bytes 
EDX:EAX with memory64 


0000 1111: 1100 0111 : mod 001 r/m 


RDX:RAX with memory128 


0100 10XB 0000 1111: 11000111 : mod 001 r/m 


B.4 64-BIT MODE INSTRUCTION ENCODINGS FOR SIMD INSTRUCTION 


EXTENSIONS 


Non-64-bit mode instruction encodings for MMX Technology, SSE, SSE2, and SSE3 are covered by applying these 
rules to Table B-19 through Table B-31. Table B-34 lists special encodings (instructions that do not follow the rules 


below). 

1. The REX instruction has no effect: 
* On immediates. 
¢ If both operands are MMX registers. 
* On MMX registers and XMM registers. 


¢ If an MMX register is encoded in the reg field of the ModR/M byte. 
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2. If amemory operand is encoded in the r/m field of the ModR/M byte, REX.X and REX.B may be used for 
encoding the memory operand. 


3. Ifa general-purpose register is encoded in the r/m field of the ModR/M byte, REX.B may be used for register 
encoding and REX.W may be used to encode the 64-bit operand size. 


4. If an XMM register operand is encoded in the reg field of the ModR/M byte, REX.R may be used for register 
encoding. If an XMM register operand is encoded in the r/m field of the ModR/M byte, REX.B may be used for 
register encoding. 


B.5 MMX INSTRUCTION FORMATS AND ENCODINGS 


MMX instructions, except the EMMS instruction, use a format similar to the 2-byte Intel Architecture integer format. 
Details of subfield encodings within these formats are presented below. 


B.5.1 Granularity Field (gg) 


The granularity field (gg) indicates the size of the packed operands that the instruction is operating on. When this 
field is used, it is located in bits 1 and 0 of the second opcode byte. Table B-18 shows the encoding of the gg field. 


Table B-18. Encoding of Granularity of Data Field (gg) 


gg Granularity of Data 
00 Packed Bytes 

01 Packed Words 

10 Packed Doublewords 

11 Quadword 


B.5.2 MMxX Technology and General-Purpose Register Fields (mmxreg and reg) 


When MMxX technology registers (mmxreg) are used as operands, they are encoded in the ModR/M byte in the reg 
field (bits 5, 4, and 3) and/or the R/M field (bits 2, 1, and 0). 


If an MMX instruction operates on a general-purpose register (reg), the register is encoded in the R/M field of the 
ModR/M byte. 


B.5.3 MMxX Instruction Formats and Encodings Table 


Table B-19 shows the formats and encodings of the integer instructions. 


Table B-19. MMX Instruction Formats and Encodings 


Instruction and Format Encoding 

EMMS - Empty MMX technology state 0000 1111:01110111 
MOVD - Move doubleword 

reg to mmxreg 0000 1111:0110 1110: 11 mmxreg reg 

reg from mmxreg 0000 1111:0111 1110: 11 mmxreg reg 

mem to mmxreg 0000 1111:0110 1110: mod mmxreg r/m 

mem from mmxreg 0000 1111:0111 1110: mod mmxreg r/m 
MOVQ - Move quadword 

mmxreg2 to mmxreg1 0000 1111:0110 1111: 11 mmxreg1 mmxreg2 

mmxreg2 from mmxreg1 0000 1111:0111 1111: 11 mmxreg1 mmxreg2 
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Table B-19. MMX Instruction Formats and Encodings (Contd.) 


Instruction and Format 


Encoding 


mem to mmxreg 


0000 1111:0110 1111: mod mmxreg r/m 


mem from mmxreg 


0000 1111:0111 1111: mod mmxreg r/m 


PACKSSDW' - Pack dword to word data (signed with saturat 


ion) 


mmxreg2 to mmxreg1 


0000 1111:0110 1011: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:0110 1011: mod mmxreg r/m 


PACKSSWB! - Pack word to byte data (signed with saturatio 


n 


~— 


mmxreg2 to mmxreg1 


0000 1111:0110 0011: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:0110 0011: mod mmxreg r/m 


PACKUSWB! - Pack word to byte data (unsigned with saturation) 


mmxreg2 to mmxreg1 


0000 1111:0110 0111: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:0110 0111: mod mmxreg r/m 


PADD - Add with wrap-around 


mmxreg2 to mmxreg1 


0000 1111: 1111 11gg: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111: 1111 11gg: mod mmxreg r/m 


PADDS - Add signed with saturation 


mmxreg2 to mmxreg1 


0000 1111: 1110 11gg: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111: 1110 11gg: mod mmxreg r/m 


PADDUS - Add unsigned with saturation 


mmxreg2 to mmxreg1 


0000 1111: 1101 11gg: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111: 1101 11gg: mod mmxreg r/m 


PAND - Bitwise And 


mmxreg2 to mmxreg1 


0000 1111:1101 1011: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:1101 1011: mod mmxreg r/m 


PANDN - Bitwise AndNot 


mmxreg2 to mmxreg1 


0000 1111:1101 1111: 11 mmxreg1 mmxreg2 


memory to mmxreg 


PCMPEQ - Packed compare for equality 


0000 1111:1101 1111: mod mmxreg r/m 


mmxreg1 with mmxreg2 


0000 1111:0111 01gg: 11 mmxreg1 mmxreg2 


mmxreg with memory 


0000 1111:0111 01gg: mod mmxreg r/m 


PCMPGT - Packed compare greater (signed) 


mmxreg1 with mmxreg2 


0000 1111:0110 01gg: 11 mmxreg1 mmxreg2 


mmxreg with memory 


0000 1111:0110 01gg: mod mmxreg r/m 


PMADDWD - Packed multiply add 


mmxreg2 to mmxreg1 


0000 1111:1111 0101: 11 mmxreg1 mmxreg2 


memory to mmxreg 


PMULHUW - Packed multiplication, store high word (unsigned) 


0000 1111:1111 0101: mod mmxreg r/m 


mmxreg2 to mmxreg1 


0000 1111: 1110 0100: 11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111: 11100100: mod mmxreg r/m 
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Table B-19. MMX Instruction Formats and Encodings (Contd.) 


Instruction and Format 


Encoding 


PMULHW - Packed multiplication, store high word 


mmxreg2 to mmxreg1 


0000 1111:1110 0101: 


11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:1110 0101: 


mod mmxreg r/m 


PMULLW - Packed multiplication, store low word 


mmxreg2 to mmxreg1 


0000 1111:1101 0101: 


11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:1101 0101: 


mod mmxreg r/m 


POR - Bitwise Or 


mmxreg2 to mmxreg1 


0000 1111:1110 1011: 


11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:1110 1011: 


mod mmxreg r/m 


PSLL? - Packed shift left logical 


mmxreg1 by mmxreg2 


0000 1111:1111 O0gg: 


11 mmxreg1 mmxreg2 


mmxreg by memory 


0000 1111:1111 O0gg: 


mod mmxreg r/m 


mmxreg by immediate 


0000 1111:0111 O0gg: 


11 110 mmxreg: imm8 data 


PSRA@ - Packed shift right arithmetic 


mmxreg1 by mmxreg2 


0000 1111:1110 O0gg: 


11 mmxreg1 mmxreg2 


mmxreg by memory 


0000 1111:1110 O0gg: 


mod mmxreg r/m 


mmxreg by immediate 


0000 1111:0111 O0gg: 


11 100 mmxreg: imm8 data 


PSRL? - Packed shift right logical 


mmxreg1 by mmxreg2 


0000 1111:1101 O0gg: 


11 mmxreg1 mmxreg2 


mmxreg by memory 


0000 1111:1101 O0gg: 


mod mmxreg r/m 


mmxreg by immediate 


0000 1111:0111 O0gg: 


11 010 mmxreg: imm8 data 


PSUB - Subtract with wrap-around 


mmxreg2 from mmxreg1 


0000 1111:1111 10gg: 


11 mmxreg1 mmxreg2 


memory from mmxreg 


0000 1111:1111 10gg: 


mod mmxreg r/m 


PSUBS - Subtract signed with saturation 


mmxreg2 from mmxreqg1 


memory from mmxreg 


0000 1111:1110 10gg: 
0000 1111:1110 10gg: 


11 mmxreg1 mmxreg2 


mod mmxreg r/m 


PSUBUS - Subtract unsigned with saturation 


mmxreg2 from mmxreqg1 


0000 1111:1101 10gg: 


11 mmxreg1 mmxreg2 


memory from mmxreg 


0000 1111:1101 10gg: 


mod mmxreg r/m 


PUNPCKH - Unpack high data to next larger type 


mmxreg2 to mmxreg1 


0000 1111:0110 10gg: 


11 mmxreg1 mmxreg2 


memory to mmxreg 


0000 1111:0110 10gg: 


mod mmxreg r/m 


PUNPCKL - Unpack low data to next larger type 


mmxreg2 to mmxreg1 


memory to mmxreg 


0000 1111:0110 O0gg: 
0000 1111:0110 00gg: 


11 mmxreg1 mmxreg2 


mod mmxreg r/m 
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Table B-19. MMX Instruction Formats and Encodings (Contd.) 


Instruction and Format Encoding 
PXOR - Bitwise Xor 
mmxreg2 to mmxreg1 0000 1111:1110 1111: 11 mmxreg1 mmxreg2 
memory to mmxreg 0000 1111:1110 1111: mod mmxreg r/m 


NOTES: 
1. The pack instructions perform saturation from signed packed data of one type to signed or unsigned data of the next smaller type. 


2. The format of the shift instructions has one additional format to support shifting by immediate shift-counts. The shift operations 
are not supported equally for all data types. 


B.6 PROCESSOR EXTENDED STATE INSTRUCTION FORMATS AND ENCODINGS 


Table B-20 shows the formats and encodings for several instructions that relate to processor extended state 
management. 


Table B-20. Formats and Encodings of XSAVE/XRSTOR/XGETBV/XSETBV Instructions 


Instruction and Format Encoding 
XGETBV - Get Value of Extended Control Register 0000 1111:0000 0001: 1101 0000 
XRSTOR - Restore Processor Extended States! 0000 1111:1010 1110: mod’ 101 r/m 
XSAVE - Save Processor Extended States! 0000 1111:1010 1110: mod’ 100 r/m 
XSETBV - Set Extended Control Register 0000 1111:0000 0001: 1101 0001 


NOTES: 
1. For XSAVE and XRSTOR, “mod = 11” is reserved. 


B.7 P6 FAMILY INSTRUCTION FORMATS AND ENCODINGS 


Table B-20 shows the formats and encodings for several instructions that were introduced into the IA-32 architec- 
ture in the P6 family processors. 


Table B-21. Formats and Encodings of P6 Family Instructions 


Instruction and Format Encoding 

CMOVcc - Conditional Move 

register2 to register] 0000 1111:0100 tttn: 11 reg] reg2 

memory to register 0000 1111: 0100 tttn: mod reg r/m 
FCMOVcc - Conditional Move on EFLAG Register Condition Codes 

move if below (B) 11011 010: 11 000 ST(i) 

move if equal (E) 11011 010:11 001 ST(i) 

move if below or equal (BE) 11011010: 11010 ST(i) 

move if unordered (U) 11011010: 11 011 ST(i) 

move if not below (NB) 11011011: 11 000 ST(i) 

move if not equal (NE) 11011 011:11 001 ST(i) 

move if not below or equal (NBE) 11011 011:11 010 ST(i) 
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Table B-21. Formats and Encodings of P6 Family Instructions (Contd.) 


Instruction and Format Encoding 
move if not unordered (NU) 11011 011:11 011 ST(i) 
FCOMI - Compare Real and Set EFLAGS 11011 011:11 110 ST(i) 
FXRSTOR - Restore x87 FPU, MMX, SSE, and SSE2 State 0000 1111:1010 1110: mod’ 001 r/m 
FXSAVE - Save x87 FPU, MMX, SSE, and SSE2 State 0000 1111:1010 1110: mod’ 000 r/m 
SYSENTER - Fast System Call 0000 1111:0011 0100 
SYSEXIT - Fast Return from Fast System Call 0000 1111:0011 0101 


NOTES: 
1. For FXSAVE and FXRSTOR, “mod = 11” is reserved. 


B.8 SSE INSTRUCTION FORMATS AND ENCODINGS 


The SSE instructions use the ModR/M format and are preceded by the OFH prefix byte. In general, operations are 
not duplicated to provide two directions (that is, separate load and store variants). 


The following three tables (Tables B-22, B-23, and B-24) show the formats and encodings for the SSE SIMD 
floating-point, SIMD integer, and cacheability and memory ordering instructions, respectively. Some SSE instruc- 
tions require a mandatory prefix (66H, F2H, F3H) as part of the two-byte opcode. Mandatory prefixes are included 
in the tables. 


Table B-22. Formats and Encodings of SSE Floating-Point Instructions 


Instruction and Format Encoding 

ADDPS—Add Packed Single-Precision Floating-Point Values 

xmmreg2 to xmmreg1 0000 1111:0101 1000:11 xmmreg1 xmmreg2 

mem to xmmreg 0000 1111:0101 1000: mod xmmreg r/m 
ADDSS—Add Scalar Single-Precision Floating-Point Values 

xmmreg2 to xmmreg1 1111 0011:0000 1111:01011000:11 xmmreg1 xmmreg2 

mem to xmmreg 1111 0011:0000 1111:01011000: mod xmmreg r/m 
ANDNPS-—Bitwise Logical AND NOT of Packed Single-Precision Floating-Point Values 

xmmreg2 to xmmreg1 0000 1111:0101 0101:11 xmmreg1 xmmreg2 

mem to xmmreg 0000 1111:0101 0101: mod xmmreg r/m 
ANDPS-—Bitwise Logical AND of Packed Single-Precision Floating-Point Values 

xmmreg2 to xmmreg1 0000 1111:0101 0100:11 xmmreg1 xmmreg2 

mem to xmmreg 0000 1111:0101 0100: mod xmmreg r/m 
CMPPS—Compare Packed Single-Precision Floating-Point Values 

xmmreg2 to xmmreg1, imm8 0000 1111:1100 0010:11 xmmreg1 xmmreg2: imm8 

mem to xmmreg, imm8 0000 1111:1100 0010: mod xmmreg r/m: imm8 


CMPSS—Compare Scalar Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1, imm8 1111 0011:0000 1111:1100 0010:11 xmmreg1 xmmreg2: imm8 

mem to xmmreg, imm8 1111 0011:0000 1111:1100 0010: mod xmmreg r/m: imm8 
COMISS—Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS 

xmmreg2 to xmmreg1 0000 1111:0010 1111:11 xmmreg1 xmmreg2 

mem to xmmreg 0000 1111:0010 1111: mod xmmreg r/m 
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Table B-22. Formats and Encodings of SSE Floating-Point Instructions (Contd.) 


Instruction and Format 


Encoding 


CVTPI2PS—Convert Packed Doubleword Integers to Packed Single-Precision Floating-Point Values 


mmreg to xmmreg 


0000 1111:0010 1010:11 xmmreg1 mmreg1 


mem to xmmreg 


0000 1111:0010 1010: mod xmmreg r/m 


CVTPS2PI—Convert Packed Single-Precision Floating-Point Values to Packed Doubleword Integers 


xmmreg to mmreg 


0000 1111:0010 1101:11 mmreg1 xmmreg1 


mem to mmreg 


0000 1111:0010 1101: mod mmreg r/m 


CVTSI2SS—Convert Doubleword Integer to Scalar Single-Precision Floating-Point Value 


r32 to xmmreg1 


1111 0011:0000 1111:00101010:11 xmmreg1 132 


mem to xmmreg 


1111 0011:0000 1111:00101010: mod xmmreg r/m 


CVTSS2SI—Convert Scalar Single-Precision Floating-Point Value to Doubleword Integer 


xmmreg to r32 


1111 0011:0000 1111:0010 1101:11 r32 xmmreg 


mem to r32 


1111 0011:0000 1111:0010 1101: mod r32 r/m 


CVTTPS2PI—Convert with Truncation Packed Single-Precision Floating-Point Values to Packed Doubleword Integers 


xmmreg to mmreg 


0000 1111:0010 1100:11 mmreg1 xmmreg1 


mem to mmreg 


0000 1111:0010 1100: mod mmreg r/m 


CVTTSS2SI—Convert with Truncation Scalar Single-Prec 


ision Floating-Point Value to Doubleword Integer 


xmmreg to r32 


1111 0011:0000 1111:0010 1100:11 r32 xmmreg1 


mem to r32 


1111 0011:0000 1111:0010 1100: mod r32 r/m 


DIVPS—Divide Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0101 1110:11 xmmreg1 xmmreg2 


mem to xmmreg 


0000 1111:0101 1110: mod xmmreg r/m 


DIVSS—Divide Scalar Single-Precision Floating-Point Val 


ues 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0101 1110:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0101 1110: mod xmmreg r/m 


LDMXCSR—Load MXCSR Register State 


m32 to MXCSR 


0000 1111:1010 1110:mod’ 010 mem 


MAXPS—Return Maximum Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0101 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


0000 1111:0101 1111: mod xmmreg r/m 


MAXSS—Return Maximum Scalar Double-Precision Floating-Point Value 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0101 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0101 1111: mod xmmreg r/m 


MINPS—Return Minimum Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0101 1101:11 xmmreg1 xmmreg2 


mem to xmmreg 


0000 1111:0101 1101: mod xmmreg r/m 


MINSS—Return Minimum Scalar Double-Precision Floating-Point Value 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0101 1101:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0101 1101: mod xmmreg r/m 
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Table B-22. Formats and Encodings of SSE Floating-Point Instructions (Contd.) 


Instruction and Format 


Encoding 


MOVAPS—Move Aligned Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0010 1000:11 xmmreg2 xmmreg1 


mem to xmmreg1 


0000 1111:0010 1000: mod xmmreg r/m 


xmmreg1 to xmmreg2 


0000 1111:0010 1001:11 xmmreg1 xmmreg2 


xmmreg1 to mem 


0000 1111:0010 1001: mod xmmreg r/m 


MOVHLPS—Move Packed Single-Precision Floating-Point Values High to Low 


xmmreg2 to xmmreg1 


0000 1111:0001 0010:11 xmmreg1 xmmreg2 


MOVHPS—Move High Packed Single-Precision Floating-Point Values 


mem to xmmreg 


0000 1111:0001 0110: mod xmmreg r/m 


xmmreg to mem 


0000 1111:0001 0111: mod xmmreg r/m 


MOVLHPS—Move Packed Single-Precision Floating-Point Values Low to High 


xmmreg2 to xmmreg1 


0000 1111:00010110:11 xmmreg1 xmmreg2 


MOVLPS—Move Low Packed Single-Precision Floating-Point Values 


mem to xmmreg 


0000 1111:0001 0010: mod xmmreg r/m 


xmmreg to mem 


0000 1111:0001 0011: mod xmmreg r/m 


MOVMSKPS—Extract Packed Single-Precision Floating-Point Sign Mask 


xmmreg to r32 


0000 1111:0101 0000:11 r32 xmmreg 


MOVSS—Move Scalar Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0001 0000:11 xmmreg2 xmmreg1 


mem to xmmreg1 


1111 0011:0000 1111:0001 0000: mod xmmreg r/m 


xmmreg1 to xmmreg2 


1111 0011:0000 1111:0001 0001:11 xmmreg1 xmmreg2 


xmmreg1 to mem 


1111 0011:0000 1111:0001 0001: mod xmmreg r/m 


MOVUPS—Move Unaligned Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


mem to xmmreg1 


0000 1111:0001 0000:11 xmmreg2 xmmreg1 
0000 1111:0001 0000: mod xmmreg r/m 


xmmreg1 to xmmreg2 


0000 1111:0001 0001:11 xmmreg1 xmmreg2 


xmmreg1 to mem 


0000 1111:0001 0001: mod xmmreg r/m 


MULPS—Multiply Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0101 1001:11 xmmreg1 xmmreg2 


mem to xmmreg 


0000 1111:0101 1001: mod xmmreg r/m 


MULSS—Multiply Scalar Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0101 1001:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0101 1001: mod xmmreg r/m 


ORPS—Bitwise Logical OR of Single-Precision Floating-Point Values 


xmmreg2 to xmmreq1 


0000 1111:0101 0110:11 xmmreg1 xmmreg2 


mem to xmmreg 


0000 1111:0101 0110: mod xmmreg r/m 


RCPPS—Compute Reciprocals of Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0000 1111:0101 0011:11 xmmreg1 xmmreg2 
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Table B-22. Formats and Encodings of SSE Floating-Point Instructions (Contd.) 


Instruction and Format Encoding 
mem to xmmreg 0000 1111:0101 0011: mod xmmreg r/m 
RCPSS—Compute Reciprocals of Scalar Single-Precision Floating-Point Value 
xmmreg2 to xmmreg1 1111 0011:0000 1111:01010011:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:01010011: mod xmmreg r/m 
RSQRTPS—Compute Reciprocals of Square Roots of Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 0010:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0101 0010: mode xmmreg r/m 
RSQRTSS—Compute Reciprocals of Square Roots of Scalar Single-Precision Floating-Point Value 
xmmreg2 to xmmreg1 1111 0011:0000 1111:0101 0010:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:0101 0010: mod xmmreg r/m 
SHUFPS—Shuffle Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1, imm8 0000 1111:1100 0110:11 xmmreg1 xmmreg2: imm8 
mem to xmmreg, imm8 0000 1111:1100 0110: mod xmmreg r/m: imm8 
SQRTPS—Compute Square Roots of Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 0001:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0101 0001: mod xmmreg r/m 
SQRTSS—Compute Square Root of Scalar Single-Precision Floating-Point Value 
xmmreg2 to xmmreg1 1111 0011:0000 1111:0101 0001:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:0101 0001:mod xmmreg r/m 
STMXCSR—Store MXCSR Register State 
MXCSR to mem 0000 1111:1010 1110:mod4 011 mem 
SUBPS—Subtract Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 1100:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0101 1100:mod xmmreg r/m 
SUBSS—Subtract Scalar Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 1111 0011:0000 1111:0101 1100:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:0101 1100:mod xmmreg r/m 
UCOMISS—Unordered Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS 
xmmreg2 to xmmreg1 0000 1111:0010 1110:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0010 1110: mod xmmreg r/m 
UNPCKHPS—Unpack and Interleave High Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0001 0101:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0001 0101: mod xmmreg r/m 
UNPCKLPS—Unpack and Interleave Low Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0001 0100:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0001 0100: mod xmmreg r/m 
XORPS—Bitwise Logical XOR of Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 0111:11 xmmreg1 xmmreg2 
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Table B-22. Formats and Encodings of SSE Floating-Point Instructions (Contd.) 


Instruction and Format 


Encoding 


mem to xmmreg 


0000 1111:0101 0111: mod xmmreg r/m 


Table B-23. Formats and Encodings of SSE Integer Instructions 


Instruction and Format 


Encoding 


PAVGB/PAVGW—Average Packed Integers 


mmreg2 to mmreg1 


0000 1111:1110 0000:11 mmreg1 mmreg2 


0000 1111:1110 0011:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:1110 0000: mod mmreg r/m 


0000 1111:1110 0011: mod mmreg r/m 


PEXTRW—Extract Word 


mmreg to reg32, imm8 


0000 1111:1100 0101:11 r32 mmreg: imm8 


PINSRW—Insert Word 


reg32 to mmreg, imm8 


m16 to mmreg, imm8 


0000 1111:1100 0100:11 mmreg r32: imm8 
0000 1111:1100 0100: mod mmreg r/m: imm8 


PMAXSW—Maximum of Packed Signed Word Integers 


mmreg2 to mmreg1 


mem to mmreg 


0000 1111:1110 1110:11 mmreg1 mmreg2 
0000 1111:1110 1110: mod mmreg r/m 


PMAXUB—Maximum of Packed Unsigned Byte Integers 


mmreg2 to mmreg1 


mem to mmreg 


0000 1111:1101 1110:11 mmreg1 mmreg2 
0000 1111:1101 1110: mod mmreg r/m 


PMINSW—Minimum of Packed Signed Word Integers 


mmreg2 to mmreg1 


mem to mmreg 


0000 1111:1110 1010:11 mmreg1 mmreg2 
0000 1111:1110 1010: mod mmreg r/m 


PMINUB—Minimum of Packed Unsigned Byte Integers 


mmreg2 to mmreg1 


0000 1111:1101 1010:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:1101 1010: mod mmreg r/m 


PMOVMSKB—Move Byte Mask To Integer 


mmreg to reg32 


0000 1111:1101 0111:11 r32 mmreg 


PMULHUW—Multiply Packed Unsigned Integers and Store High Result 


mmreg2 to mmreg1 


0000 1111:1110 0100:11 mmreg1 mmreg2 


mem to mmreg 
PSADBW—Compute Sum of Absolute Differences 


0000 1111:1110 0100: mod mmreg r/m 


mmreg2 to mmreg1 


0000 1111:1111 0110:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:1111 0110: mod mmreg r/m 


PSHUFW —Shuffle Packed Words 


mmreg2 to mmreg1, imm8 


0000 1111:0111 0000:11 mmreg1 mmreg2: imm8 


mem to mmreg, imm8 


0000 1111:0111 0000: mod mmreg r/m: imm8 
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Table B-24. Format and Encoding of SSE Cacheability & Memory Ordering Instructions 


Instruction and Format Encoding 

MASKMOVQ-—Store Selected Bytes of Quadword 

mmreg2 to mmreg1 0000 1111:1111 0111:11 mmreg1 mmreg2 
MOVNTPS—Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint 

xmmreg to mem 0000 1111:0010 1011: mod xmmreg r/m 
MOVNTQ—Store Quadword Using Non-Temporal Hint 

mmreg to mem 0000 1111:1110 0111: mod mmreg r/m 
PREFETCHTO—Prefetch Temporal to All Cache Levels 0000 1111:0001 1000:mod4 001 mem 
PREFETCHT1—Prefetch Temporal to First Level Cache 0000 1111:0001 1000:mod* 010 mem 
PREFETCHT2—Prefetch Temporal to Second Level Cache 0000 1111:0001 1000:mod’ 011 mem 
PREFETCHNTA—Prefetch Non-Temporal to All Cache Levels 0000 1111:0001 1000:mod* 000 mem 
SFENCE—Store Fence 0000 1111:1010 1110:11 111 000 


B.9 SSE2 INSTRUCTION FORMATS AND ENCODINGS 


The SSE2 instructions use the ModR/M format and are preceded by the OFH prefix byte. In general, operations are 
not duplicated to provide two directions (that is, separate load and store variants). 


The following three tables show the formats and encodings for the SSE2 SIMD floating-point, SIMD integer, and 
cacheability instructions, respectively. Some SSE2 instructions require a mandatory prefix (66H, F2H, F3H) as part 
of the two-byte opcode. These prefixes are included in the tables. 


B.9.1 Granularity Field (gg) 


The granularity field (gg) indicates the size of the packed operands that the instruction is operating on. When this 
field is used, it is located in bits 1 and O of the second opcode byte. Table B-25 shows the encoding of this gg field. 


Table B-25. Encoding of Granularity of Data Field (gg) 


gg Granularity of Data 
00 Packed Bytes 

01 Packed Words 

10 Packed Doublewords 

11 Quadword 
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Table B-26. Formats and E 


ncodings of SSE2 Floating-Point Instructions 


Instruction and Format 


Encoding 


ADDPD—Add Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 1000:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 1000: mod xmmreg r/m 


ADDSD—Add Scalar Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0101 1000:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:0000 1111:0101 1000: mod xmmreg r/m 


ANDNPD-—Bitwise Logical AND NOT of Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 0101:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 0101: mod xmmreg r/m 


ANDPD-—Bitwise Logical AND of Packed Double-Preci 


sion Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 0100:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 0100: mod xmmreg r/m 


CMPPD—Compare Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1, imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:1100 0010: mod xmmreg r/m: imm8 


CMPSD—Compare Scalar Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1, imm8 


mem to xmmreg, imm8 


11110 010:0000 1111:1100 0010: mod xmmreg r/m: imm8 


COMISD—Compare Scalar Ordered Double-Precision F 


loating-Point Values and Set EFLAGS 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0010 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0010 1111: mod xmmreg r/m 


CVTPI2PD—Convert Packed Doubleword Integers to Packed Double-Precision Floating-Point Values 


mmreg to xmmreg 


0110 0110:0000 1111:0010 1010:11 xmmreg1 mmreg1 


mem to xmmreg 


0110 0110:0000 1111:0010 1010: mod xmmreg r/m 


CVTPD2PI—Convert Packed Double-Precision Floating-Point Values to Packed Doubleword Integers 


xmmreg to mmreg 


mem to mmreg 


0110 0110:0000 1111:0010 1101:11 mmreg1 xmmreg1 
0110 0110:0000 1111:0010 1101: mod mmreg r/m 


CVTSI2SD—Convert Doubleword Integer to Scalar Do 


uble-Precision Floating-Point Value 


r32 to xmmreg1 


1111 0010:0000 1111:0010 1010:11 xmmreg r32 


mem to xmmreg 


1111 0010:0000 1111:0010 1010: mod xmmreg r/m 


CVTSD2SI—Convert Scalar Double-Precision Floating-Point Value to Doubleword Integer 


xmmreg to r32 


1111 0010:0000 1111:0010 1101:11 r32 xmmreg 


mem to r32 


1111 0010:0000 1111:0010 1101: mod r32 r/m 


CVTTPD2PI—Convert with Truncation Packed Double-Precision Floating-Point Values to Packed Doubleword Integers 


xmmreg to mmreg 


mem to mmreg 


0110 0110:0000 1111:0010 1100:11 mmreg xmmreg 
0110 0110:0000 1111:0010 1100: mod mmreg r/m 


CVTTSD2SI—Convert with Truncation Scalar Double-Precision Floating-Point Value to Doubleword Integer 


xmmreg to r32 
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1111 0010:0000 1111:0010 1100:11 r32 xmmreg 


0110 0110:0000 1111:1100 0010:11 xmmreg1 xmmreg2: imm8 


1111 0010:0000 1111:1100 0010:11 xmmreg1 xmmreg2: imm8 
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Table B-26. Formats and Encodings of SSE2 Floating-Point Instructions (Contd.) 


Instruction and Format Encoding 
mem to r32 1111 0010:0000 1111:0010 1100: mod r32 r/m 
CVTPD2PS—Covert Packed Double-Precision Floating-Point Values to Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0101 1010:11 xmmreg1 xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0101 1010: mod xmmreg r/m 
CVTPS2PD—Covert Packed Single-Precision Floating-Point Values to Packed Double-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 1010:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0101 1010: mod xmmreg r/m 
CVTSD2SS—Covert Scalar Double-Precision Floating-Point Value to Scalar Single-Precision Floating-Point Value 
xmmreg2 to xmmreg1 1111 0010:0000 1111:0101 1010:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0010:0000 1111:0101 1010: mod xmmreg r/m 
CVTSS2SD—Covert Scalar Single-Precision Floating-Point Value to Scalar Double-Precision Floating-Point Value 
xmmreg2 to xmmreg1 1111 0011:0000 1111:0101 1010:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:00001 111:0101 1010: mod xmmreg r/m 
CVTPD2DQ—Convert Packed Double-Precision Floating-Point Values to Packed Doubleword Integers 
xmmreg2 to xmmreg1 1111 0010:0000 1111:1110 0110:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0010:0000 1111:1110 0110: mod xmmreg r/m 
CVTTPD2DQ—Convert With Truncation Packed Double-Precision Floating-Point Values to Packed Doubleword Integers 
xmmreg2 to xmmreg1 0110 0110:0000 1111:1110 0110:11 xmmreg1 xmmreg2 
mem to xmmreg 0110 0110:0000 1111:1110 0110: mod xmmreg r/m 
CVTDQ2PD—Convert Packed Doubleword Integers to Packed Single-Precision Floating-Point Values 
xmmreg2 to xmmreg1 1111 0011:0000 1111:1110 0110:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:1110 0110: mod xmmreg r/m 
CVTPS2DQ—Convert Packed Single-Precision Floating-Point Values to Packed Doubleword Integers 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0101 1011:11 xmmreg1 xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0101 1011: mod xmmreg r/m 
CVTTPS2DQ—Convert With Truncation Packed Single-Precision Floating-Point Values to Packed Doubleword Integers 
xmmreg2 to xmmreg1 1111 0011:0000 1111:0101 1011:11 xmmreg1 xmmreg2 
mem to xmmreg 1111 0011:0000 1111:0101 1011: mod xmmreg r/m 
CVTDQ2PS—Convert Packed Doubleword Integers to Packed Double-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0000 1111:0101 1011:11 xmmreg1 xmmreg2 
mem to xmmreg 0000 1111:0101 1011: mod xmmreg r/m 
DIVPD—Divide Packed Double-Precision Floating-Point Values 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0101 1110:11 xmmreg1 xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0101 1110: mod xmmreg r/m 
DIVSD—Divide Scalar Double-Precision Floating-Point Values 
xmmreg2 to xmmreg1 1111 0010:0000 1111:0101 1110:11 xmmreg1 xmmreg2 


Vol.2D B-49 


INSTRUCTION FORMATS AND ENCODINGS 


Table B-26. Formats and Encodings of SSE2 Floating-Point Instructions (Contd.) 


Instruction and Format 


Encoding 


mem to xmmreg 


1111 0010:0000 1111:0101 1110: mod xmmreg r/m 


MAXPD—Return Maximum Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 1111: mod xmmreg r/m 


MAXSD—Return Maximum Scalar Double-Precision Fl 


oating-Point Value 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0101 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:0000 1111:0101 1111: mod xmmreg r/m 


MINPD—Return Minimum Packed Double-Precision Fl 


oating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 1101:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 1101: mod xmmreg r/m 


MINSD—Return Minimum Scalar Double-Precision Flo 


ating-Point Value 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0101 1101:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:0000 1111:0101 1101: mod xmmreg r/m 


MOVAPD—Move Aligned Packed Double-Precision Flo 


ating-Point Values 


xmmreg1 to xmmreg2 


0110 0110:0000 1111:0010 1001:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


0110 0110:0000 1111:0010 1001: mod xmmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0010 1000:11 xmmreg1 xmmreg2 


mem to xmmreg1 


0110 0110:0000 1111:0010 1000: mod xmmreg r/m 


MOVHPD—Move High Packed Double-Precision Floati 


ng-Point Values 


xmmreg to mem 


0110 0110:0000 1111:0001 0111: mod xmmreg r/m 


mem to xmmreg 


0110 0110:0000 1111:0001 0110: mod xmmreg r/m 


MOVLPD—Move Low Packed Double-Precision Floating-Point Values 


xmmreg to mem 


0110 0110:0000 1111:0001 0011: mod xmmreg r/m 


mem to xmmreg 


0110 0110:0000 1111:0001 0010: mod xmmreg r/m 


MOVMSKPD—E€Extract Packed Double-Precision Floating-Point Sign Mask 


xmmreg to r32 


0110 0110:0000 1111:0101 0000:11 r32 xmmreg 


MOVSD—Move Scalar Double-Precision Floating-Point Values 


xmmreg1 to xmmreg2 


1111 0010:0000 1111:0001 0001:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


1111 0010:0000 1111:0001 0001: mod xmmreg r/m 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0001 0000:11 xmmreg1 xmmreg2 


mem to xmmreg1 


1111 0010:0000 1111:0001 0000: mod xmmreg r/m 


MOVUPD—Move Unaligned Packed Double-Precision 


Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0001 0001:11 xmmreg2 xmmreg1 


mem to xmmreg1 


0110 0110:0000 1111:0001 0001: mod xmmreg r/m 


xmmreg1 to xmmreg2 


xmmreg1 to mem 


0110 0110:0000 1111:0001 0000:11 xmmreg1 xmmreg2 
0110 0110:0000 1111:0001 0000: mod xmmreg r/m 


MULPD—Multiply Packed Double-Precision Floating-P. 


oint Values 


xmmreg2 to xmmreg1 
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0110 0110:0000 1111:0101 1001:11 xmmreg1 xmmreg2 
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Table B-26. Formats and Encodings of SSE2 Floating-Point Instructions (Contd.) 


Instruction and Format 


Encoding 


mem to xmmreg 


0110 0110:0000 1111:0101 1001: mod xmmreg r/m 


MULSD—Multiply Scalar Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


1111 0010:00001111:01011001:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:00001111:01011001: mod xmmreg r/m 


ORPD—Bitwise Logical OR of Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 0110:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 0110: mod xmmreg r/m 


SHUFPD—Shuffle Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:1100 0110:11 xmmreg1 xmmreg2: imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:1100 0110: mod xmmreg r/m: imm8 


SQRTPD—Compute Square Roots of Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 0001:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 0001: mod xmmreg r/m 


SQRTSD—Compute Square Root of Scalar Double-Pre 


cision Floating-Point Value 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0101 0001:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:0000 1111:0101 0001: mod xmmreg r/m 


SUBPD—Subtract Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 1100:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 1100: mod xmmreg r/m 


SUBSD—Subtract Scalar Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


1111 0010:0000 1111:0101 1100:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0010:0000 1111:0101 1100: mod xmmreg r/m 


UCOMISD—Unordered Compare Scalar Ordered Doubl 


e-Precision Floating-Point Values and Set EFLAGS 


xmmreg2 to xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0010 1110:11 xmmreg1 xmmreg2 
0110 0110:0000 1111:0010 1110: mod xmmreg r/m 


UNPCKHPD—Unpack and Interleave High Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0001 0101:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0001 0101: mod xmmreg r/m 


UNPCKLPD—Unpack and Interleave Low Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0001 0100:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0001 0100: mod xmmreg r/m 


XORPD—Bitwise Logical OR of Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0101 0111:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0101 0111: mod xmmreg r/m 
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Table B-27. Formats and Encodings of SSE2 Integer Instructions 


Instruction and Format 


Encoding 


MOVD—Move Doubleword 


reg to xmmreg 


0110 0110:0000 1111:0110 1110: 11 xmmreg reg 


reg from xmmreg 


0110 0110:0000 1111:0111 1110: 11 xmmreg reg 


mem to xmmreg 


0110 0110:0000 1111:0110 1110: mod xmmreg r/m 


mem from xmmreg 


0110 0110:0000 1111:0111 1110: mod xmmreg r/m 


MOVDQA—Move Aligned Double Quadword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 1111:11 xmmreg1 xmmreg2 


xmmreg2 from xmmreq1 


0110 0110:0000 1111:0111 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0110 1111: mod xmmreg r/m 


mem from xmmreg 


0110 0110:0000 1111:0111 1111: mod xmmreg r/m 


MOVDQU—Move Unaligned Double Quadword 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0110 1111:11 xmmreg1 xmmreg2 


xmmreg2 from xmmreg1 


1111 0011:0000 1111:0111 1111:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0110 1111: mod xmmreg r/m 


mem from xmmreg 


1111 0011:0000 1111:0111 1111: mod xmmreg r/m 


MOVQ2DQ—Move Quadword from MMX to XMM Register 


mmreg to xmmreg 


1111 0011:0000 1111:1101 0110:11 mmreg1 mmreg2 


MOVDQ2Q—Move Quadword from XMM to MMX Register 


xmmreg to mmreg 


1111 0010:0000 1111:1101 0110:11 mmreg1 mmreg2 


MOVQ—Move Quadword 


xmmreg2 to xmmreg1 


1111 0011:0000 1111:0111 1110: 11 xmmreg1 xmmreg2 


xmmreg2 from xmmreqg1 


0110 0110:0000 1111:1101 0110: 11 xmmreg1 xmmreg2 


mem to xmmreg 


1111 0011:0000 1111:0111 1110: mod xmmreg r/m 


mem from xmmreg 


0110 0110:0000 1111:1101 0110: mod xmmreg r/m 


PACKSSDW'!—Pack Dword To Word Data (signed with saturation) 


xmmreg2 to xmmreg1 


memory to xmmreg 


0110 0110:0000 1111:0110 1011: 11 xmmreg1 xmmreg2 
0110 0110:0000 1111:0110 1011: mod xmmreg r/m 


PACKSSWB—Pack Word To Byte Data (signed with saturation) 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 0011: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:0110 0011: mod xmmreg r/m 


PACKUSWB—Pack Word To Byte Data (unsigned with saturation) 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 0111: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:0110 0111: mod xmmreg r/m 


PADDQ—Add Packed Quadword Integers 


mmreg2 to mmreg1 


mem to mmreg 


0000 1111:1101 0100:11 mmreg1 mmreg2 
0000 1111:1101 0100: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 0100:11 xmmreg1 xmmreg2 


mem to xmmreg 
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0110 0110:0000 1111:1101 0100: mod xmmreg r/m 
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Table B-27. Formats and Encodings of SSE2 Integer Instructions (Contd.) 


Instruction and Format 


Encoding 


PADD—Add With Wrap-around 


xmmreg2 to xmmreg1 


0110 0110:0000 1111: 1111 11gg: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111: 1111 11gg: mod xmmreg r/m 


PADDS—Add Signed With Saturation 


xmmreg2 to xmmreg1 


0110 0110:0000 1111: 1110 11gg: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111: 1110 11gg: mod xmmreg r/m 


PADDUS—Add Unsigned With Saturation 


xmmreg2 to xmmreg1 


0110 0110:0000 1111: 1101 11gg: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111: 1101 11gg: mod xmmreg r/m 


PAND—Bitwise And 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 1011: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1101 1011: mod xmmreg r/m 


PANDN—Bitwise AndNot 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 1111: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1101 1111: mod xmmreg r/m 


PAVGB—Average Packed Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:11100 000:11 xmmreg1 xmmreg2 


mem to xmmreg 


01100110:00001111:11100000 mod xmmreg r/m 


PAVGW—Average Packed Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 0011:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1110 0011 mod xmmreg r/m 


PCMPEQ—Packed Compare For Equality 


xmmreg1 with xmmreg2 


0110 0110:0000 1111:0111 01gg: 11 xmmreg1 xmmreg2 


xmmreg with memory 


0110 0110:0000 1111:0111 01gg: mod xmmreg r/m 


PCMPGT—Packed Compare Greater (signed) 


xmmreg1 with xmmreg2 


xmmreg with memory 


0110 0110:0000 1111:0110 01gg: 11 xmmreg1 xmmreg2 
0110 0110:0000 1111:0110 01gg: mod xmmreg r/m 


PEXTRW—Extract Word 


xmmreg to reg32, imm8 


0110 0110:0000 1111:1100 0101:11 r32 xmmreg: imm8 


PINSRW—Insert Word 


reg32 to xmmreg, imm8 


0110 0110:0000 1111:1100 0100:11 xmmreg r32: imm8 


m16 to xmmreg, imm8 


0110 0110:0000 1111:1100 0100: mod xmmreg r/m: imm8 


PMADDWD—Packed Multiply Add 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1111 0101: 11 xmmreg1 xmmreg2 


memory to xmmreg 
PMAXSW—Maximum of Packed Signed Word Integers 


0110 0110:0000 1111:1111 0101: mod xmmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 1110:11 xmmreg1 xmmreg2 


mem to xmmreg 


01100110:00001111:11101110: mod xmmreg r/m 
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Table B-27. Formats and Encodings of SSE2 Integer Instructions (Contd.) 


Instruction and Format 


Encoding 


PMAXUB—Maximum of Packed Unsigned Byte Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 1110:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1101 1110: mod xmmreg r/m 


PMINSW—Minimum of Packed Signed Word Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 1010:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1110 1010: mod xmmreg r/m 


PMINUB—Minimum of Packed Unsigned Byte Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 1010:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1101 1010 mod xmmreg r/m 


PMOVMSKB—Move Byte Mask To Integer 


xmmreg to reg32 


0110 0110:0000 1111:1101 0111:11 132 xmmreg 


PMULHUW—Packed multiplication, store high word (unsigned) 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 0100: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1110 0100: mod xmmreg r/m 


PMULHW—Packed Multiplication, store high word 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 0101: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1110 0101: mod xmmreg r/m 


PMULLW—Packed Multiplication, store low word 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1101 0101: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1101 0101: mod xmmreg r/m 


PMULUDQ—Multiply Packed Unsigned Doubleword Integers 


mmreg2 to mmreg1 


0000 1111:1111 0100:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:1111 0100: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:00001111:1111 0100:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:00001111:1111 0100: mod xmmreg r/m 


POR—Bitwise Or 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 1011: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1110 1011: mod xmmreg r/m 


PSADBW—Compute Sum of Absolute Differences 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1111 0110:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1111 0110: mod xmmreg r/m 


PSHUFLW—Shuffle Packed Low Words 


xmmreg2 to xmmreg1, imm8 


1111 0010:0000 1111:0111 0000:11 xmmreg1 xmmreg2: imm8 


mem to xmmreg, imm8 


1111 0010:0000 1111:0111 0000:11 mod xmmreg r/m: imm8 


PSHUFHW-—Shuffle Packed High Words 


xmmreg2 to xmmreg1, imm8 


1111 0011:0000 1111:0111 0000:11 xmmreg1 xmmreg2: imm8 


mem to xmmreg, imm8 


1111 0011:0000 1111:0111 0000: mod xmmreg r/m: imm8 


PSHUFD—Shuffle Packed Doublewords 
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Table B-27. Formats and Encodings of SSE2 Integer Instructions (Contd.) 


Instruction and Format 


Encoding 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0111 0000:11 xmmreg1 xmmreg2: imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0111 0000: mod xmmreg r/m: imm8 


PSLLDQ—Shift Double Quadword Left Logical 


xmmreg, imm8 


0110 0110:0000 1111:0111 0011:11 111 xmmreg: imm8 


PSLL—Packed Shift Left Logical 


xmmreg1 by xmmreg2 


0110 0110:0000 1111:1111 O0gg: 11 xmmreg1 xmmreg2 


xmmreg by memory 


0110 0110:0000 1111:1111 O0gg: mod xmmreg r/m 


xmmreg by immediate 


0110 0110:0000 1111:0111 O0gg: 11 110 xmmreg: imm8 


PSRA—Packed Shift Right Arithmetic 


xmmreg1 by xmmreg2 


0110 0110:0000 1111:1110 O0gg: 11 xmmreg1 xmmreg2 


xmmreg by memory 


0110 0110:0000 1111:1110 O0gg: mod xmmreg r/m 


xmmreg by immediate 


0110 0110:0000 1111:0111 O0gg: 11 100 xmmreg: imm8 


PSRLDQ—Shift Double Quadword Right Logical 


xmmreg, imm8 


0110 0110:00001111:01110011:11 011 xmmreg: imm8 


PSRL—Packed Shift Right Logical 


xmmreg1 by xmmreg2 


0110 0110:0000 1111:1101 O0gg: 11 xmmreg1 xmmreg2 


xmmreg by memory 


0110 0110:0000 1111:1101 O0gg: mod xmmreg r/m 


xmmreg by immediate 


0110 0110:0000 1111:0111 O0gg: 11 010 xmmreg: imm8 


PSUBQ—Subtract Packed Quadword Integers 


mmreg2 to mmreg1 


0000 1111:11111 011:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:1111 1011: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1111 1011:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:1111 1011: mod xmmreg r/m 


PSUB—Subtract With Wrap-around 


xmmreg2 from xmmreg1 


0110 0110:0000 1111:1111 10gg: 11 xmmreg1 xmmreg2 


memory from xmmreg 
PSUBS—Subtract Signed With Saturation 


0110 0110:0000 1111:1111 10gg: mod xmmreg r/m 


xmmreg2 from xmmreg1 


0110 0110:0000 1111:1110 10gg: 11 xmmreg1 xmmreg2 


memory from xmmreg 


0110 0110:0000 1111:1110 10gg: mod xmmreg r/m 


PSUBUS—Subtract Unsigned With Saturation 


xmmreg2 from xmmreg1 


0000 1111:1101 10gg: 11 xmmreg1 xmmreg2 


memory from xmmreg 


0000 1111:1101 10gg: mod xmmreg r/m 


PUNPCKH—Unpack High Data To Next Larger Type 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 10gg:11 xmmreg1 xmmreg2 


mem to xmmreg 
PUNPCKHQDQ—Unpack High Data 


0110 0110:0000 1111:0110 10gg: mod xmmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 1101:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0110 1101: mod xmmreg r/m 
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Table B-27. Formats and Encodings of SSE2 Integer Instructions (Contd.) 


Instruction and Format 


Encoding 


PUNPCKL—Unpack Low Data To Next Larger Type 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 00gg:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0110 O0gg: mod xmmreg r/m 


PUNPCKLQDQ—Unpack Low Data 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0110 1100:11 xmmreg1 xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0110 1100: mod xmmreg r/m 


PXOR—Bitwise Xor 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1110 1111: 11 xmmreg1 xmmreg2 


memory to xmmreg 


0110 0110:0000 1111:1110 1111: mod xmmreg r/m 


Table B-28. Format and Encoding of SSE2 Cacheability Instructions 


Instruction and Format 
MASKMOVDQU-Store Selected Bytes of Double Qua 


Encoding 
dword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:1111 0111:11 xmmreg1 xmmreg2 


CLFLUSH—Flush Cache Line 


mem 


0000 1111:1010 1110: mod 111 r/m 


MOVNTPD-—Store Packed Double-Precision Floating-Point Values Using Non-Temporal Hint 


xmmreg to mem 


0110 0110:0000 1111:0010 1011: mod xmmreg r/m 


MOVNTDQ-—Store Double Quadword Using Non-Temporal Hint 


xmmreg to mem 


0110 0110:0000 1111:1110 0111: mod xmmreg r/m 


reg to mem 


MOVNTI-—Store Doubleword Using Non-Temporal Hint 


0000 1111:1100 0011: mod reg r/m 


PAUSE—Spin Loop Hint 


1111 0011:1001 0000 


LFENCE—Load Fence 
MFENCE—Memory Fence 


0000 1111:1010 1110: 11 101 000 


0000 1111:1010 1110: 11 110 000 
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B.10 SSE3 FORMATS AND ENCODINGS TABLE 


The tables in this section provide SSE3 formats and encodings. Some SSE3 instructions require a mandatory prefix 
(66H, F2H, F3H) as part of the two-byte opcode. These prefixes are included in the tables. 


When in IA-32e mode, use of the REX.R prefix permits instructions that use general purpose and XMM registers to 
access additional registers. Some instructions require the REX.W prefix to promote the instruction to 64-bit opera- 
tion. Instructions that require the REX.W prefix are listed (with their opcodes) in Section B.13. 


Table B-29. Formats and Encodings of SSE3 Floating-Point Instructions 


Instruction and Format Encoding 
ADDSUBPD—Add /Sub packed DP FP numbers from XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 01100110:00001111:11010000:11 xmmreg1 xmmreg2 
mem to xmmreg 01100110:00001111:11010000: mod xmmreg r/m 
ADDSUBPS—Add /Sub packed SP FP numbers from XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 11110010:00001111:11010000:11 xmmreg1 xmmreg2 
mem to xmmreg 11110010:00001111:11010000: mod xmmreg r/m 
HADDPD—Add horizontally packed DP FP numbers XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 01100110:00001111:01111100:11 xmmreg1 xmmreg2 
mem to xmmreg 01100110:00001111:01111100: mod xmmreg r/m 
HADDPS—Add horizontally packed SP FP numbers XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 11110010:00001111:01111100:11 xmmreg1 xmmreg2 
mem to xmmreg 11110010:00001111:01111100: mod xmmreg r/m 
HSUBPD—Sub horizontally packed DP FP numbers XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 01100110:00001111:01111101:11 xmmreg1 xmmreg2 
mem to xmmreg 01100110:00001111:01111101: mod xmmreg r/m 
HSUBPS—Sub horizontally packed SP FP numbers XMM2/Mem to XMM1 
xmmreg2 to xmmreg1 11110010:00001111:01111101:11 xmmreg1 xmmreg2 
mem to xmmreg 11110010:00001111:01111101: mod xmmreg r/m 
Table B-30. Formats and Encodings for SSE3 Event Management Instructions 
Instruction and Format Encoding 
MONITOR—Set up a linear address range to be monitored by hardware 
eax, ecx, edx 0000 1111 : 0000 0001:11 001 000 
MWAIT—Wait until write-back store performed within the range specified by the instruction MONITOR 
eax, CX 0000 1111 : 0000 0001:11 001 001 


Table B-31. Formats and Encodings for SSE3 Integer and Move Instructions 


Instruction and Format Encoding 
FISTTP—Store ST in int16 (chop) and pop 
m1 6int 11011 111: mod‘ 001 r/m 
FISTTP—Store ST in int32 (chop) and pop 
m32int 11011 011: mod’ 001 r/m 
FISTTP—Store ST in int64 (chop) and pop 
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Table B-31. Formats and Encodings for SSE3 Integer and Move Instructions (Contd.) 


Instruction and Format 


Encoding 


m64int 11011 101 : mod‘ 001 r/m 
LDDQU—Load unaligned integer 128-bit 
xmm, m128 11110010:00001111:11110000: mod’ xmmreg r/m 


MOVDDUP—Move 64 bits representing one DP data from XM 


M2/Mem to XMM1 and duplicate 


xmmreg2 to xmmreg1 


11110010:00001111:00010010:11 xmmreg1 xmmreg2 


mem to xmmreg 


11110010:00001111:00010010: mod xmmreg r/m 


MOVSHDUP—Move 128 bits representing 4 SP data from XM 


M2/Mem to XMM1 and duplicate high 


xmmreg2 to xmmreg1 


1111001 1:00001111:00010110:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111001 1:00001111:00010110: mod xmmreg r/m 


MOVSLDUP—Move 128 bits representing 4 SP data from XMM2/Mem to XMM1 and duplicate low 


xmmreg2 to xmmreg1 


1111001 1:00001111:00010010:11 xmmreg1 xmmreg2 


mem to xmmreg 


1111001 1:00001111:00010010: mod xmmreg r/m 
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SSSE3 FORMATS AND ENCODING TABLE 


The tables in this section provide SSSE3 formats and encodings. Some SSSE3 instructions require a mandatory 
prefix (66H) as part of the three-byte opcode. These prefixes are included in the table below. 


Table B-32. Formats and Encodings for SSSE3 Instructions 


Instruction and Format 


Encoding 


PABSB—Packed Absolute Value Bytes 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0001 1100:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0001 1100: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0001 1100:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0001 1100: mod xmmreg r/m 


PABSD—Packed Absolute Value Double Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0001 1110:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0001 1110: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0001 1110:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0001 1110: mod xmmreg r/m 


PABSW—Packed Absolute Value Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0001 1101:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0001 1101: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0001 1101:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0001 1101: mod xmmreg r/m 


PALIGNR—Packed Align Right 


mmreg2 to mmreg1, imm8 


0000 1111:0011 1010: 0000 1111:11 mmreg1 mmreg2: imm8 
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Table B-32. Formats and Encodings for SSSE3 Instructions (Contd.) 


Instruction and Format 


Encoding 


mem to mmreg, imm8 


0000 1111:0011 1010: 0000 1111: mod mmreg r/m: imm8 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0011 1010: 0000 1111:11 xmmreg1 
xmmreg2: imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0000 1111: mod xmmreg r/m: 
imm8 


PHADDD—Packed Horizontal Add Double Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0010:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0010: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0010:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0010: mod xmmreg r/m 


PHADDSW—Packed Horizontal Add and Saturate 


mmreg2 to mmreg1 


mem to mmreg 


0000 1111:0011 1000: 0000 0011:11 mmreg1 mmreg2 
0000 1111:0011 1000: 0000 0011: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0011:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0011: mod xmmreg r/m 


PHADDW—Packed Horizontal Add Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0001:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0001: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0001:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0001: mod xmmreg r/m 


PHSUBD—Packed Horizontal Subtract Double Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0110:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0110: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0110:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0110: mod xmmreg r/m 


PHSUBSW—Packed Horizontal Subtract and Saturate 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0111:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0111: mod mmreg r/m 


xmmreg2 to xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0111:11 xmmreg1 
xmmreg2 


0110 0110:0000 1111:0011 1000: 0000 0111: mod xmmreg r/m 


PHSUBW—Packed Horizontal Subtract Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0101:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0101: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0101:11 xmmreg1 
xmmreg2 
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Table B-32. Formats and Encodings for SSSE3 Instructions (Contd.) 


Instruction and Format 


Encoding 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0101: mod xmmreg r/m 


PMADDUBSW—Multiply and Add Packed Signed and Unsigne 


d Bytes 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0100:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0100: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 0100:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 0100: mod xmmreg r/m 


PMULHRSW—Packed Multiply Hign with Round and Scale 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 1011:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 1011: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 1011:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 1011: mod xmmreg r/m 


PSHUFB—Packed Shuffle Bytes 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 0000:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 0000: mod mmreg r/m 


xmmreg2 to xmmreqg1 


0110 0110:0000 1111:0011 1000: 0000 0000:11 xmmreg1 
xmmreg2 


mem to xmmreg 
PSIGNB—Packed Sign Bytes 


0110 0110:0000 1111:0011 1000: 0000 0000: mod xmmreg r/m 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 1000:11 mmreg1 mmreg2 


mem to mmreg 


xmmreg2 to xmmreg1 


0000 1111:0011 1000: 0000 1000: mod mmreg r/m 


0110 0110:0000 1111:0011 1000: 0000 1000:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 1000: mod xmmreg r/m 


PSIGND—Packed Sign Double Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 1010:11 mmreg1 mmreg2 


mem to mmreg 


xmmreg2 to xmmreg1 


0000 1111:0011 1000: 0000 1010: mod mmreg r/m 


0110 0110:0000 1111:0011 1000: 0000 1010:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 1010: mod xmmreg r/m 


PSIGNW—Packed Sign Words 


mmreg2 to mmreg1 


0000 1111:0011 1000: 0000 1001:11 mmreg1 mmreg2 


mem to mmreg 


0000 1111:0011 1000: 0000 1001: mod mmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0000 1001:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0000 1001: mod xmmreg r/m 


B.12 


AESNI AND PCLMULQDQ INSTRUCTION FORMATS AND ENCODINGS 


Table B-33 shows the formats and encodings for AESNI and PCLMULQDQ instructions. 
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Table B-33. Formats and Encodings of AESNI and PCLMULQDQ Instructions 


Instruction and Format Encoding 
AE€SDEC—Perform One Round of an AES Decryption Flow 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000:1101 1110:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000:1101 1110: mod xmmreg r/m 
AESDECLAST—Perform Last Round of an AES Decryption Flow 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000:1101 1111:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000:1101 1111: mod xmmreg r/m 
AE€SENC—Perform One Round of an AES Encryption Flow 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000:1101 1100:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000:1101 1100: mod xmmreg r/m 
AESENCLAST—Perform Last Round of an AES Encryption Flow 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000:1101 1101:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000:1101 1101: mod xmmreg r/m 
AESIMC—Perform the AES InvMixColumn Transformation 
xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000:1101 1011:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000:1101 1011: mod xmmreg r/m 
AESKEYGENASSIST—AES Round Key Generation Assist 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010:1101 1111:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010:1101 1111: mod xmmreg r/m: 
imm8 
PCLMULQDQ—Carry-Less Multiplication Quadword 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010:0100 0100:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010:0100 0100: mod xmmreg r/m: 
imm8 


B.13. SPECIAL ENCODINGS FOR 64-BIT MODE 


The following Pentium, P6, MMX, SSE, SSE2, SSE3 instructions are promoted to 64-bit operation in IA-32e mode 
by using REX.W. However, these entries are special cases that do not follow the general rules (specified in Section 
B.4). 


Table B-34. Special Case Instructions Promoted Using REX.W 
Instruction and Format Encoding 
CMOVcc—Conditional Move 
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Table B-34. Special Case Instructions Promoted Using REX.W (Contd.) 


Instruction and Format 


Encoding 


register2 to register] 


0100 OROB 0000 1111: 0100 tttn: 11 reg1 reg2 


qwordregister2 to qwordregister1 


0100 1ROB 0000 1111: 0100 tttn: 11 qwordreg1 qwordreg2 


memory to register 


0100 ORXB 0000 1111 : 0100 tttn: mod reg r/m 


memory64 to qwordregister 


0100 1RXB 0000 1111 : 0100 tttn : mod qwordreg r/m 


CVTSD2SI—Convert Scalar Double-Precision Floating-Point Value to Doubleword Integer 


xmmreg to r32 


0100 OROB 1111 0010:0000 1111:0010 1101:11 r32 
xmmreg 


xmmreg to r64 


0100 1ROB 1111 0010:0000 1111:0010 1101:11 r64 
xmmreg 


mem64 to r32 


0100 OROXB 1111 0010:0000 1111:0010 1101: mod r32 r/m 


mem64 to r64 


0100 1RXB 1111 0010:0000 1111:0010 1101: mod r64 r/m 


CVTSI2SS—Convert Doubleword Integer to Scalar Single-Precision Floating-Point Value 


r32 to xmmreg1 


0100 OROB 1111 0011:0000 1111:0010 1010:11 xmmreg 
r32 


r64 to xmmreg1 


0100 1ROB 1111 0011:0000 1111:0010 1010:11 xmmreg 
r64 


mem to xmmreg 


0100 ORXB 1111 0011:0000 1111:0010 1010: mod xmmreg 
r/m 


mem64 to xmmreg 


0100 1RXB 1111 0011:0000 1111:0010 1010: mod xmmreg 
r/m 


CVTSI2SD—Convert Doubleword Integer to Scalar Double-Precis 


ion Floating-Point Value 


r32 to xmmreg1 


0100 OROB 1111 0010:0000 1111:0010 1010:11 xmmreg 
r32 


r64 to xmmreg1 


0100 1ROB 1111 0010:0000 1111:0010 1010:11 xmmreg 
r64 


mem to xmmreg 


0100 ORXB 1111 0010:0000 1111:00101 010: mod xmmreg 
r/m 


mem64 to xmmreg 


0100 1RXB 1111 0010:0000 1111:0010 1010: mod xmmreg 
r/m 


CVTSS2SI—Convert Scalar Single-Precision Floating-Point Value 


to Doubleword Integer 


xmmreg to r32 


xmmreg to r64 


0100 OROB 1111 0011:0000 1111:0010 1101:11 r32 
xmmreg 


0100 1ROB 1111 0011:0000 1111:0010 1101:11 r64 
xmmreg 


mem to r32 


0100 ORXB 11110011:00001111:00101101: mod r32 r/m 


mem32 to r64 


0100 1RXB 1111 0011:0000 1111:0010 1101: mod r64 r/m 


CVTTSD2SI—Convert with Truncation Scalar Double-Precision Floating-Point Value to Doubleword Integer 


xmmreg to r32 


0100 OROB 11110010:00001111:00101100:11 r32 xmmreg 


xmmreg to r64 


0100 1ROB 1111 0010:0000 1111:0010 1100:11 r64 
xmmreg 


mem64 to r32 


0100 ORXB 1111 0010:0000 1111:0010 1100: mod r32 r/m 


mem64 to r64 


0100 1RXB 1111 0010:0000 1111:0010 1100: mod r64 r/m 
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Table B-34. Special Case Instructions Promoted Using REX.W (Contd.) 


Instruction and Format Encoding 
CVTTSS2SI—Convert with Truncation Scalar Single-Precision Floating-Point Value to Doubleword Integer 
xmmreg to r32 0100 OROB 1111 0011:0000 1111:0010 1100:11 r32 
xmmreg1 
xmmreg to r64 0100 1ROB 1111 0011:0000 1111:0010 1100:11 r64 
xmmreg1 
mem to r32 0100 ORXB 1111 0011:0000 1111:0010 1100: mod r32 r/m 
mem32 to r64 0100 1RXB 1111 0011:0000 1111:0010 1100: mod r64 r/m 
MOVD/MOVQ—Move doubleword 
reg to mmxreg 0100 OROB 0000 1111:0110 1110: 11 mmxreg reg 
qwordreg to mmxreg 0100 1ROB 0000 1111:0110 1110: 11 mmxreg qwordreg 
reg from mmxreg 0100 OROB 0000 1111:0111 1110: 11 mmxreg reg 
qwordreg from mmxreg 0100 1ROB 0000 1111:0111 1110: 11 mmxreg qwordreg 
mem to mmxreg 0100 ORXB 0000 1111:0110 1110: mod mmxreg r/m 
mem64 to mmxreg 0100 1RXB 0000 1111:0110 1110: mod mmxreg r/m 
mem from mmxreg 0100 ORXB 0000 1111:0111 1110: mod mmxreg r/m 
mem64 from mmxreg 0100 1RXB 0000 1111:0111 1110: mod mmxreg r/m 
mmxreg with memory 0100 ORXB 0000 1111:0110 01gg: mod mmxreg r/m 
MOVMSKPS—Extract Packed Single-Precision Floating-Point Sign Mask 
xmmreg to r32 0100 OROB 0000 1111:0101 0000:11 r32 xmmreg 
xmmreg to r64 0100 1ROB 00001111:01010000:11 r64 xmmreg 
PEXTRW—Extract Word 
mmreg to reg32, imm8 0100 OROB 0000 1111:1100 0101:11 r32 mmreg: imm8 
mmreg to reg64, imm8 0100 1ROB 0000 1111:1100 0101:11 r64 mmreg: imm8 
xmmreg to reg32, imm8 0100 OROB 0110 0110 0000 1111:1100 0101:11 r32 
xmmreg: imm8 
xmmreg to reg64, imm8 0100 1ROB 0110 0110 0000 1111:1100 0101:11 r64 
xmmreg: imm8 
PINSRW—Insert Word 
reg32 to mmreg, imm8 0100 OROB 0000 1111:1100 0100:11 mmreg r32: imm8 
reg64 to mmreg, imm8 0100 1ROB 0000 1111:1100 0100:11 mmreg r64: imm8 
m16 to mmreg, imm8 0100 OROB 0000 1111:1100 0100 mod mmreg r/m: imm8 
m16 to mmreg, imm8 0100 1RXB 0000 1111:11000100 mod mmreg r/m: imm8 
reg32 to xmmreg, imm8 0100 ORXB 0110 0110 0000 1111:1100 0100:11 xmmreg 
r32: imm8 
reg64 to xmmreg, imm8 0100 ORXB 0110 0110 0000 1111:1100 0100:11 xmmreg 
r64: imm8 
m16 to xmmreg, imm8 0100 ORXB 0110 0110 0000 1111:1100 0100 mod xmmreg 
r/m: imm8s 
m16 to xmmreg, imm8 0100 1RXB 0110 0110 0000 1111:1100 0100 mod xmmreg 
r/m: imm8 


PMOVMSKB—Move Byte Mask To Integer 
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Table B-34. Special Case Instructions Promoted Using REX.W (Contd.) 


Instruction and Format 


Encoding 


mmreg to reg32 


0100 ORXB 0000 1111:1101 0111:11 r32 mmreg 


mmreg to reg64 


0100 1ROB 0000 1111:1101 0111:11 r64 mmreg 


xmmreg to reg32 


0100 ORXB 0110 0110 0000 1111:1101 0111:11 r32 mmreg 


xmmreg to reg64 


01100110 0000 1111:1101 0111:11 r64 xmmreg 


B.14 SSE4.1 FORMATS AND ENCODING TABLE 


The tables in this section provide SSE4.1 formats and encodings. Some SSE4.1 instructions require a mandatory 
prefix (66H, F2H, F3H) as part of the three-byte opcode. These prefixes are included in the tables. 


In 64-bit mode, some instructions requires REX.W, the byte sequence of REX.W prefix in the opcode sequence is 


shown. 


Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format 


Encoding 


BLENDPD — Blend Packed Double-Precision Floats 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1010: 0000 1101:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1010: 0000 1101: mod xmmreg r/m 


BLENDPS — Blend Packed Single-Precision Floats 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1010: 0000 1100:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1010: 0000 1100: mod xmmreg r/m 


BLENDVPD — Variable Blend Packed Double-Precision Floats 


xmmreg2 to xmmreg1 <xmmO> 


0110 0110:0000 1111:0011 1000: 0001 0101:11 xmmreg1 
xmmreg2 


mem to xmmreg <xmmO0> 


0110 0110:0000 1111:0011 1000: 0001 0101: mod xmmreg r/m 


BLENDVPS — Variable Blend Packed Single-Precision Floats 


xmmreg2 to xmmreg1 <xmmO0> 


0110 0110:0000 1111:0011 1000: 0001 0100:11 xmmreg1 
xmmreg2 


mem to xmmreg <xmmO0> 


0110 0110:0000 1111:0011 1000: 0001 0100: mod xmmreg r/m 


DPPD — Packed Double-Precision Dot Products 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0011 1010: 0100 0001:11 xmmreg1 
xmmreg2: imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0100 0001: mod xmmreg r/m: 
imm8 


DPPS — Packed Single-Precision Dot Products 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0011 1010: 0100 0000:11 xmmreg1 
xmmreg2: imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0100 0000: mod xmmreg r/m: 
imm8 


EXTRACTPS — Extract From Packed Single-Precision Floats 


reg from xmmreg , imm8 


0110 0110:0000 1111:0011 1010: 0001 0111:11 xmmreg reg: 
imm8 
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Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format Encoding 
mem from xmmreg , imm8 0110 0110:0000 1111:0011 1010: 0001 0111: mod xmmreg r/m: 
imm8 


INSERTPS — Insert Into Packed Single-Precision Floats 


xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0010 0001:11 xmmreg1 
xmmreg2: imm8 

mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0010 0001: mod xmmreg r/m: 
imm8 


MOVNTDQA — Load Double Quadword Non-temporal Aligned 


m128 to xmmreg 0110 0110:0000 1111:0011 1000: 0010 1010:11 r/m xmmreg2 
MPSADBW — Multiple Packed Sums of Absolute Difference 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0100 0010:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0100 0010: mod xmmreg r/m: 
imm8 


PACKUSDW — Pack with Unsigned Saturation 


xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000: 0010 1011:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000: 0010 1011: mod xmmreg r/m 
PBLENDVB — Variable Blend Packed Bytes 
xmmreg2 to xmmreg1 <xmm0> 0110 0110:0000 1111:0011 1000: 0001 0000:11 xmmreg1 
xmmreg2 
mem to xmmreg <xmm0> 0110 0110:0000 1111:0011 1000: 0001 0000: mod xmmreg r/m 
PBLENDW — Blend Packed Words 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0001 1110:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0000 1110: mod xmmreg r/m: 
imm8 


PCMPEQQ — Compare Packed Qword Data of Equal 


xmmreg2 to xmmreg1 0110 0110:0000 1111:0011 1000: 0010 1001:11 xmmreg1 
xmmreg2 
mem to xmmreg 0110 0110:0000 1111:0011 1000: 0010 1001: mod xmmreg r/m 


PEXTRB — Extract Byte 


reg from xmmreg , imm8 0110 0110:0000 1111:0011 1010: 0001 0100:11 xmmreg reg: 
imm8 

xmmreg to mem, imm8 0110 0110:0000 1111:0011 1010: 0001 0100: mod xmmreg r/m: 
imm8 


PEXTRD — Extract DWord 


reg from xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0001 0110:11 xmmreg reg: 
imm8 
xmmreg to mem, imm8 0110 0110:0000 1111:0011 1010: 0001 0110: mod 


xmmreg r/m: imm8 
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Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format 


Encoding 


PEXTRQ — Extract QWord 


r64 from xmmreg, imm8 


0110 0110:REX.W:0000 1111:0011 1010: 0001 0110:11 xmmreg 
reg: imm8 


m64 from xmmreg, imm8 


0110 0110:REX.W:0000 1111:0011 1010: 0001 0110: mod 
xmmreg r/m: imm8 


PEXTRW — Extract Word 


reg from xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0001 0101:11 reg xmmreg: 
imm8 


mem from xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0001 0101: mod xmmreg r/m: 
imm8 


PHMINPOSUW — Packed Horizontal Word Minimum 


xmmreg2 to xmmreqg1 


0110 0110:0000 1111:0011 1000: 0100 0001:11 xmmreg1 
xmmreg2 


mem to xmmreg 
PINSRB — Extract Byte 


0110 0110:0000 1111:0011 1000: 0100 0001: mod xmmreg r/m 


reg to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0010 0000:11 xmmreg reg: 
imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0010 0000: mod xmmreg r/m: 
imm8 


PINSRD — Extract DWord 


reg to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0010 0010:11 xmmreg reg: 
imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0010 0010: mod xmmreg r/m: 
imm8 


PINSRQ — Extract QWord 


r64 to xmmreg, imm8 


0110 0110:REX.W:0000 1111:0011 1010:0010 0010:11 xmmreg 
reg: imm8 


m64 to xmmreg, imm8 


0110 0110:REX.W:0000 1111:0011 1010: 0010 0010: mod 
xmmreg r/m: imm8 


PMAXSB — Maximum of Packed Signed Byte Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0011 1100:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0011 1100: mod xmmreg r/m 


PMAXSD — Maximum of Packed Signed Dword Integers 


xmmreg2 to xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0011 1101:11 xmmreg1 
xmmreg2 


0110 0110:0000 1111:0011 1000: 0011 1101: mod xmmreg r/m 


PMAXUD — Maximum of Packed Unsigned Dword Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 1000: 0011 1111:11 xmmreg1 
xmmreg2 


mem to xmmreg 


0110 0110:0000 1111:0011 1000: 0011 1111: mod xmmreg r/m 


PMAXUW — Maximum of Packed Unsigned Word Integers 
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Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format 


Encoding 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 1110:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 1110: mod xmmreg r/m 


PMINSB — Minimum of Packed Signed Byte Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 1000:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 1000: mod xmmreg r/m 


PMINSD — Minimum of Packed Signed Dword Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 1001:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 1001: mod xmmreg r/m 


PMINUD — Minimum of Packed Unsigned Dword Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 1011:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 1011: mod xmmreg r/m 


PMINUW — Minimum of Packed Unsigned Word Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 1010:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 1010: mod xmmreg r/m 


PMOVSXBD — Packed Move Sign Extend - Byte to Dword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0010 0001:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 0001: mod xmmreg r/m 


PMOVSXBQ — Packed Move Sign Extend - Byte to Qword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0010 0010:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 0010: mod xmmreg r/m 


PMOVSXBW — Packed Move Sign Extend - Byte to Word 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0010 0000:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 0000: mod xmmreg r/m 


PMOVSXWD — Packed Move Sign Extend - Word to Dword 


xmmreg2 to xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 
xmmreg2 


0110 0110:0000 1111:0011 


1000: 0010 0011:11 xmmreg1 


1000: 0010 0011: mod xmmreg r/m 


PMOVSXWQ — Packed Move Sign Extend - Word to Qword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0010 0100:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 0100: mod xmmreg r/m 


PMOVSXDQ — Packed Move Sign Extend - Dword to Qword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0010 0101:11 xmmreg1 


Vol.2D B-67 


INSTRUCTION FORMATS AND ENCODINGS 


Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format 


Encoding 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 0101: 


mod xmmreg r/m 


PMOVZXBD — Packed Move Zero Extend - Byte to Dword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0011 0001:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 0001: 


mod xmmreg r/m 


PMOVZXBQ — Packed Move Zero Extend - Byte to Qword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0011 0010:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 0010: 


mod xmmreg r/m 


PMOVZXBW — Packed Move Zero Extend - Byte to Word 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0011 0000:11 xmmreg1 


mem to xmmreg 
PMOVZXWD — Packed Move Zero Extend - Word to Dword 


0110 0110:0000 1111:0011 


1000: 0011 0000: 


mod xmmreg r/m 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0011 0011:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 0011: 


mod xmmreg r/m 


PMOVZXWQ — Packed Move Zero Extend - Word to Qword 


xmmreg2 to xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


xmmreg2 


0110 0110:0000 1111:0011 


1000: 0011 0100:11 xmmreg1 


1000: 0011 0100: 


mod xmmreg r/m 


PMOVZXDQ — Packed Move Zero Extend - Dword to Qword 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0011 0101:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0011 0101: 


mod xmmreg r/m 


PMULDQ — Multiply Packed Signed Dword Integers 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0010 1000:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0010 1000: 


mod xmmreg r/m 


PMULLD — Multiply Packed Signed Dword Integers, Store low Result 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0100 0000:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0100 0000: 


mod xmmreg r/m 


PTEST — Logical Compare 


xmmreg2 to xmmreg1 


0110 0110:0000 1111:0011 


xmmreg2 


1000: 0001 0111:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1000: 0001 0111: 


mod xmmreg r/m 


ROUNDPD — Round Packed Double-Precision Values 


xmmreg2 to xmmreg1, imm8 


mem to xmmreg, imm8 


0110 0110:0000 1111:0011 1010: 0000 1001:11 xmmreg1 


xmmreg2: imm8 


0110 0110:0000 1111:0011 1010: 0000 1001: 


imms 


mod xmmreg r/m: 
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Table B-35. Encodings of SSE4.1 instructions 


Instruction and Format Encoding 
ROUNDPS — Round Packed Single-Precision Values 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0000 1000:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0000 1000: mod xmmreg r/m: 
imm8 
ROUNDSD — Round Scalar Double-Precision Value 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0000 1011:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0000 1011: mod xmmreg r/m: 
imm8 


ROUNDSS — Round Scalar Single-Precision Value 


xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0000 1010:11 xmmreg1 
xmmreg2: imm8 

mem to xmmreg, imm8 0110 0110:0000 1111:0011 1010: 0000 1010: mod xmmreg r/m: 
imm8 


B.15  SSE4.2 FORMATS AND ENCODING TABLE 


The tables in this section provide SSE4.2 formats and encodings. Some SSE4.2 instructions require a mandatory 
prefix (66H, F2H, F3H) as part of the three-byte opcode. These prefixes are included in the tables. In 64-bit mode, 
some instructions requires REX.W, the byte sequence of REX.W prefix in the opcode sequence is shown. 


Table B-36. Encodings of SSE4.2 instructions 


Instruction and Format Encoding 
CRC32 — Accumulate CRC32 
reg2 to reg! 1111 0010:0000 1111:0011 1000: 1111 O00w :11 reg] reg2 
mem to reg 1111 0010:0000 1111:0011 1000: 1111 O00w: mod reg r/m 
bytereg2 to reg! 1111 0010:0100 WROB:0000 1111:0011 1000: 1111 0000 :11 
reg1 bytereg2 
m8 to reg 1111 0010:0100 WROB:0000 1111:0011 1000: 1111 0000: mod 
reg r/m 
qwreg2 to qwreg1 1111 0010:0100 1ROB:0000 1111:0011 1000: 1111 0001 :11 
qwreg1 qwreg2 
mem64 to qwreg 1111 0010:0100 1ROB:0000 1111:0011 1000: 1111 0001 : mod 
qwreg r/m 
PCMPESTRI— Packed Compare Explicit-Length Strings To Index 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0110 0001:11 xmmreg1 
xmmreg2: imm8 
mem to xmmreg 0110 0110:0000 1111:0011 1010: 0110 0001: mod xmmreg r/m 
PCMPESTRM— Packed Compare Explicit-Length Strings To Mask 
xmmreg2 to xmmreg1, imm8 0110 0110:0000 1111:0011 1010: 0110 0000:11 xmmreg1 
xmmreg2: imm8 
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Table B-36. Encodings of SSE4.2 instructions 


Instruction and Format 


Encoding 


mem to xmmreg 


0110 0110:0000 1111:0011 


1010: 0110 0000: mod xmmreg r/m 


PCMPISTRI— Packed Compare Implicit-Length String To Index 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0011 
xmmreg2: imm8 


1010: 0110 0011:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1010: 0110 0011: mod xmmreg r/m 


PCMPISTRM— Packed Compare Implicit-Length Strings To Mask 


xmmreg2 to xmmreg1, imm8 


0110 0110:0000 1111:0011 
xmmreg2: imm8 


1010: 0110 0010:11 xmmreg1 


mem to xmmreg 


0110 0110:0000 1111:0011 


1010: 0110 0010: mod xmmreg r/m 


PCMPGTQ— Packed Compare Greater Than 


xmmreg to xmmreg 


0110 0110:0000 1111:0011 
xmmreg2 


1000: 0011 0111:11 xmmreg1 


mem to xmmreg 
POPCNT— Return Number of Bits Set to 1 


0110 0110:0000 1111:0011 


1000: 0011 0111: mod xmmreg r/m 


reg2 to reg] 


1111 0011:0000 1111:1011 


1000:11 reg1 reg2 


mem to reg1 


qwreg2 to qwreg1 


1111 0011:0000 1111:1011 


1000:mod reg1 r/m 


1111 0011:0100 1ROB:0000 1111:1011 1000:11 regi reg2 


mem64 to qwreg] 


1111 0011:0100 1ROB:0000 1111:1011 1000:mod reg1 r/m 
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AVX FORMATS AND ENCODING TABLE 


The tables in this section provide AVX formats and encodings. A mixed form of bit/hex/symbolic forms are used to 


express the various bytes: 


The C4/C5 and opcode bytes are expressed in hex notation; the first and second payload byte of VEX, the modR/M 
byte is expressed in combination of bit/symbolic form. The first payload byte of C4 is expressed as combination of 
bits and hex form, with the hex value preceded by an underscore. The VEX bit field to encode upper register 8-15 
uses 1’s complement form, each of those bit field is expressed as lower case notation rxb, instead of RXB. 


The hybrid bit-nibble-byte form is depicted below: 


hex notation 76----3210 hex notation 7-6 5-3 2-0 
cS R srcreg Lp p Opcode byte Mod Reg* R/M 
Two-Byte VEX 
765 4----- (0) 76----3210 hex notation 7-6 5-3 2-0 
C4 RXB O_hex W srcreg L pp Opcode byte Mod Reg R/M 
a; 
mmmmm 


Three-Byte VEX 


Figure B-2. Hybrid Notation of VEX-Encoded Key Instruction Bytes 
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Table B-37. Encodings of AVX instructions 


Instruction and Format 


Encoding 


VBLENDPD — Blend Packed Double-Precision Floats 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxb0_3: w xmmreg2 001:0D:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_3: w xmmreg2 001:0D:mod xmmreg1 r/m: imm 


ymmreg2 with ymmreg3 into ymmreg1 


C4: rxb0_3: w ymmreg2 101:0D:11 ymmreg1 ymmreg3: imm 


ymmreg2 with mem to ymmreg1 


C4: rxbO_3: w ymmreg2 101:0D:mod ymmreg1 r/m: imm 


VBLENDPS — Blend Packed Single-Precision Floats 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:0C:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxb0_3: w xmmreg2 001:0C:mod xmmreg1 r/m: imm 


ymmreg2 with ymmreg3 into ymmreg1 


C4: rxb0_3: w ymmreg2 101:0C:11 ymmreg1 ymmreg3: imm 


ymmreg2 with mem to ymmreg1 


C4: rxb0_3: w ymmreg2 101:0C:mod ymmreg1 r/m: imm 


VBLENDVPD — Variable Blend Packed Double-Precision Floats 


xmmreg2 with xmmreg3 into xmmreg1 using xmmreg4 as 
mask 


C4: rxbO_3: 0 xmmreg2 001:4B:11 xmmreg1 xmmreg3: xmmreg4 


xmmreg2 with mem to xmmreg1 using xmmreg4 as mask 


C4: rxb0_3: O xmmreg2 001:4B:mod xmmreg1 r/m: xmmreg4 


ymmreg2 with ymmreg3 into ymmreg1 using ymmreg4 as 
mask 


C4: rxbO_3: 0 ymmreg2 101:4B:11 ymmreg1 ymmreg3: ymmreg4 


ymmreg2 with mem to ymmreg1 using ymmreg4 as mask 


C4: rxb0_3: 0 ymmreg2 101:4B:mod ymmreg1 r/m: ymmreg4 


VBLENDVPS — Variable Blend Packed Single-Precision Floats 


xmmreg2 with xmmreg3 into xmmreg1 using xmmreg4 as 
mask 


C4: rxbO_3: 0 xmmreg2 001:4A:11 xmmreg1 xmmreg3: xmmreg4 


xmmreg2 with mem to xmmreg1 using xmmreg4 as mask 


C4: rxbO_3: 0 xmmreg2 001:4A:mod xmmreg1 r/m: xmmreg4 


ymmreg2 with ymmreg3 into ymmreg1 using ymmreg4 as 
mask 


C4: rxbO_3: 0 ymmreg2 101:4A:11 ymmreg1 ymmreg3: ymmreg4 


ymmreg2 with mem to ymmreg1 using ymmreg4 as mask 


C4: rxb0_3: 0 ymmreg2 101:4A:mod ymmreg1 r/m: ymmreg4 


VDPPD — Packed Double-Precision Dot Products 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:41:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_3: w xmmreg2 001:41:mod xmmreg1 r/m: imm 


VDPPS — Packed Single-Precision Dot Products 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:40:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_3: w xmmreg2 001:40:mod xmmreg1 r/m: imm 


ymmreg2 with ymmreg3 into ymmreg1 


ymmreg2 with mem to ymmreg1 


C4: rxbO_3: w ymmreg2 101:40:11 ymmreg1 ymmreg3: imm 
C4: rxb0_3: w ymmreg2 101:40:mod ymmreg1 r/m: imm 


VEXTRACTPS — Extract From Packed Single-Precision Floats 


reg from xmmreqg1 using imm 


mem from xmmreg1 using imm 


C4: rxbO_3: w_F 001:17:11 xmmreg1 reg: imm 
C4: rxbO_3: w_F 001:17:mod xmmreg1 r/m: imm 


VINSERTPS — Insert Into Packed Single-Precision Floats 


use imm to merge xmmreg3 with xmmreg2 into xmmreg1 


C4: rxb0_3: w xmmreg2 001:21:11 xmmreg1 xmmreg3: imm 


use imm to merge mem with xmmreg2 into xmmreg1 


C4: rxb0_3: w xmmreg2 001:21:mod xmmreg1 r/m: imm 


VMOVNTDQA — Load Double Quadword Non-temporal Aligned 


m128 to xmmreg1 


C4: rxbO_2: w_F 001:2A:11 xmmreg1 r/m 
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Instruction and Format 


Encoding 


VMPSADBW — Multiple Packed Sums of Absolute Difference 


xmmreg3 with xmmreg2 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:42:11 xmmreg1 xmmreg3: imm 


m128 with xmmreg2 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:42:mod xmmreg1 r/m: imm 


VPACKUSDW — Pack with Unsigned Saturation 


xmmreg3 and xmmreg2 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:2B:11 xmmreg1 xmmreg3: imm 


m128 and xmmreg2 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:2B:mod xmmreg1 r/m: imm 


VPBLENDVB — Variable Blend Packed Bytes 


xmmreg2 with xmmreg3 into xmmreg1 using xmmreg4 as 
mask 


C4: rxbO_3: w xmmreg2 001:4C:11 xmmreg1 xmmreg3: xmmreg4 


xmmreg2 with mem to xmmreg1 using xmmreg4 as mask 


C4: rxbO_3: w xmmreg2 001:4C:mod xmmreg1 r/m: xmmreg4 


VPBLENDW — Blend Packed Words 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_3: w xmmreg2 001:0E:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_3: w xmmreg2 001:0E:mod xmmreg1 r/m: imm 


VPCMPEQQ — Compare Packed Qword Data of Equal 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_2: w xmmreg2 001:29:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:29:mod xmmreg1 r/m: 


VPEXTRB — Extract Byte 


reg from xmmreg1 using imm 


C4: rxbO_3: O_F 001:14:11 xmmreg1 reg: imm 


mem from xmmreg1 using imm 


C4: rxbO_3: O_F 001:14:mod xmmreg1 r/m: imm 


VPEXTRD — Extract DWord 


reg from xmmreg1 using imm 


C4: rxbO_3: O_F 001:16:11 xmmreg1 reg: imm 


mem from xmmreqg1 using imm 


C4: rxbO_3: O_F 001:16:mod xmmreg1 r/m: imm 


VPEXTRQ — Extract QWord 


reg from xmmreg1 using imm 


C4: rxbO_3: 1_F 001:16:11 xmmreg1 reg: imm 


mem from xmmreg1 using imm 


C4: rxbO_3: 1_F 001:16:mod xmmreg1 r/m: imm 


VPEXTRW — Extract Word 


reg from xmmreg1 using imm 


mem from xmmreg1 using imm 


C4: rxbO_3: O_F 001:15:11 xmmreg1 reg: imm 
C4: rxbO0_3: O_F 001:15:mod xmmreg1 r/m: imm 


VPHMINPOSUW — Packed Horizontal Word Minimum 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:41:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:41:mod xmmreg1 r/m 


VPINSRB — Insert Byte 


reg with xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: O xmmreg2 001:20:11 xmmreg1 reg: imm 


mem with xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: O xmmreg2 001:20:mod xmmreg1 r/m: imm 


VPINSRD — Insert DWord 


reg with xmmreg2 to xmmreg1, imm8 


mem with xmmreg2 to xmmreg1, imm8 


C4: rxbO0_3: 0 xmmreg2 001:22:11 xmmreg1 reg: imm 
C4: rxbO_3: 0 xmmreg2 001:22:mod xmmreg1 r/m: imm 


VPINSRQ — Insert QWord 


r64 with xmmreg2 to xmmreg1, imm8 
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Instruction and Format 


Encoding 


m64 with xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: 1 xmmreg2 001:22:mod xmmreg1 r/m: imm 


VPMAXSB — Maximum of Packed Signed Byte Integers 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_2: w xmmreg2 001:3C:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3C:mod xmmreg1 r/m 


VPMAXSD — Maximum of Packed Signed Dword Integers 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_2: w xmmreg2 001:3D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3D:mod xmmreg1 r/m 


VPMAXUD — Maximum of Packed Unsigned Dword Integers 


xmmreg2 with xmmreg3 into xmmreg1 


C4: rxbO_2: w xmmreg2 001:3F:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3F:mod xmmreg1 r/m 


VPMAXUW — Maximum of Packed Unsigned Word Integers 


xmmreg2 with xmmreg3 into xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3€:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:3E:mod xmmreg1 r/m 


VPMINSB — Minimum of Packed Signed Byte Integers 


xmmreg2 with xmmreg3 into xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:38:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:38:mod xmmreg1 r/m 


VPMINSD — Minimum of Packed Signed Dword Integers 


xmmreg2 with xmmreg3 into xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:39:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:39:mod xmmreg1 r/m 


VPMINUD — Minimum of Packed Unsigned Dword Integers 


xmmreg2 with xmmreg3 into xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3B:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:3B:mod xmmreg1 r/m 


VPMINUW — Minimum of Packed Unsigned Word Integers 


xmmreg2 with xmmreg3 into xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:3A:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:3A:mod xmmreg1 r/m 


VPMOVSXBD — Packed Move Sign Extend - Byte to Dword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:21:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:21:mod xmmreg1 r/m 


VPMOVSXBQ — Packed Move Sign Extend - Byte to Qword 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:22:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:22:mod xmmreg1 r/m 


VPMOVSXBW — Packed Move Sign Extend - Byte to Word 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:20:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:20:mod xmmreg1 r/m 


VPMOVSXWD — Packed Move Sign Extend - Word to Dword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:23:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:23:mod xmmreg1 r/m 


VPMOVSXWQ — Packed Move Sign Extend - Word to Qword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:24:11 xmmreg1 xmmreg2 
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Instruction and Format 


Encoding 


mem to xmmreg1 


C4: rxbO_2: w_F 001:24:mod xmmreg1 r/m 


VPMOVSXDQ — Packed Move Sign Extend - Dword to Qword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:25:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:25:mod xmmreg1 r/m 


VPMOVZXBD — Packed Move Zero Extend - Byte to Dword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:31:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:31:mod xmmreg1 r/m 


VPMOVZXBQ — Packed Move Zero Extend - Byte to Qword 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:32:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:32:mod xmmreg1 r/m 


VPMOVZXBW — Packed Move Zero Extend - Byte to Word 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:30:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:30:mod xmmreg1 r/m 


VPMOVZXWD — Packed Move Zero Extend - Word to Dword 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:33:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:33:mod xmmreg1 r/m 


VPMOVZXWQ — Packed Move Zero Extend - Word to Qword 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:34:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:34:mod xmmreg1 r/m 


VPMOVZXDQ — Packed Move Zero Extend - Dword to Qword 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:35:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:35:mod xmmreg1 r/m 


VPMULDQ — Multiply Packed Signed Dword Integers 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:28:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:28:mod xmmreg1 r/m 


VPMULLD — Multiply Packed Signed Dword Integers, Store low Result 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:40:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:40:mod xmmreg1 r/m 


VPTEST — Logical Compare 


xmmreg2 to xmmreg1 


mem to xmmreg 


C4: rxbO_2: w_F 001:17:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:17:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxbO_2: w_F 101:17:11 ymmreg1 ymmreg2 


mem to ymmreg 
VROUNDPD — Round Packed Double-Precision Values 


C4: rxbO_2: w_F 101:17:mod ymmreg1 r/m 


xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: w_F 001:09:11 xmmreg1 xmmreg2: imm 


mem to xmmreg1, imm8 


C4: rxb0_3: w_F 001:09:mod xmmreg1 r/m: imm 


ymmreg2 to ymmreg1, imm8 


C4: rxbO_3: w_F 101:09:11 ymmreg1 ymmreg2: imm 


mem to ymmreg1, imm8 


C4: rxbO_3: w_F 101:09:mod ymmreg1 r/m: imm 


VROUNDPS — Round Packed Single-Precision Values 


B-74 Vol. 2D 


INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format 


Encoding 


xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: w_F 001:08:11 xmmreg1 xmmreg2: imm 


mem to xmmreg1, imm8 


C4: rxbO_3: w_F 001:08:mod xmmreg1 r/m: imm 


ymmreg2 to ymmreg1, imm8 


C4: rxbO_3: w_F 101:08:11 ymmreg1 ymmreg2: imm 


mem to ymmreg1, imm8 


C4: rxbO_3: w_F 101:08:mod ymmreg1 r/m: imm 


VROUNDSD — Round Scalar Double-Precision Value 


xmmreg2 and xmmreg3 to xmmreg1, imm8 


C4: rxbO_3: w xmmreg2 001:0B:11 xmmreg1 xmmreg3: imm 


xmmreg2 and mem to xmmreg1, imm8 


C4: rxbO_3: w xmmreg2 001:0B:mod xmmreg1 r/m: imm 


VROUNDSS — Round Scalar Single-Precision Value 


xmmreg2 and xmmreg3 to xmmreg1, imm8 


C4: rxbO0_3: w xmmreg2 001:0A:11 xmmreg1 xmmreg3: imm 


xmmreg2 and mem to xmmreg1, imm8 


C4: rxbO_3: w xmmreg2 001:0A:mod xmmreg1 r/m: imm 


VPCMPESTRI — Packed Compare Explicit Length Strings, Ret 


urn Index 


xmmreg2 with xmmreg1, imm8 


mem with xmmreg1, imm8 


C4: rxbO_3: w_F 001:61:11 xmmreg1 xmmreg2: imm 
C4: rxbO_3: w_F 001:61:mod xmmreg1 r/m: imm 


VPCMPESTRM — Packed Compare Explicit Length Strings, Return Mask 


xmmreg2 with xmmreg1, imm8 


mem with xmmreg1, imm8 


C4: rxbO_3: w_F 001:60:11 xmmreg1 xmmreg2: imm 
C4: rxbO_3: w_F 001:60:mod xmmreg1 r/m: imm 


VPCMPGTQ — Compare Packed Data for Greater Than 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:28:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:28:mod xmmreg1 r/m 


VPCMPISTRI — Packed Compare Implicit Length Strings, Return Index 


xmmreg2 with xmmreg1, imm8 


mem with xmmreg1, imm8 


C4: rxbO_3: w_F 001:63:11 xmmreg1 xmmreg2: imm 
C4: rxbO_3: w_F 001:63:mod xmmreg1 r/m: imm 


VPCMPISTRM — Packed Compare Implicit Length Strings, Return Mask 


xmmreg2 with xmmreg1, imm8 


mem with xmmreg, imm8 


C4: rxbO_3: w_F 001:62:11 xmmreg1 xmmreg2: imm 
C4: rxbO_3: w_F 001:62:mod xmmreg1 r/m: imm 


VAESDEC — Perform One Round of an AES Decryption Flow 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DE:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DE:mod xmmreg1 r/m 


VAESDECLAST — Perform Last Round of an AES Decryption Flow 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DF:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:DF:mod xmmreg1 r/m 


VAESENC — Perform One Round of an AES Encryption Flow 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DC:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:DC:mod xmmreg1 r/m 


VAESENCLAST — Perform Last Round of an AES Encryption Flow 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DD:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:DD:mod xmmreg1 r/m 


VAESIMC — Perform the AES InvMixColumn Transformation 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:DB:11 xmmreg1 xmmreg2 


Vol.2D B-75 


INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format 


Encoding 


mem to xmmreg1 


C4: rxbO_2: w_F 001:DB:mod xmmreg1 r/m 


VAESKEYGENASSIST — AES Round Key Generation Assist 


xmmreg2 to xmmreg1, imm8 


C4: rxbO_3: w_F 001:DF:11 xmmreg1 xmmreg2: imm 


mem to xmmreg, imm8 


C4: rxbO_3: w_F 001:DF:mod xmmreg1 r/m: imm 


VPABSB — Packed Absolute Value 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:1C:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:1C:mod xmmreg1 r/m 


VPABSD — Packed Absolute Value 


xmmreg2 to xmmreg1 


C4: rxbO_2: w_F 001:1€:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_2: w_F 001:1E:mod xmmreg1 r/m 


VPABSW — Packed Absolute Value 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_2: w_F 001:1D:11 xmmreg1 xmmreg2 
C4: rxbO_2: w_F 001:1D:mod xmmreg1 r/m 


VPALIGNR — Packed Align Right 


xmmreg2 with xmmreg3 to xmmreg1, imm8 


xmmreg2 with mem to xmmreg1, imm8 


C4: rxbO_3: w xmmreg2 001:DD:11 xmmreg1 xmmreg3: imm 


C4: rxbO_3: w xmmreg2 001:DD:mod xmmreg1 r/m: imm 


VPHADDD — Packed Horizontal Add 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:02:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:02:mod xmmreg1 r/m 


VPHADDW — Packed Horizontal Add 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:01:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:01:mod xmmreg1 r/m 


VPHADDSW — Packed Horizontal Add and Saturate 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:03:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:03:mod xmmreg1 r/m 


VPHSUBD — Packed Horizontal Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:06:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:06:mod xmmreg1 r/m 


VPHSUBW — Packed Horizontal Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:05:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:05:mod xmmreg1 r/m 


VPHSUBSW — Packed Horizontal Subtract and Saturate 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:07:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:07:mod xmmreg1 r/m 


VPMADDUBSW — Multiply and Add Packed Signed and Unsigned Bytes 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:04:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:04:mod xmmreg1 r/m 


VPMULHRSW — Packed Multiply High with Round and Scale 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:0B:11 xmmreg1 xmmreg3 
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xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:0B:mod xmmreg1 r/m 


VPSHUFB — Packed Shuffle Bytes 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:00:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:00:mod xmmreg1 r/m 


VPSIGNB — Packed SIGN 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:08:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:08:mod xmmreg1 r/m 


VPSIGND — Packed SIGN 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_2: w xmmreg2 001:0A:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:0A:mod xmmreg1 r/m 


VPSIGNW — Packed SIGN 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_2: w xmmreg2 001:09:11 xmmreg1 xmmreg3 
C4: rxbO_2: w xmmreg2 001:09:mod xmmreg1 r/m 


VADDSUBPD — Packed Double-FP Add/Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D0:11 xmmreg1 xmmreg3 
C4: rxbO0_1: w xmmreg2 001:DO:mod xmmreg1 r/m 


xmmreglo2! with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:D0:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 001:D0:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 101:D0:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:DO:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:D0:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 101:D0:mod ymmreg1 r/m 


VADDSUBPS — Packed Single-FP Add/Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:D0:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 011:DO:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:D0:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:D0:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 111:D0:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 111:DO:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 111:D0:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 111:D0:mod ymmreg1 r/m 


VHADDPD — Packed Double-FP Horizontal Add 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:7C:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 001:7C:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:7C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:7C:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:7C:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:7C:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:7C:11 ymmreg1 ymmreglo3 
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ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:7C:mod ymmreg1 r/m 


VHADDPS — Packed Single-FP Horizontal Add 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:7C:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 011:7C:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:7C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:7C:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxbO0_1: w ymmreg2 111:7C:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 111:7C:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 111:7C:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 111:7C:mod ymmreg1 r/m 


VHSUBPD — Packed Double-FP Horizontal Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:7D:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 001:7D:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:7D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 001:7D:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 101:7D:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:7D:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:7D:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 101:7D:mod ymmreg1 r/m 


VHSUBPS — Packed Single-FP Horizontal Subtract 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO0_1: w xmmreg2 011:7D:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 011:7D:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:7D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 011:7D:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 111:7D:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 111:7D:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 111:7D:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 111:7D:mod ymmreg1 r/m 


VLDDQU — Load Unaligned Integer 128 Bits 


mem to xmmreg1 


mem to xmmreg1 


C4: rxbO_1: w_F 011:FO:mod xmmreg1 r/m 
C5: r_F 011:FO:mod xmmreg1 r/m 


mem to ymmreg1 


C4: rxbO_1: w_F 111:FO:mod ymmreg1 r/m 


mem to ymmreg1 
VMOVDDUP — Move One Double-FP and Duplicate 


C5: r_F 111:FO:mod ymmreg1 r/m 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 011:12:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 011:12:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 011:12:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 011:12:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxbO_1: w_F 111:12:11 ymmreg1 ymmreg2 
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mem to ymmreg1 


C4: rxbO_1: w_F 111:12:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5:r_F 111:12:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 111:12:mod ymmreg1 r/m 


VMOVHLPS — Move Packed Single-Precision Floating-Point Values High to Low 


xmmreg2 and xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:12:11 xmmreg1 xmmreg3 


xmmreglo2 and xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:12:11 xmmreg1 xmmreglo3 


VMOVSHDUP — Move Packed Single-FP High and Duplicate 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 010:16:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 010:16:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 010:16:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 010:16:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 110:16:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 110:16:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 110:16:11 ymmreg1 ymmreglo 


mem to ymmreg1 
VMOVSLDUP — Move Packed Single-FP Low and Duplicate 


C5: r_F 110:16:mod ymmreg1 r/m 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 010:12:11 xmmreg1 xmmreg2 


mem to xmmreg1 


xmmreglo to xmmreg1 


C4: rxbO_1: w_F 010:12:mod xmmreg1 r/m 
C5: r_F 010:12:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 010:12:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxb0_1: w_F 110:12:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 110:12:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 110:12:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 110:12:mod ymmreg1 r/m 


VADDPD — Add Packed Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:58:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:58:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:58:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:58:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:58:11 ymmreg1 ymmreg3 
C4: rxb0_1: w ymmreg2 101:58:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:58:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


VADDSD — Add Scalar Double-Precision Floating-Point Values 


C5: r_ymmreglo2 101:58:mod ymmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:58:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:58:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:58:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5 r_xmmreglo2 011:58:mod xmmreg1 r/m 


VANDPD — Bitwise Logical AND of Packed Double-Precision Floating-Point Values 
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xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:54:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:54:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:54:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:54:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:54:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:54:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:54:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:54:mod ymmreg1 r/m 


VANDNPD — Bitwise Logical AND NOT of Packed Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:55:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:55:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:55:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:55:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:55:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:55:mod ymmreg1 r/m 
C5: r_ymmreglo2 101:55:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:55:mod ymmreg1 r/m 


VCMPPD — Compare Packed Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:C2:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:C2:mod xmmreg1 r/m: imm 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:C2:11 xmmreg1 xmmreglo3: imm 


C5: r_xmmreglo2 001:C2:mod xmmreg1 r/m: imm 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:C2:11 ymmreg1 ymmreg3: imm 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:C2:mod ymmreg1 r/m: imm 
C5: r_ymmreglo2 101:C2:11 ymmreg1 ymmreglo3: imm 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:C2:mod ymmreg1 r/m: imm 


VCMPSD — Compare Scalar Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:C2:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 011:C2:mod xmmreg1 r/m: imm 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:C2:11 xmmreg1 xmmreglo3: imm 


C5: r_xmmreglo2 011:C2:mod xmmreg1 r/m: imm 


VCOMISD — Compare Scalar Ordered Double-Precision Floating-Point Values and Set EFLAGS 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_1: w_F 001:2F:11 xmmreg1 xmmreg2 
C4: rxbO_1: w_F 001:2F:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:2F:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 001:2F:mod xmmreg1 r/m 


VCVTDQ2PD— Convert Packed Dword Integers to Packed Do 


uble-Precision FP Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 010:€6:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 010:€6:mod xmmreg1 r/m 
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xmmreglo to xmmreg1 


C5: r_F 010:€6:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 010:€6:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxb0_1: w_F 110:€6:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 110:€6:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 110:€6:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 110:€6:mod ymmreg1 r/m 


VCVTDQ2PS— Convert Packed Dword Integers to Packed Single-Precision FP Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 000:5B:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 000:5B:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 000:5B:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 000:5B:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 100:5B:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 100:5B:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 100:5B:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 100:5B:mod ymmreg1 r/m 


VCVTPD2DQ— Convert Packed Double-Precision FP Values to Packed Dword Integers 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 011:€6:11 xmmreg1 xmmreg2 


mem to xmmreg1 


xmmreglo to xmmreg1 


C4: rxbO_1: w_F 011:€6:mod xmmreg1 r/m 
C5: r_F 011:€6:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 011:€6:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxb0O_1: w_F 111:€6:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 111:€6:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 111:€6:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 111:€6:mod ymmreg1 r/m 


VCVTPD2PS— Convert Packed Double-Precision FP Values to Packed Single-Precision FP Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 001:5A:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 001:5A:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:5A:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 001:5A:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 101:5A:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 101:5A:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 101:5A:11 ymmreg1 ymmreglo 


mem to ymmreg1 
VCVTPS2DQ— Convert Packed Single-Precision FP Values to 


C5: r_F 101:5A:mod ymmreg1 r/m 
Packed Dword Integers 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 001:5B:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 001:5B:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:5B:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 001:5B:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxbO_1: w_F 101:5B:11 ymmreg1 ymmreg2 
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mem to ymmreg1 


C4: rxbO_1: w_F 101:5B:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 101:5B:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 101:5B:mod ymmreg1 r/m 


VCVTPS2PD— Convert Packed Single-Precision FP Values to 


Packed Double-Precision FP Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 000:5A:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxb0_1: w_F 000:5A:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 000:5A:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 000:5A:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxbO_1: w_F 100:5A:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 100:5A:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 100:5A:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 100:5A:mod ymmreg1 r/m 


VCVTSD2SI— Convert Scalar Double-Precision FP Value to Integer 


xmmreg1 to reg32 


C4: rxbO_1: O_F 011:2D:11 reg xmmreg1 


mem to reg32 


xmmreglo to reg32 


C4: rxb0_1: O_F 011:2D:mod reg r/m 
C5: r_F 011:2D:11 reg xmmreglo 


mem to reg32 


C5: r_F 011:2D:mod reg r/m 


ymmreg1 to reg64 


mem to reg64 


C4: rxbO_1: 1_F 111:2D:11 reg ymmreg1 
C4: rxbO_1: 1_F 111:2D:mod reg r/m 


VCVTSD2SS — Convert Scalar Double-Precision FP Value to Scalar Single-Precision FP Value 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5A:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 011:5A:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:5A:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VCVTSI2SD— Convert Dword Integer to Scalar Double-Precis 


C5: r_xmmreglo2 011:5A:mod xmmreg1 r/m 


ion FP Value 


xmmreg2 with reg to xmmreg1 


C4: rxbO_1: 0 xmmreg2 011:2A:11 xmmreg1 reg 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: 0 xmmreg2 011:2A:mod xmmreg1 r/m 


xmmreglo2 with reglo to xmmreg1 


C5: r_xmmreglo2 011:2A:11 xmmreg1 reglo 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:2A:mod xmmreg1 r/m 


ymmreg2 with reg to ymmreg1 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: 1 ymmreg2 111:2A:11 ymmreg1 reg 
C4: rxb0_1: 1 ymmreg2 111:2A:mod ymmreg1 r/m 


VCVTSS2SD — Convert Scalar Single-Precision FP Value to Scalar Double-Precision FP Value 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:5A:11 xmmreg1 xmmreg3 
C4: rxbO_1: w xmmreg2 010:5A:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:5A:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:5A:mod xmmreg1 r/m 


VCVTTPD2DQ— Convert with Truncation Packed Double-Prec 


ision FP Values to Packed Dword Integers 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 001:€6:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 001:€6:mod xmmreg1 r/m 
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xmmreglo to xmmreg1 


C5: r_F 001:€6:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 001:€6:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxb0_1: w_F 101:€6:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 101:€6:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 101:€6:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 101:€6:mod ymmreg1 r/m 


VCVTTPS2DQ— Convert with Truncation Packed Single-Precision FP Values to Packed Dword Integers 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 010:5B:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 010:5B:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 010:5B:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 010:5B:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 110:5B:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 110:5B:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 110:5B:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 110:5B:mod ymmreg1 r/m 


VCVTTSD2SI— Convert with Truncation Scalar Double-Precision FP Value to Signed Integer 


xmmreg1 to reg32 


C4: rxbO_1: O_F 011:2C:11 reg xmmreg1 


mem to reg32 


xmmreglo to reg32 


C4: rxbO_1: O_F 011:2C:mod reg r/m 
C5: r_F 011:2C:11 reg xmmreglo 


mem to reg32 


C5: r_F 011:2C:mod reg r/m 


xmmreg1 to reg64 


mem to reg64 


C4: rxbO_1: 1_F 011:2C:11 reg xmmreg1 
C4: rxbO_1: 1_F 011:2C:mod reg r/m 


VDIVPD — Divide Packed Double-Precision Floating-Point Va 


lues 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:5E:11 xmmreg1 xmmreg3 
C4: rxbO_1: w xmmreg2 001:5E:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:5€:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:5€:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5€:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5E€:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:5€:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 101:5€:mod ymmreg1 r/m 


VDIVSD — Divide Scalar Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5€:11 xmmreg1 xmmreg3 
C4: rxbO_1: w xmmreg2 011:5€:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:5€:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:5€:mod xmmreg1 r/m 


VMASKMOVDQU-— Store Selected Bytes of Double Quadword 


xmmreg1 to mem; xmmreg2 as mask 


C4: rxbO_1: w_F 001:F7:11 r/m xmmreg1: xmmreg2 


xmmreg1 to mem; xmmreg2 as mask 


C5: r_F 001:F7:11 r/m xmmreg1: xmmreg2 
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VMAXPD — Return Maximum Packed Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:5F:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:5F:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:5F:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:5F:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5F:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5F:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:5F:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:5F:mod ymmreg1 r/m 


VMAXSD — Return Maximum Scalar Double-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5F:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5F:mod xmmreg1 r/m 


C5: r_xmmreglo2 011:5F:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:5F:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


VMINPD — Return Minimum Packed Double-Precision Floating-Point Values 


C4: rxb0_1: w xmmreg2 001:5D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:5D:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:5D:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:5D:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5D:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5D:mod ymmreg1 r/m 


C5: r_ymmreglo2 101:5D:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:5D:mod ymmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


VMINSD — Return Minimum Scalar Double-Precision Floating-Point Value 


C4: rxbO_1: w xmmreg2 011:5D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5D:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:5D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:5D:mod xmmreg1 r/m 


VMOVAPD — Move Aligned Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_1: w_F 001:28:11 xmmreg1 xmmreg2 


C4: rxbO_1: w_F 001:28:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:28:11 xmmreg1 xmmreglo 


mem to xmmreg1 


xmmreg1 to xmmreg2 


C5: r_F 001:28:mod xmmreg1 r/m 


C4: rxbO_1: w_F 001:29:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


C4: rxbO_1: w_F 001:29:mod r/m xmmreg1 


xmmreg1 to xmmreglo 


C5: r_F 001:29:11 xmmreglo xmmreg1 


xmmreg1 to mem 


C5: r_F 001:29:mod r/m xmmreg1 


ymmreg2 to ymmreg1 


C4: rxbO_1: w_F 101:28:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxb0_1: w_F 101:28:mod ymmreg1 r/m 
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ymmreglo to ymmreg1 


C5: r_F 101:28:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 101:28:mod ymmreg1 r/m 


ymmreg1 to ymmreg2 


C4: rxbO_1: w_F 101:29:11 ymmreg2 ymmreg1 


ymmreg1 to mem 


C4: rxb0_1: w_F 101:29:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


C5: r_F 101:29:11 ymmreglo ymmreg1 


ymmreg1 to mem 


C5: r_F 101:29:mod r/m ymmreg1 


VMOVD — Move Doubleword 


reg32 to xmmreg1 


C4: rxbO_1: O_F 001:6€:11 xmmreg1 reg32 


mem32 to xmmreg1 


C4: rxbO_1: O_F 001:6E:mod xmmreg1 r/m 


reg32 to xmmreg1 


C5: r_F 001:6€:11 xmmreg1 reg32 


mem32 to xmmreg1 


C5: r_F 001:6E:mod xmmreg1 r/m 


xmmreg1 to reg32 


xmmreg1 to mem32 


C4: rxbO_1: O_F 001:7€:11 reg32 xmmreg1 
C4: rxbO_1: O_F 001:7E:mod mem32 xmmreg1 


xmmreglo to reg32 


C5: r_F 001:7€:11 reg32 xmmreglo 


xmmreglo to mem32 


VMOVQ — Move Quadword 


C5: r_F 001:7E:mod mem32 xmmreglo 


reg64 to xmmreg1 


C4: rxbO_1: 1_F 001:6€:11 xmmreg1 reg64 


mem64 to xmmreg1 


xmmreg1 to reg64 


C4: rxbO_1: 1_F 001:6E:mod xmmreg1 r/m 
C4: rxbO_1: 1_F 001:7€:11 reg64 xmmreg1 


xmmreg1 to mem64 


C4: rxbO_1: 1_F 001:7E:mod r/m xmmreg1 


VMOVDQA — Move Aligned Double Quadword 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 001:6F:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 001:6F:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


mem to xmmreg1 


C5: r_F 001:6F:11 xmmreg1 xmmreglo 
C5: r_F 001:6F:mod xmmreg1 r/m 


xmmreg1 to xmmreg2 


C4: rxbO_1: w_F 001:7F:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


C4: rxbO_1: w_F 001:7F:mod r/m xmmreg1 


xmmreg1 to xmmreglo 


C5: r_F 001:7F:11 xmmreglo xmmreg1 


xmmreg1 to mem 


C5: r_F 001:7F:mod r/m xmmreg1 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxb0_1: w_F 101:6F:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 101:6F:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 101:6F:11 ymmreg1 ymmreglo 


mem to ymmreg1 


ymmreg1 to ymmreg2 


C5: r_F 101:6F:mod ymmreg1 r/m 
C4: rxb0_1: w_F 101:7F:11 ymmreg2 ymmreg1 


ymmreg1 to mem 


C4: rxbO_1: w_F 101:7F:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


C5: r_F 101:7F:11 ymmreglo ymmreg1 


ymmreg1 to mem 


C5: r_F 101:7F:mod r/m ymmreg1 


VMOVDQU — Move Unaligned Double Quadword 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 010:6F:11 xmmreg1 xmmreg2 
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mem to xmmreg1 


C4: rxbO_1: w_F 010:6F:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 010:6F:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 010:6F:mod xmmreg1 r/m 


xmmreg1 to xmmreg2 


C4: rxbO_1: w_F 010:7F:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


C4: rxbO_1: w_F 010:7F:mod r/m xmmreg1 


xmmreg1 to xmmreglo 


C5: r_F 010:7F:11 xmmreglo xmmreg1 


xmmreg1 to mem 


C5: r_F 010:7F:mod r/m xmmreg1 


ymmreg2 to ymmreg1 


C4: rxbO_1: w_F 110:6F:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 110:6F:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 110:6F:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 110:6F:mod ymmreg1 r/m 


ymmreg1 to ymmreg2 


ymmreg1 to mem 


C4: rxbO_1: w_F 110:7F:11 ymmreg2 ymmreg1 
C4: rxbO_1: w_F 110:7F:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


C5: r_F 110:7F:11 ymmreglo ymmreg1 


ymmreg1 to mem 


C5: r_F 110:7F:mod r/m ymmreg1 


VMOVHPD — Move High Packed Double-Precision Floating-Point Value 


xmmreg1 and mem to xmmreg2 


C4: rxb0_1: w xmmreg1 001:16:11 xmmreg2 r/m 


xmmreg1 and mem to xmmreglo2 


xmmreg1 to mem 


C5: r_xmmreg1 001:16:11 xmmreglo2 r/m 
C4: rxbO_1: w_F 001:17:mod r/m xmmreg1 


xmmreglo to mem 


C5: r_F 001:17:mod r/m xmmreglo 


xmmreg1 and mem to xmmreg2 


VMOVLPD — Move Low Packed Double-Precision Floating-Point Value 


C4: rxb0_1: w xmmreg1 001:12:11 xmmreg2 r/m 


xmmreg1 and mem to xmmreglo2 


C5: r_xmmreg1 001:12:11 xmmreglo2 r/m 


xmmreg1 to mem 


xmmreglo to mem 


C4: rxbO_1: w_F 001:13:mod r/m xmmreg1 
C5: r_F 001:13:mod r/m xmmreglo 


VMOVMSKPD — Extract Packed Double-Precision Floating-Point Sign Mask 


xmmreg2 to reg 


C4: rxbO_1: w_F 001:50:11 reg xmmreg1 


xmmreglo to reg 


C5: r_F 001:50:11 reg xmmreglo 


ymmregz to reg 


C4: rxbO_1: w_F 101:50:11 reg ymmreg1 


ymmreglo to reg 
VMOVNTDQ — Store Double Quadword Using Non-Temporal 


C5: r_F 101:50:11 reg ymmreglo 
Hint 


xmmreg1 to mem 


C4: rxbO_1: w_F 001:€7:11 r/m xmmreg1 


xmmreglo to mem 


ymmreg1 to mem 


C5: r_F 001:€7:11 r/m xmmreglo 
C4: rxbO_1: w_F 101:€7:11 r/m ymmreg1 


ymmreglo to mem 


C5: r_F 101:€7:11 r/m ymmreglo 


VMOVNTPD — Store Packed Double-Precision Floating-Point 


Values Using Non-Temporal Hint 


xmmreg1 to mem 


C4: rxbO_1: w_F 001:2B:11 r/m xmmreg1 


xmmreglo to mem 


C5: r_F 001:2B:11 r/m xmmreglo 


ymmreg1 to mem 


C4: rxbO_1: w_F 101:2B:11r/m ymmreg1 
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INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format 


Encoding 


ymmreglo to mem 


C5: r_F 101:2B:11r/m ymmreglo 


VMOVSD — Move Scalar Double-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:10:11 xmmreg1 xmmreg3 


mem to xmmreg1 


C4: rxbO_1: w_F 011:10:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:10:11 xmmreg1 xmmreglo3 


mem to xmmreg1 


C5: r_F 011:10:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:11:11 xmmreg1 xmmreg3 


xmmreg1 to mem 


C4: rxbO_1: w_F 011:11:mod r/m xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:11:11 xmmreg1 xmmreglo3 


xmmreglo to mem 


C5: r_F 011:11:mod r/m xmmreglo 


VMOVUPD — Move Unaligned Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_1: w_F 001:10:11 xmmreg1 xmmreg2 
C4: rxbO_1: w_F 001:10:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:10:11 xmmreg1 xmmreglo 


mem to xmmreg1 


ymmreg2 to ymmreg1 


C5: r_F 001:10:mod xmmreg1 r/m 
C4: rxb0_1: w_F 101:10:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 101:10:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


mem to ymmreg1 


C5: r_F 101:10:11 ymmreg1 ymmreglo 
C5: r_F 101:10:mod ymmreg1 r/m 


xmmreg1 to xmmreg2 


C4: rxbO_1: w_F 001:11:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


xmmreg1 to xmmreglo 


C4: rxbO_1: w_F 001:11:mod r/m xmmreg1 
C5: r_F 001:11:11 xmmreglo xmmreg1 


xmmreg1 to mem 


C5: r_F 001:11:mod r/m xmmreg1 


ymmreg1 to ymmreg2 


ymmreg1 to mem 


C4: rxb0O_1: w_F 101:11:11 ymmreg2 ymmreg1 
C4: rxbO_1: w_F 101:11:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


C5: r_F 101:11:11 ymmreglo ymmreg1 


ymmreg1 to mem 


C5: r_F 101:11:mod r/m ymmreg1 


VMULPD — Multiply Packed Double-Precision Floating-Point 


Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:59:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:59:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:59:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:59:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:59:11 ymmreg1 ymmreg3 
C4: rxb0_1: w ymmreg2 101:59:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:59:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:59:mod ymmreg1 r/m 


VMULSD — Multiply Scalar Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:59:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:59:mod xmmreg1 r/m 
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INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format 


Encoding 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:59:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:59:mod xmmreg1 r/m 


VORPD — Bitwise Logical OR of Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:56:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:56:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:56:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:56:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:56:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:56:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:56:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:56:mod ymmreg1 r/m 


VPACKSSWB— Pack with Signed Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:63:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:63:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:63:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:63:mod xmmreg1 r/m 


VPACKSSDW- Pack with Signed Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:6B:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 001:6B:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:6B:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPACKUSWB— Pack with Unsigned Saturation 


C5: r_xmmreglo2 001:6B:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:67:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:67:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:67:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:67:mod xmmreg1 r/m 


VPADDB — Add Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FC:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FC:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:FC:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:FC:mod xmmreg1 r/m 


VPADDW — Add Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FD:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 001:FD:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:FD:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:FD:mod xmmreg1 r/m 


VPADDD — Add Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FE:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FE:mod xmmreg1 r/m 
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INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format 


Encoding 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:FE:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:FE:mod xmmreg1 r/m 


VPADDQ — Add Packed Quadword Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D4:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D4:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:D4:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D4:mod xmmreg1 r/m 


VPADDSB — Add Packed Signed Integers with Signed Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€C:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:EC:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€C:mod xmmreg1 r/m 


VPADDSW — Add Packed Signed Integers with Signed Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:ED:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:€D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:ED:mod xmmreg1 r/m 


VPADDUSB — Add Packed Unsigned Integers with Unsigned 


xmmreg2 with xmmreg3 to xmmreg1 


Saturation 


C4: rxb0_1: w xmmreg2 001:DC:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DC:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DC:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:DC:mod xmmreg1 r/m 


VPADDUSW — Add Packed Unsigned Integers with Unsigned Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:DD:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 001:DD:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:DD:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DD:mod xmmreg1 r/m 


VPAND — Logical AND 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:DB:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DB:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:DB:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DB:mod xmmreg1 r/m 


VPANDN — Logical AND NOT 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DF:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DF:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:DF:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DF:mod xmmreg1 r/m 


VPAVGB — Average Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€0:11 xmmreg1 xmmreg3 
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Instruction and Format 


Encoding 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€0:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€0:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€0:mod xmmreg1 r/m 


VPAVGW — Average Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:E€3:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:E3:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€3:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€3:mod xmmreg1 r/m 


VPCMPEQB — Compare Packed Data for Equal 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:74:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:74:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:74:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:74:mod xmmreg1 r/m 


VPCMPEQW — Compare Packed Data for Equal 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:75:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 001:75:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:75:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPCMPEQD — Compare Packed Data for Equal 


C5: r_xmmreglo2 001:75:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:76:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:76:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:76:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:76:mod xmmreg1 r/m 


VPCMPGTB — Compare Packed Signed Integers for Greater Than 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:64:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:64:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:64:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:64:mod xmmreg1 r/m 


VPCMPGTW — Compare Packed Signed Integers for Greater Than 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:65:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 001:65:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:65:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:65:mod xmmreg1 r/m 


VPCMPGTD — Compare Packed Signed Integers for Greater Than 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:66:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:66:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:66:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:66:mod xmmreg1 r/m 


VPEXTRW — Extract Word 
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Instruction and Format 


Encoding 


xmmreg1 to reg using imm 


C4: rxbO_1: O_F 001:C5:11 reg xmmreg1: imm 


xmmreg1 to reg using imm 


C5: r_F 001:C5:11 reg xmmreg1: imm 


VPINSRW — Insert Word 


xmmreg2 with reg to xmmreg1 


C4: rxb0_1: 0 xmmreg2 001:C4:11 xmmreg1 reg: imm 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: 0 xmmreg2 001:C4:mod xmmreg1 r/m: imm 


xmmreglo2 with reglo to xmmreg1 


C5: r_xmmreglo2 001:C4:11 xmmreg1 reglo: imm 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:C4:mod xmmreg1 r/m: imm 


VPMADDWD — Multiply and Add Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F5:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:F5:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:F5:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPMAXSW — Maximum of Packed Signed Word Integers 


C5: r_xmmreglo2 001:F5:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€E:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:EE:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:€€:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€E:mod xmmreg1 r/m 


VPMAXUB — Maximum of Packed Unsigned Byte Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DE:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:DE:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DE:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:DE:mod xmmreg1 r/m 


VPMINSW — Minimum of Packed Signed Word Integers 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:E€A:11 xmmreg1 xmmreg3 
C4: rxbO_1: w xmmreg2 001:EA:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€A:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:EA:mod xmmreg1 r/m 


VPMINUB — Minimum of Packed Unsigned Byte Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:DA:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:DA:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:DA:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:DA:mod xmmreg1 r/m 


VPMOVMSKB — Move Byte Mask 


xmmreg1 to reg 


C4: rxbO_1: w_F 001:D7:11 reg xmmreg1 


xmmreg1 to reg 


C5: r_F 001:D7:11 reg xmmreg1 


VPMULHUW — Multiply Packed Unsigned Integers and Store 


High Result 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€4:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€4:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€4:11 xmmreg1 xmmreglo3 
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xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€4:mod xmmreg1 r/m 


VPMULHW — Multiply Packed Signed Integers and Store High Result 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:€5:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:E5:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€5:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€5:mod xmmreg1 r/m 


VPMULLW — Multiply Packed Signed Integers and Store Low 


Result 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D5:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D5:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:D5:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D5:mod xmmreg1 r/m 


VPMULUDQ — Multiply Packed Unsigned Doubleword Intege 


xmmreg2 with xmmreg3 to xmmreg1 


rs 


C4: rxbO_1: w xmmreg2 001:F4:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F4:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:F4:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:F4:mod xmmreg1 r/m 


VPOR — Bitwise Logical OR 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€B:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 001:EB:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€B:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPSADBW — Compute Sum of Absolute Differences 


C5: r_xmmreglo2 001:EB:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:F6:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:F6:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:F6:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:F6:mod xmmreg1 r/m 


xmmreglo2 with mem to xmmreg1 


VPSHUFD — Shuffle Packed Doublewords 


xmmreg2 to xmmreg1 using imm 


C4: rxbO_1: w_F 001:70:11 xmmreg1 xmmreg2: imm 


mem to xmmreg1 using imm 


C4: rxbO_1: w_F 001:70:mod xmmreg1 r/m: imm 


xmmreglo to xmmreg1 using imm 


mem to xmmreg1 using imm 


C5: r_F 001:70:11 xmmreg1 xmmreglo: imm 


C5: r_F 001:70:mod xmmreg1 r/m: imm 


VPSHUFHW — Shuffle Packed High Words 


xmmreg2 to xmmreg1 using imm 


mem to xmmreg1 using imm 


C4: rxbO_1: w_F 010:70:11 xmmreg1 xmmreg2: imm 
C4: rxbO_1: w_F 010:70:mod xmmreg1 r/m: imm 


xmmreglo to xmmreg1 using imm 


C5: r_F 010:70:11 xmmreg1 xmmreglo: imm 


mem to xmmreg1 using imm 


C5: r_F 010:70:mod xmmreg1 r/m: imm 


VPSHUFLW — Shuffle Packed Low Words 


xmmreg2 to xmmreg1 using imm 


C4: rxbO_1: w_F 011:70:11 xmmreg1 xmmreg2: imm 


mem to xmmreg1 using imm 


C4: rxbO_1: w_F 011:70:mod xmmreg1 r/m: imm 
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xmmreglo to xmmreg1 using imm 


C5: r_F 011:70:11 xmmreg1 xmmreglo: imm 


mem to xmmreg1 using imm 


C5: r_F 011:70:mod xmmreg1 r/m: imm 


VPSLLDQ — Shift Double Quadword Left Logical 


xmmreg2 to xmmreg1 using imm 


C4: rxbO_1: w_F 001:73:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm 


C5: r_F 001:73:11 xmmreg1 xmmreglo: imm 


VPSLLW — Shift Packed Data Left Logical 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F1:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:F1:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:F1:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:F1:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:71:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 
VPSLLD — Shift Packed Data Left Logical 


C5: r_F 001:71:11 xmmreg1 xmmreglo: imm 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F2:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F2:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:F2:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:F2:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


xmmreglo to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:72:11 xmmreg1 xmmreg2: imm 


C5: r_F 001:72:11 xmmreg1 xmmreglo: imm 


VPSLLQ — Shift Packed Data Left Logical 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F3:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 001:F3:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:F3:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


xmmreg2 to xmmreg1 using imm8 


C5: r_xmmreglo2 001:F3:mod xmmreg1 r/m 


C4: rxbO_1: w_F 001:73:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 


C5: r_F 001:73:11 xmmreg1 xmmreglo: imm 


VPSRAW — Shift Packed Data Right Arithmetic 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€1:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€1:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€1:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:€1:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:71:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 
VPSRAD — Shift Packed Data Right Arithmetic 


C5: r_F 001:71:11 xmmreg1 xmmreglo: imm 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:E€2:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:E2:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€2:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€2:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:72:11 xmmreg1 xmmreg2: imm 
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xmmreglo to xmmreg1 using imm8 


C5: r_F 001:72:11 xmmreg1 xmmreglo: imm 


VPSRLDQ — Shift Double Quadword Right Logical 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:73:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 


C5: r_F 001:73:11 xmmreg1 xmmreglo: imm 


VPSRLW — Shift Packed Data Right Logical 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D1:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D1:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:D1:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D1:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:71:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 


C5: r_F 001:71:11 xmmreg1 xmmreglo: imm 


VPSRLD — Shift Packed Data Right Logical 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D2:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D2:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D2:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:D2:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:72:11 xmmreg1 xmmreg2: imm 


xmmreglo to xmmreg1 using imm8 
VPSRLQ — Shift Packed Data Right Logical 


C5: r_F 001:72:11 xmmreg1 xmmreglo: imm 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:D3:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D3:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:D3:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D3:mod xmmreg1 r/m 


xmmreg2 to xmmreg1 using imm8 


xmmreglo to xmmreg1 using imm8 


C4: rxbO_1: w_F 001:73:11 xmmreg1 xmmreg2: imm 


C5: r_F 001:73:11 xmmreg1 xmmreglo: imm 


VPSUBB — Subtract Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F8:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F8:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:F8:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPSUBW — Subtract Packed Integers 


C5: r_xmmreglo2 001:F8:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:F9:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:F9:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:F9:11 xmmreg1 xmmreglo3 


xmmrelog2 with mem to xmmreg1 


C5: r_xmmreglo2 001:F9:mod xmmreg1 r/m 


VPSUBD — Subtract Packed Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FA:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:FA:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:FA:11 xmmreg1 xmmreglo3 
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Encoding 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:FA:mod xmmreg1 r/m 


VPSUBQ — Subtract Packed Quadword Integers 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:FB:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:FB:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:FB:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:FB:mod xmmreg1 r/m 


VPSUBSB — Subtract Packed Signed Integers with Signed Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:€8:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0O_1: w xmmreg2 001:€8:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:€8:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€8:mod xmmreg1 r/m 


VPSUBSW — Subtract Packed Signed Integers with Signed S 


xmmreg2 with xmmreg3 to xmmreg1 


aturation 


C4: rxbO_1: w xmmreg2 001:€9:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0O_1: w xmmreg2 001:€9:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€9:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:€9:mod xmmreg1 r/m 


VPSUBUSB — Subtract Packed Unsigned Integers with Unsigned Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D8:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 001:D8:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:D8:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D8:mod xmmreg1 r/m 


VPSUBUSW — Subtract Packed Unsigned Integers with Unsigned Saturation 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0O_1: w xmmreg2 001:D9:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:D9:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:D9:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:D9:mod xmmreg1 r/m 


VPUNPCKHBW — Unpack High Data 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:68:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:68:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:68:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:68:mod xmmreg1 r/m 


VPUNPCKHWD — Unpack High Data 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:69:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 001:69:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:69:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:69:mod xmmreg1 r/m 


VPUNPCKHDQ — Unpack High Data 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:6A:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:6A:mod xmmreg1 r/m 
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xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:6A:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:6A:mod xmmreg1 r/m 


VPUNPCKHQDQ — Unpack High Data 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0O_1: w xmmreg2 001:6D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:6D:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:6D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:6D:mod xmmreg1 r/m 


VPUNPCKLBW — Unpack Low Data 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:60:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:60:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:60:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 
VPUNPCKLWD — Unpack Low Data 


C5: r_xmmreglo2 001:60:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0O_1: w xmmreg2 001:61:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxb0_1: w xmmreg2 001:61:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:61:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:61:mod xmmreg1 r/m 


VPUNPCKLDQ — Unpack Low Data 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:62:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:62:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:62:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:62:mod xmmreg1 r/m 


VPUNPCKLQDQ — Unpack Low Data 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:6C:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 001:6C:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:6C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:6C:mod xmmreg1 r/m 


VPXOR — Logical Exclusive OR 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:EF:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:EF:mod xmmreg1 r/m 


C5: r_xmmreglo2 001:E€F:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:€F:mod xmmreg1 r/m 


VSHUFPD — Shuffle Packed Double-Precision Floating-Point 


xmmreg2 with xmmreg3 to xmmreg1 using imm8 


Values 


C4: rxbO_1: w xmmreg2 001:C6:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 using imm8 


C4: rxbO_1: w xmmreg2 001:C6:mod xmmreg1 r/m: imm 


xmmreglo2 with xmmreglo3 to xmmreg1 using imm8 


C5: r_xmmreglo2 001:C6:11 xmmreg1 xmmreglo3: imm 


xmmreglo2 with mem to xmmreg1 using imm8 


C5: r_xmmreglo2 001:C6:mod xmmreg1 r/m: imm 


ymmreg2 with ymmreg3 to ymmreg1 using imm8 


C4: rxbO_1: w ymmreg2 101:C6:11 ymmreg1 ymmreg3: imm 


ymmreg2 with mem to ymmreg1 using imm8 


C4: rxb0_1: w ymmreg2 101:C6:mod ymmreg1 r/m: imm 
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ymmreglo2 with ymmreglo3 to ymmreg1 using imm8 


C5: r_ymmreglo2 101:C6:11 ymmreg1 ymmreglo3: imm 


ymmreglo2 with mem to ymmreg1 using imm8 


C5: r_ymmreglo2 101:C6:mod ymmreg1 r/m: imm 


VSQRTPD — Compute Square Roots of Packed Double-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 001:51:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 001:51:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 001:51:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 001:51:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


C4: rxb0_1: w_F 101:51:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 101:51:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 101:51:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 101:51:mod ymmreg1 r/m 


VSQRTSD — Compute Square Root of Scalar Double-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:51:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 011:51:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:51:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 011:51:mod xmmreg1 r/m 


VSUBPD — Subtract Packed Double-Precision Floating-Point 


Values 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:5C:11 xmmreg1 xmmreg3 
C4: rxbO_1: w xmmreg2 001:5C:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:5C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 001:5C:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 101:5C:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:5C:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:5C:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 101:5C:mod ymmreg1 r/m 


VSUBSD — Subtract Scalar Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5C:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 011:5C:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 011:5C:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 011:5C:mod xmmreg1 r/m 


VUCOMISD — Unordered Compare Scalar Double-Precision Floating-Point Values and Set EFLAGS 


xmmreg2 with xmmreg1, set EFLAGS 


C4: rxbO_1: w_F xmmreg1 001:2E:11 xmmreg2 


mem with xmmreg1, set EFLAGS 


xmmreglo with xmmreg1, set EFLAGS 


C4: rxbO_1: w_F xmmreg1 001:2E:mod r/m 
C5: r_F xmmreg1 001:2E:11 xmmreglo 


mem with xmmreg1, set EFLAGS 


C5: r_F xmmreg1 001:2E:mod r/m 


VUNPCKHPD — Unpack and Interleave High Packed Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:15:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:15:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:15:11 xmmreg1 xmmreglo3 
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xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:15:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:15:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:15:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:15:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:15:mod ymmreg1 r/m 


VUNPCKHPS — Unpack and Interleave High Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:15:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 000:15:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:15:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:15:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:15:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:15:mod ymmreg1 r/m 
C5: r_ymmreglo2 100:15:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:15:mod ymmreg1 r/m 


VUNPCKLPD — Unpack and Interleave Low Packed Double-P 


xmmreg2 with xmmreg3 to xmmreg1 


recision Floating-Point Values 


C4: rxbO_1: w xmmreg2 001:14:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 001:14:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:14:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 001:14:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:14:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:14:mod ymmreg1 r/m 
C5: r_ymmreglo2 101:14:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:14:mod ymmreg1 r/m 


VUNPCKLPS — Unpack and Interleave Low Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:14:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 000:14:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:14:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:14:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:14:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


ymmreglo2 with ymmreglo3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:14:mod ymmreg1 r/m 
C5: r_ymmreglo2 100:14:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:14:mod ymmreg1 r/m 


VXORPD — Bitwise Logical XOR for Double-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 001:57:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 001:57:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 001:57:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 001:57:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 101:57:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 101:57:mod ymmreg1 r/m 
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ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 101:57:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 101:57:mod ymmreg1 r/m 


VADDPS — Add Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:58:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 000:58:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:58:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:58:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:58:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:58:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 100:58:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:58:mod ymmreg1 r/m 


VADDSS — Add Scalar Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:58:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 010:58:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:58:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 010:58:mod xmmreg1 r/m 


VANDPS — Bitwise Logical AND of Packed Single-Precision F 


loating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxb0O_1: w xmmreg2 000:54:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 000:54:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:54:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 000:54:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 100:54:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:54:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:54:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 100:54:mod ymmreg1 r/m 


VANDNPS — Bitwise Logical AND NOT of Packed Single-Prec 


ision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:55:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 000:55:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:55:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 000:55:mod xmmreg1 r/m 


C4: rxb0_1: w ymmreg2 100:55:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:55:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:55:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 100:55:mod ymmreg1 r/m 


VCMPPS — Compare Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:C2:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 000:C2:mod xmmreg1 r/m: imm 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:C2:11 xmmreg1 xmmreglo3: imm 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:C2:mod xmmreg1 r/m: imm 
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ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:C2:11 ymmreg1 ymmreg3: imm 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:C2:mod ymmreg1 r/m: imm 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 100:C2:11 ymmreg1 ymmreglo3: imm 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:C2:mod ymmreg1 r/m: imm 


VCMPSS — Compare Scalar Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:C2:11 xmmreg1 xmmreg3: imm 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:C2:mod xmmreg1 r/m: imm 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:C2:11 xmmreg1 xmmreglo3: imm 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:C2:mod xmmreg1 r/m: imm 


VCOMISS — Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS 


xmmreg2 with xmmreg1 


C4: rxbO_1: w_F 000:2F:11 xmmreg1 xmmreg2 


mem with xmmreg1 


xmmreglo with xmmreg1 


C4: rxbO_1: w_F 000:2F:mod xmmreg1 r/m 
C5: r_F 000:2F:11 xmmreg1 xmmreglo 


mem with xmmreg1 


C5: r_F 000:2F:mod xmmreg1 r/m 


VCVTSI2SS — Convert Dword Integer to Scalar Single-Precisi 


xmmreg2 with reg to xmmreg1 


ion FP Value 


C4: rxbO_1: 0 xmmreg2 010:2A:11 xmmreg1 reg 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: 0 xmmreg2 010:2A:mod xmmreg1 r/m 


xmmreglo2 with reglo to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:2A:11 xmmreg1 reglo 


C5: r_xmmreglo2 010:2A:mod xmmreg1 r/m 


xmmreg2 with reg to xmmreg1 


C4: rxbO_1: 1 xmmreg2 010:2A:11 xmmreg1 reg 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: 1 xmmreg2 010:2A:mod xmmreg1 r/m 


VCVTSS2SI — Convert Scalar Single-Precision FP Value to Dword Integer 


xmmreg1 to reg 


C4: rxbO_1: O_F 010:2D:11 reg xmmreg1 


mem to reg 


xmmreglo to reg 


C4: rxb0_1: O_F 010:2D:mod reg r/m 
C5: r_F 010:2D:11 reg xmmreglo 


mem to reg 


C5: r_F 010:2D:mod reg r/m 


xmmreg1 to reg 


C4: rxbO_1: 1_F 010:2D:11 reg xmmreg1 


mem to reg 


C4: rxb0_1: 1_F 010:2D:mod reg r/m 


VCVTTSS2SI — Convert with Truncation Scalar Single-Precisi 


on FP Value to Dword Integer 


xmmreg1 to reg 


mem to reg 


C4: rxbO_1: O_F 010:2C:11 reg xmmreg1 
C4: rxbO_1: O_F 010:2C:mod reg r/m 


xmmreglo to reg 


C5: r_F 010:2C:11 reg xmmreglo 


mem to reg 


xmmreg1 to reg 


C5: r_F 010:2C:mod reg r/m 
C4: rxbO_1: 1_F 010:2C:11 reg xmmreg1 


mem to reg 


C4: rxbO_1: 1_F 010:2C:mod reg r/m 


VDIVPS — Divide Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 000:5E:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 000:5E:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:5€:11 xmmreg1 xmmreglo3 
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xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:5E:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:5€:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:5E:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 100:5€:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:5€:mod ymmreg1 r/m 


VDIVSS — Divide Scalar Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:5E:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 010:5E:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:5€:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:5€:mod xmmreg1 r/m 


VLDMXCSR — Load MXCSR Register 


mem to MXCSR reg 
mem to MXCSR reg 


C4: rxbO_1: w_F 000:AEmod 011 r/m 
C5: r_F 000:AEmod 011 r/m 


VMAXPS — Return Maximum Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 000:5F:11 xmmreg1 xmmreg3 
C4: rxb0_1: w xmmreg2 000:5F:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:5F:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


ymmreg2 with ymmreg3 to ymmreg1 


C5: r_xmmreglo2 000:5F:mod xmmreg1 r/m 


C4: rxbO_1: w ymmreg2 100:5F:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:5F:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:5F:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 100:5F:mod ymmreg1 r/m 


VMAXSS — Return Maximum Scalar Single-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:5F:11 xmmreg1 xmmreg3 


C4: rxb0_1: w xmmreg2 010:5F:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:5F:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:5F:mod xmmreg1 r/m 


VMINPS — Return Minimum Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:5D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:5D:mod xmmreg1 r/m 


C5: r_xmmreglo2 000:5D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:5D:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:5D:11 ymmreg1 ymmreg3 
C4: rxb0_1: w ymmreg2 100:5D:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 100:5D:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:5D:mod ymmreg1 r/m 


VMINSS — Return Minimum Scalar Single-Precision Floating- 


Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxb0_1: w xmmreg2 010:5D:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:5D:mod xmmreg1 r/m 
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xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:5D:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:5D:mod xmmreg1 r/m 


VMOVAPS— Move Aligned Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 000:28:11 xmmreg1 xmmreg2 


mem to xmmreg1 


C4: rxbO_1: w_F 000:28:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 000:28:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 000:28:mod xmmreg1 r/m 


xmmreg1 to xmmreg2 


C4: rxbO_1: w_F 000:29:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


C4: rxbO_1: w_F 000:29:mod r/m xmmreg1 


xmmreg1 to xmmreglo 


C5: r_F 000:29:11 xmmreglo xmmreg1 


xmmreg1 to mem 


C5: r_F 000:29:mod r/m xmmreg1 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 100:28:11 ymmreg1 ymmreg2 


C4: rxb0_1: w_F 100:28:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 100:28:11 ymmreg1 ymmreglo 


mem to ymmreg1 


ymmreg1 to ymmreg2 


C5: r_F 100:28:mod ymmreg1 r/m 


C4: rxbO_1: w_F 100:29:11 ymmreg2 ymmreg1 


ymmreg1 to mem 


C4: rxbO_1: w_F 100:29:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


ymmreg1 to mem 


C5: r_F 100:29:11 ymmreglo ymmreg1 


C5: r_F 100:29:mod r/m ymmreg1 


VMOVHPS — Move High Packed Single-Precision Floating-Po 


int Values 


xmmreg1 with mem to xmmreg2 


xmmreg1 with mem to xmmreglo2 


C4: rxb0_1: w xmmreg1 000:16:mod xmmreg2 r/m 


C5: r_xmmreg1 000:16:mod xmmreglo2 r/m 


xmmreg1 to mem 


C4: rxbO_1: w_F 000:17:mod r/m xmmreg1 


xmmreglo to mem 


C5: r_F 000:17:mod r/m xmmreglo 


VMOVLHPS — Move Packed Single-Precision Floating-Point Values Low to High 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:16:11 xmmreg1 xmmreglo3 


VMOVLPS — Move Low Packed Single-Precision Floating-Point Values 


xmmreg1 with mem to xmmreg2 


C4: rxbO_1: w xmmreg1 000:12:mod xmmreg2 r/m 


xmmreg1 with mem to xmmreglo2 


xmmreg1 to mem 


C5: r_xmmreg1 000:12:mod xmmreglo2 r/m 


C4: rxbO_1: w_F 000:13:mod r/m xmmreg1 


xmmreglo to mem 


C5: r_F 000:13:mod r/m xmmreglo 


xmmreg2 to reg 


VMOVMSKPS — Extract Packed Single-Precision Floating-Poi 


nt Sign Mask 
C4: rxbO_1: w_F 000:50:11 reg xmmreg2 


xmmreglo to reg 


C5: r_F 000:50:11 reg xmmreglo 


ymmregz to reg 


C4: rxbO_1: w_F 100:50:11 reg ymmreg2 


ymmreglo to reg 


C5: r_F 100:50:11 reg ymmreglo 


VMOVNTPS — Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint 


xmmreg1 to mem 


C4: rxbO_1: w_F 000:2B:mod r/m xmmreg1 
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Instruction and Format 


Encoding 


xmmreglo to mem 


C5: r_F 000:2B:mod r/m xmmreglo 


ymmreg1 to mem 


C4: rxb0_1: w_F 100:2B:mod r/m ymmreg1 


ymmreglo to mem 


C5: r_F 100:2B:mod r/m ymmreglo 


VMOVSS — Move Scalar Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:10:11 xmmreg1 xmmreg3 


mem to xmmreg1 


C4: rxbO_1: w_F 010:10:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C5: r_xmmreg2 010:10:11 xmmreg1 xmmreg3 


mem to xmmreg1 


C5: r_F 010:10:mod xmmreg1 r/m 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:11:11 xmmreg1 xmmreg3 


xmmreg1 to mem 


C4: rxbO_1: w_F 010:11:mod r/m xmmreg1 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:11:11 xmmreg1 xmmreglo3 


xmmreglo to mem 


C5: r_F 010:11:mod r/m xmmreglo 


VMOVUPS— Move Unaligned Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 000:10:11 xmmreg1 xmmreg2 


mem to xmmreg1 


xmmreglo to xmmreg1 


C4: rxbO_1: w_F 000:10:mod xmmreg1 r/m 
C5: r_F 000:10:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 000:10:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxb0O_1: w_F 100:10:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 100:10:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 100:10:11 ymmreg1 ymmreglo 


mem to ymmreg1 


xmmreg1 to xmmreg2 


C5: r_F 100:10:mod ymmreg1 r/m 
C4: rxbO_1: w_F 000:11:11 xmmreg2 xmmreg1 


xmmreg1 to mem 


C4: rxbO_1: w_F 000:11:mod r/m xmmreg1 


xmmreg1 to xmmreglo 


xmmreg1 to mem 


C5: r_F 000:11:11 xmmreglo xmmreg1 
C5: r_F 000:11:mod r/m xmmreg1 


ymmreg1 to ymmreg2 


C4: rxbO_1: w_F 100:11:11 ymmreg2 ymmreg1 


ymmreg1 to mem 


C4: rxbO_1: w_F 100:11:mod r/m ymmreg1 


ymmreg1 to ymmreglo 


C5: r_F 100:11:11 ymmreglo ymmreg1 


ymmreg1 to mem 


C5: r_F 100:11:mod r/m ymmreg1 


VMULPS — Multiply Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:59:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxb0_1: w xmmreg2 000:59:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:59:11 xmmreg1 xmmreglo3 


C5: r_xmmreglo2 000:59:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:59:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:59:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


C5: r_ymmreglo2 100:59:11 ymmreg1 ymmreglo3 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:59:mod ymmreg1 r/m 


VMULSS — Multiply Scalar Single-Precision Floating-Point Values 
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Instruction and Format 


Encoding 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:59:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:59:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:59:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:59:mod xmmreg1 r/m 


VORPS — Bitwise Logical OR of Single-Precision Floating-Poi 


nt Values 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 000:56:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 000:56:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 000:56:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 000:56:mod xmmreg1 r/m 


ymmreg2 with ymmreg3 to ymmreg1 


C4: rxb0_1: w ymmreg2 100:56:11 ymmreg1 ymmreg3 


ymmreg2 with mem to ymmreg1 


C4: rxb0_1: w ymmreg2 100:56:mod ymmreg1 r/m 


ymmreglo2 with ymmreglo3 to ymmreg1 


ymmreglo2 with mem to ymmreg1 


C5: r_ymmreglo2 100:56:11 ymmreg1 ymmreglo3 
C5: r_ymmreglo2 100:56:mod ymmreg1 r/m 


VRCPPS — Compute Reciprocals of Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


mem to xmmreg1 


C4: rxbO_1: w_F 000:53:11 xmmreg1 xmmreg2 
C4: rxbO_1: w_F 000:53:mod xmmreg1 r/m 


xmmreglo to xmmreg1 


C5: r_F 000:53:11 xmmreg1 xmmreglo 


mem to xmmreg1 


ymmreg2 to ymmreg1 


C5: r_F 000:53:mod xmmreg1 r/m 
C4: rxbO_1: w_F 100:53:11 ymmreg1 ymmreg2 


mem to ymmreg1 


C4: rxbO_1: w_F 100:53:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


mem to ymmreg1 


C5: r_F 100:53:11 ymmreg1 ymmreglo 
C5: r_F 100:53:mod ymmreg1 r/m 


VRCPSS — Compute Reciprocal of Scalar Single-Precision Flo 


ating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:53:11 xmmreg1 xmmreg3 


C4: rxbO_1: w xmmreg2 010:53:mod xmmreg1 r/m 


xmmreglo2 with xmmreglo3 to xmmreg1 


C5: r_xmmreglo2 010:53:11 xmmreg1 xmmreglo3 


xmmreglo2 with mem to xmmreg1 


C5: r_xmmreglo2 010:53:mod xmmreg1 r/m 


VRSQRTPS — Compute Reciprocals of Square Roots of Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 


C4: rxbO_1: w_F 000:52:11 xmmreg1 xmmreg2 


mem to xmmreg1 


xmmreglo to xmmreg1 


C4: rxbO_1: w_F 000:52:mod xmmreg1 r/m 
C5: r_F 000:52:11 xmmreg1 xmmreglo 


mem to xmmreg1 


C5: r_F 000:52:mod xmmreg1 r/m 


ymmreg2 to ymmreg1 


mem to ymmreg1 


C4: rxbO_1: w_F 100:52:11 ymmreg1 ymmreg2 
C4: rxbO_1: w_F 100:52:mod ymmreg1 r/m 


ymmreglo to ymmreg1 


C5: r_F 100:52:11 ymmreg1 ymmreglo 


mem to ymmreg1 


C5: r_F 100:52:mod ymmreg1 r/m 


VRSQRTSS — Compute Reciprocal of Square Root of Scalar S 


ingle-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 


C4: rxbO_1: w xmmreg2 010:52:11 xmmreg1 xmmreg3 


xmmreg2 with mem to xmmreg1 


C4: rxbO_1: w xmmreg2 010:52:mod xmmreg1 r/m 
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Instruction and Format Encoding 
xmmreglo2 with xmmreglo3 to xmmreg1 C5: r_xmmreglo2 010:52:11 xmmreg1 xmmreglo3 
xmmreglo2 with mem to xmmreg1 C5: r_xmmreglo2 010:52:mod xmmreg1 r/m 

VSHUFPS — Shuffle Packed Single-Precision Floating-Point Values 
xmmreg2 with xmmreg3 to xmmreg1, imm8 C4: rxbO_1: w xmmreg2 000:C6:11 xmmreg1 xmmreg3: imm 
xmmreg2 with mem to xmmreg1, imm8 C4: rxbO_1: w xmmreg2 000:C6:mod xmmreg1 r/m: imm 
xmmreglo2 with xmmreglo3 to xmmreg1, imm8 C5: r_xmmreglo2 000:C6:11 xmmreg1 xmmreglo3: imm 
xmmreglo2 with mem to xmmreg1, imm8 C5: r_xmmreglo2 000:C6:mod xmmreg1 r/m: imm 
ymmreg2 with ymmreg3 to ymmreg1, imm8 C4: rxb0_1: w ymmreg2 100:C6:11 ymmreg1 ymmreg3: imm 
ymmreg2 with mem to ymmreg1, imm8 C4: rxb0_1: w ymmreg2 100:C6:mod ymmreg1 r/m: imm 
ymmreglo2 with ymmreglo3 to ymmreg1, imm8 C5: r_ymmreglo2 100:C6:11 ymmreg1 ymmreglo3: imm 
ymmreglo2 with mem to ymmreg1, imm8 C5: r_ymmreglo2 100:C6:mod ymmreg1 r/m: imm 


VSQRTPS — Compute Square Roots of Packed Single-Precision Floating-Point Values 


xmmreg2 to xmmreg1 C4: rxbO_1: w_F 000:51:11 xmmreg1 xmmreg2 
mem to xmmreg1 C4: rxbO_1: w_F 000:51:mod xmmreg1 r/m 
xmmreglo to xmmreg1 C5: r_F 000:51:11 xmmreg1 xmmreglo 

mem to xmmreg1 C5: r_F 000:51:mod xmmreg1 r/m 

ymmreg2 to ymmreg1 C4: rxbO_1: w_F 100:51:11 ymmreg1 ymmreg2 
mem to ymmreg1 C4: rxbO_1: w_F 100:51:mod ymmreg1 r/m 
ymmreglo to ymmreg1 C5: r_F 100:51:11 ymmreg1 ymmreglo 

mem to ymmreg1 C5: r_F 100:51:mod ymmreg1 r/m 


VSQRTSS — Compute Square Root of Scalar Single-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 C4: rxb0O_1: w xmmreg2 010:51:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxb0_1: w xmmreg2 010:51:mod xmmreg1 r/m 
xmmreglo2 with xmmreglo3 to xmmreg1 C5: r_xmmreglo2 010:51:11 xmmreg1 xmmreglo3 
xmmreglo2 with mem to xmmreg1 C5: r_xmmreglo2 010:51:mod xmmreg1 r/m 
VSTMXCSR — Store MXCSR Register State 
MXCSR to mem C4: rxb0_1: w_F 000:AE:mod 011 r/m 
MXCSR to mem C5: r_F 000:AE:mod 011 r/m 
VSUBPS — Subtract Packed Single-Precision Floating-Point Values 
xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_1: w xmmreg2 000:5C:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxb0_1: w xmmreg2 000:5C:mod xmmreg1 r/m 
xmmreglo2 with xmmreglo3 to xmmreg1 C5: r_xmmreglo2 000:5C:11 xmmreg1 xmmreglo3 
xmmreglo2 with mem to xmmreg1 C5: r_xmmreglo2 000:5C:mod xmmreg1 r/m 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxb0_1: w ymmreg2 100:5C:11 ymmreg1 ymmreg3 
ymmreg2 with mem to ymmreg1 C4: rxb0_1: w ymmreg2 100:5C:mod ymmreg1 r/m 
ymmreglo2 with ymmreglo3 to ymmreg1 C5: r_ymmreglo2 100:5C:11 ymmreg1 ymmreglo3 
ymmreglo2 with mem to ymmreg1 C5: r_ymmreglo2 100:5C:mod ymmreg1 r/m 


VSUBSS — Subtract Scalar Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_1: w xmmreg2 010:5C:11 xmmreg1 xmmreg3 
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Instruction and Format Encoding 
xmmreg2 with mem to xmmreg1 C4: rxbO_1: w xmmreg2 010:5C:mod xmmreg1 r/m 
xmmreglo2 with xmmreglo3 to xmmreg1 C5: r_xmmreglo2 010:5C:11 xmmreg1 xmmreglo3 
xmmreglo2 with mem to xmmreg1 C5: r_xmmreglo2 010:5C:mod xmmreg1 r/m 


VUCOMISS — Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS 


xmmreg2 with xmmreg1 C4: rxbO_1: w_F 000:2E:11 xmmreg1 xmmreg2 
mem with xmmreg1 C4: rxbO_1: w_F 000:2E:mod xmmreg1 r/m 
xmmreglo with xmmreg1 C5: r_F 000:2E:11 xmmreg1 xmmreglo 

mem with xmmreg1 C5: r_F 000:2E:mod xmmreg1 r/m 


UNPCKHPS — Unpack and Interleave High Packed Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_1: w xmmreg2 000:15:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxb0_1: w xmmreg2 000:15mod xmmreg1 r/m 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxb0_1: w ymmreg2 100:15:11 ymmreg1 ymmreg3 
ymmreg2 with mem to ymmreg1 C4: rxb0_1: w ymmreg2 100:15mod ymmreg1 r/m 


UNPCKLPS — Unpack and Interleave Low Packed Single-Precision Floating-Point Value 


xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_1: w xmmreg2 000:14:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxb0_1: w xmmreg2 000:14mod xmmreg1 r/m 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxb0_1: w ymmreg2 100:14:11 ymmreg1 ymmreg3 
ymmreg2 with mem to ymmreg1 C4: rxb0_1: w ymmreg2 100:14mod ymmreg1 r/m 


VXORPS — Bitwise Logical XOR for Single-Precision Floating-Point Values 


xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_1: w xmmreg2 000:57:11 xmmreg1 xmmreg3 

xmmreg2 with mem to xmmreg1 C4: rxb0_1: w xmmreg2 000:57:mod xmmreg1 r/m 

xmmreglo2 with xmmreglo3 to xmmreg1 C5: r_xmmreglo2 000:57:11 xmmreg1 xmmreglo3 

xmmreglo2 with mem to xmmreg1 C5: r_xmmreglo2 000:57:mod xmmreg1 r/m 

ymmreg2 with ymmreg3 to ymmreg1 C4: rxb0_1: w ymmreg2 100:57:11 ymmreg1 ymmreg3 

ymmreg2 with mem to ymmreg1 C4: rxb0_1: w ymmreg2 100:57:mod ymmreg1 r/m 

ymmreglo2 with ymmreglo3 to ymmreg1 C5: r_ymmreglo2 100:57:11 ymmreg1 ymmreglo3 

ymmreglo2 with mem to ymmreg1 C5: r_ymmreglo2 100:57:mod ymmreg1 r/m 
VBROADCAST —Load with Broadcast 

mem to xmmreg1 C4: rxbO_2: O_F 001:18:mod xmmreg1 r/m 

mem to ymmreg1 C4: rxbO_2: O_F 101:18:mod ymmreg1 r/m 

mem to ymmreg1 C4: rxbO_2: O_F 101:19:mod ymmreg1 r/m 

mem to ymmreg1 C4: rxbO_2: O_F 101:1A:mod ymmreg1 r/m 
VEXTRACTF128 — Extract Packed Floating-Point Values 

ymmreg2 to xmmreg1, imm8 C4: rxbO_3: O_F 001:19:11 xmmreg1 ymmreg2: imm 

ymmreg2 to mem, imm8 C4: rxbO_3: O_F 001:19:mod r/m ymmreg2: imm 
VINSERTF 128 — Insert Packed Floating-Point Values 

xmmreg3 and merge with ymmreg2 to ymmreg1, imm8 C4: rxb0_3: 0 ymmreg2101:18:11 ymmreg1 xmmreg3: imm 

mem and merge with ymmreg2 to ymmreg1, imm8 C4: rxbO_3: 0 ymmreg2 101:18:mod ymmreg1 r/m: imm 


VPERMILPD — Permute Double-Precision Floating-Point Values 
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Instruction and Format Encoding 

xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_2: 0 xmmreg2 001:0D:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxbO_2: 0 xmmreg2 001:0D:mod xmmreg1 r/m 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxbO_2: 0 ymmreg2 101:0D:11 ymmreg1 ymmreg3 
ymmreg2 with mem to ymmreg1 C4: rxbO_2: 0 ymmreg2 101:0D:mod ymmreg1 r/m 
xmmreg2 to xmmreg1, imm C4: rxbO_3: O_F 001:05:11 xmmreg1 xmmreg2: imm 
mem to xmmreg1, imm C4: rxbO_3: O_F 001:05:mod xmmreg1 r/m: imm 
ymmreg2 to ymmreg1, imm C4: rxbO_3: O_F 101:05:11 ymmreg1 ymmreg2: imm 
mem to ymmreg1, imm C4: rxbO_3: O_F 101:05:mod ymmreg1 r/m: imm 

VPERMILPS — Permute Single-Precision Floating-Point Values 
xmmreg2 with xmmreg3 to xmmreg1 C4: rxbO_2: 0 xmmreg2 001:0C:11 xmmreg1 xmmreg3 
xmmreg2 with mem to xmmreg1 C4: rxbO_2: 0 xmmreg2 001:0C:mod xmmreg1 r/m 
xmmreg2 to xmmreg1, imm C4: rxbO_3: O_F 001:04:11 xmmreg1 xmmreg2: imm 
mem to xmmreg1, imm C4: rxbO_3: O_F 001:04:mod xmmreg1 r/m: imm 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxbO_2: 0 ymmreg2 101:0C:11 ymmreg1 ymmreg3 
ymmreg2 with mem to ymmreg1 C4: rxbO_2: 0 ymmreg2 101:0C:mod ymmreg1 r/m 
ymmreg2 to ymmreg1, imm C4: rxbO_3: O_F 101:04:11 ymmreg1 ymmreg2: imm 
mem to ymmreg1, imm C4: rxbO_3: O_F 101:04:mod ymmreg1 r/m: imm 

VPERM2F128 — Permute Floating-Point Values 
ymmreg2 with ymmreg3 to ymmreg1 C4: rxb0_3: 0 ymmreg2 101:06:11 ymmreg1 ymmreg3: imm 
ymmreg2 with mem to ymmreg1 C4: rxb0_3: 0 ymmreg2 101:06:mod ymmreg1 r/m: imm 

VTESTPD/VTESTPS — Packed Bit Test 
xmmreg2 to xmmreg1 C4: rxbO_2: O_F 001:0€:11 xmmreg2 xmmreg1 
mem to xmmreg1 C4: rxbO_2: O_F 001:0E:mod xmmreg2 r/m 
ymmreg2 to ymmreg1 C4: rxbO_2: O_F 101:0€:11 ymmreg2 ymmreg1 
mem to ymmreg1 C4: rxbO_2: O_F 101:0E:mod ymmreg2 r/m 
xmmreg2 to xmmreg1 C4: rxbO_2: O_F 001:0F:11 xmmreg1 xmmreg2: imm 
mem to xmmreg1 C4: rxbO_2: O_F 001:0F:mod xmmreg1 r/m: imm 
ymmreg2 to ymmreg1 C4: rxbO_2: O_F 101:0F:11 ymmreg1 ymmreg2: imm 
mem to ymmreg1 C4: rxbO_2: O_F 101:0F:mod ymmreg1 r/m: imm 

NOTES: 


1. The term “lo” refers to the lower eight registers, 0-7 
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B.17 


FLOATING-POINT INSTRUCTION FORMATS AND ENCODINGS 


Table B-38 shows the five different formats used for floating-point instructions. In all cases, instructions are at 
least two bytes long and begin with the bit pattern 11011. 


Table B-38. General Floating-Point Instruction Formats 


Instruction 
First Byte Second Byte Optional Fields 
1 11011 OPA 1 mod 1 OPB r/m s-i-b disp 
2 11011 MF OPA mod OPB r/m s-i-b disp 
3 11011 d P OPA 1 1 OPB R ST(i) 
4 11011 0 0 1 1 1 1 OP 
5 11011 1 1 1 1 1 OP 
15-11 10 9 8 7 6 5 4 3 210 
MF = Memory Format R XOR d= 0 — Destination OP Source 
00 — 32-bit real R XOR d= 1 — Source OP Destination 
01 — 32-bit integer 
10 — 64-bit real ST(i) = Register stack element / 
11 — 16-bit integer 000 = Stack Top 
P = Pop 


O — Do not pop stack 

1 — Pop stack after operation 
d = Destination 

O — Destination is ST(0) 

1 — Destination is ST(i) 


001 = Second stack element 


111 = €ighth stack element 


The Mod and R/M fields of the ModR/M byte have the same interpretation as the corresponding fields of the integer 
instructions. The SIB byte and disp (displacement) are optionally present in instructions that have Mod and R/M 
fields. Their presence depends on the values of Mod and R/M, as for integer instructions. 


Table B-39 shows the formats and encodings of the floating-point instructions. 


Table B-39. Floating-Point Instruction Formats and Encodings 


Instruction and Format Encoding 

F2XM1 - Compute 257(°) - 1 11011 001: 1111 0000 
FABS - Absolute Value 11011 001: 11100001 
FADD - Add 

ST(0) := ST(0) + 32-bit memory 11011 000 : mod 000 r/m 

ST(0) := ST(O) + 64-bit memory 11011 100: mod 000 r/m 

ST(d) := ST(0) + ST(i) 11011 d0O: 11 000 ST(i) 
FADDP - Add and Pop 

ST(0) := ST(0) + ST(i) 11011 110: 11 000 ST(i) 
FBLD - Load Binary Coded Decimal 11011 111: mod 100 r/m 
FBSTP - Store Binary Coded Decimal and Pop 11011 111:mod 110 r/m 
FCHS - Change Sign 11011 001 : 1110 0000 
FCLEX - Clear Exceptions 11011 011:11100010 


FCOM - Compare Real 
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Table B-39. Floating-Point Instruction Formats and Encodings (Contd.) 


Instruction and Format Encoding 

32-bit memory 11011 000: mod 010 r/m 

64-bit memory 11011 100: mod 010 r/m 

ST(i) 11011 000: 11 010 ST(i) 
FCOMP - Compare Real and Pop 

32-bit memory 11011 000: mod 011 r/m 

64-bit memory 11011 100: mod 011 r/m 

ST(i) 11011 000: 11 011 ST(i) 
FCOMPP - Compare Real and Pop Twice 11011 110:11011 001 
FCOMIP - Compare Real, Set EFLAGS, and Pop 11011 111:11 110 ST(i) 
FCOS - Cosine of ST(0) 11011 001:11111111 
FDECSTP - Decrement Stack-Top Pointer 11011 001:11110110 
FDIV - Divide 

ST(0) := ST(O) + 32-bit memory 11011 000: mod 110 r/m 

ST(0) :=ST(0) + 64-bit memory 11011 100: mod 110 r/m 

ST(d) := ST(O) + ST(i) 11011 d00: 1111 R ST(i) 
FDIVP - Divide and Pop 

ST(0) := ST(0) = ST(i) 11011 110: 1111 1 ST(i) 
FDIVR - Reverse Divide 

ST(0) := 32-bit memory + ST(0) 11011 000: mod 111 r/m 

ST(0) := 64-bit memory + ST(0) 11011 100: mod 111 r/m 

ST(d) := ST(i) + ST(O) 11011 d00: 1111 R ST(i) 
FDIVRP - Reverse Divide and Pop 

ST(0) := ST(i) + ST(0) 11011 110:1111 OST(i) 
FFREE - Free ST(i) Register 11011 101: 1100 0 ST(i) 
FIADD - Add Integer 

ST(0) := ST(O) + 16-bit memory 11011 110: mod 000 r/m 

ST(0) := ST(O) + 32-bit memory 11011 010: mod 000 r/m 
FICOM - Compare Integer 

16-bit memory 11011 110: mod 010 r/m 

32-bit memory 11011 010: mod 010 r/m 
FICOMP - Compare Integer and Pop 

16-bit memory 11011 110: mod 011 r/m 

32-bit memory 11011 010: mod 011 r/m 
FIDIV - Divide 

ST(0) := ST(O) + 16-bit memory 11011 110: mod 110r/m 

ST(0) := ST(O) + 32-bit memory 11011010: mod 110 r/m 
FIDIVR - Reverse Divide 

ST(0) := 16-bit memory + ST(0) 11011 110: mod 111 r/m 
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Table B-39. Floating-Point Instruction Formats and Encodings (Contd.) 


Instruction and Format Encoding 


ST(0) := 32-bit memory + ST(0) 11011010: mod 111 r/m 
FILD - Load Integer 

16-bit memory 11011 111: mod 000 r/m 

32-bit memory 11011 011: mod 000 r/m 

64-bit memory 11011 111: mod 101 r/m 
FIMUL- Multiply 

ST(0) := ST(O) x 16-bit memory 11011 110: mod 001 r/m 

ST(0) := ST(O) x 32-bit memory 11011 010: mod 001 r/m 


FINCSTP - Increment Stack Pointer 11011 001:11110111 


FINIT - Initialize Floating-Point Unit 


FIST - Store Integer 


16-bit memory 11011 111:mod 010 r/m 


32-bit memory 11011 011:mod 010 r/m 


FISTP - Store Integer and Pop 


16-bit memory 11011 111:mod011 r/m 


32-bit memory 11011 011: mod 011 r/m 


64-bit memory 11011 111:mod 111 r/m 


FISUB - Subtract 


ST(0) := ST(O) - 16-bit memory 11011 110: mod 100 r/m 


ST(0) := ST(0) - 32-bit memory 11011010: mod 100 r/m 


FISUBR - Reverse Subtract 


ST(0) := 16-bit memory — ST(0) 11011 110: mod 101 r/m 


ST(0) := 32-bit memory — ST(0) 11011010: mod 101 r/m 


FLD - Load Real 


32-bit memory 11011 001 : mod 000 r/m 


11011 101 : mod 000 r/m 
80-bit memory 11011 011: mod 101 r/m 


64-bit memory 


ST(i) 11011 001 : 11 000 ST(i) 


FLD1 - Load +1.0 into ST(0) 11011 001: 1110 1000 


FLDCW - Load Control Word 11011 001: mod 101 r/m 


FLDENV - Load FPU Environment 11011 001 : mod 100 r/m 


FLDLZ2E - Load log>(e) into ST(0) 11011 001:1110 1010 


FLDL2T - Load loga(10) into ST(0) 11011 001 :1110 1001 


FLDLG2 - Load log; 9(2) into ST(0) 11011 001:1110 1100 


FLDLN2 - Load log,(2) into ST(0) 11011 001:11101101 
FLDPI - Load z into ST(0) 11011 001:1110 1011 


FLDZ - Load +0.0 into ST(0) 11011 001:11101110 


FMUL - Multiply 
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INSTRUCTION FORMATS AND ENCODINGS 


Instruction and Format Encoding 

ST(0) := ST(O) x 32-bit memory 11011 000 : mod 001 r/m 

ST(O) := ST(O) x 64-bit memory 11011 100: mod 001 r/m 

ST(d) := ST(0) x ST(i) 11011 d00: 1100 1 ST(i) 
FMULP - Multiply 

ST(i) == ST(O) x ST(i) 11011 110: 1100 1 ST(i) 
FNOP - No Operation 11011 001 : 1101 0000 
FPATAN - Partial Arctangent 11011 001:1111 0011 
FPREM - Partial Remainder 11011 001:1111 1000 
FPREM1 - Partial Remainder (IEEE) 11011 001:1111 0101 
FPTAN - Partial Tangent 11011 001: 11110010 
FRNDINT - Round to Integer 11011 001:1111 1100 
FRSTOR - Restore FPU State 11011 101: mod 100 r/m 
FSAVE - Store FPU State 11011 101: mod 110r/m 
FSCALE - Scale 11011 001:1111 1101 
FSIN - Sine 11011 001:1111 1110 
FSINCOS - Sine and Cosine 11011 001:1111 1011 
FSQRT - Square Root 11011 001: 1111 1010 
FST - Store Real 

32-bit memory 11011 001 : mod 010 r/m 

64-bit memory 11011 101: mod 010 r/m 

ST(i) 11011 101: 11 010 ST(i) 
FSTCW - Store Control Word 11011 001: mod 111 r/m 
FSTENV - Store FPU Environment 11011 001: mod 110 r/m 
FSTP - Store Real and Pop 

32-bit memory 11011 001 : mod 011 r/m 

64-bit memory 11011 101: mod 011 r/m 

80-bit memory 11011 011: mod 111 r/m 

ST(i) 11011 101: 11011 ST(i) 
FSTSW - Store Status Word into AX 11011 111: 1110 0000 
FSTSW - Store Status Word into Memory 11011 101: mod 111 r/m 
FSUB - Subtract 

ST(0) := ST(O) - 32-bit memory 11011 000: mod 100 r/m 

ST(0O) := ST(O) - 64-bit memory 11011 100: mod 100 r/m 

ST(d) := ST(0) - ST(i) 11011 d00: 1110 R ST(i) 
FSUBP - Subtract and Pop 

ST(0) := ST(0) - ST(i) 11011 110: 11101 ST(i) 
FSUBR - Reverse Subtract 

ST(0) := 32-bit memory - ST(0) 11011 000: mod 101 r/m 
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Table B-39. Floating-Point Instruction Formats and Encodings (Contd.) 


Instruction and Format 


Encoding 


ST(0) := 64-bit memory - ST(0) 


11011 100: mod 101 r/m 


ST(d) := ST(i) - ST(0) 


11011 d00: 1110 R ST(i) 


FSUBRP - Reverse Subtract and Pop 


ST(i) = ST(i) - ST(0) 


11011 110:11100 ST(i) 


FTST - Test 


11011 001: 11100100 


FUCOM - Unordered Compare Real 


11011 101:11100ST(i) 


FUCOMP - Unordered Compare Real and Pop 


11011 101:11101 ST(i) 


FUCOMPP - Unordered Compare Real and Pop Twice 


11011 010: 1110 1001 


FUCOMI - Unorderd Compare Real and Set EFLAGS 


11011 011: 11 101 ST(i) 


FUCOMIP - Unorderd Compare Real, Set EFLAGS, and Pop 


11011 111: 11 101 ST(i) 


FXAM - Examine 11011 001:11100101 
FXCH - Exchange ST(0) and ST(i) 11011 001: 1100 1 ST(i) 
FXTRACT - Extract Exponent and Significand 11011 001:1111 0100 
FYL2X - ST(1) x logo(ST(0)) 11011 001: 11110001 
FYL2XP1 - ST(1) x loga(ST(0) + 1.0) 11011 001:1111 1001 


FWAIT - Wait until FPU Ready 


1001 1011 (same instruction as WAIT) 


B.18 VMX INSTRUCTIONS 


Table B-40 describes virtual-machine extensions (VMX) 


Table B-40. Encodin 


gs for VMX Instructions 


Instruction and Format 


Encoding 


INVEPT—Invalidate Cached EPT Mappings 


Descriptor m128 according to reg 


01100110 00001111 00111000 10000000: mod reg r/m 


INVVPID—Invalidate Cached VPID Mappings 


Descriptor m128 according to reg 


01100110 00001111 00111000 10000001: mod reg r/m 


VMCALL—Call to VM Monitor 


Call VMM: causes VM exit. 


00001111 00000001 11000001 


VMCLEAR—Clear Virtual-Machine Control Structure 


mem32:VMCS_data_ptr 


01100110 00001111 11000111: mod 110 r/m 


mem64:VMCS_data_ptr 


01100110 00001111 11000111: mod 110 r/m 


VMFUNC—Invoke VM Function 


Invoke VM function specified in EAX 


00001111 00000001 11010100 


VMLAUNCH—Launch Virtual Machine 


Launch VM managed by Current_VMCS 


00001111 00000001 11000010 


VMRESUME—Resume Virtual Machine 


Resume VM managed by Current_VMCS 


00001111 00000001 11000011 


VMPTRLD—Load Pointer to Virtual-Machine Control Structure 


mem32 to Current_VMCS_ptr 


00001111 11000111: mod 110 r/m 
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Table B-40. Encodings for VMX Instructions 


Instruction and Format 


Encoding 


mem64 to Current_VMCS_ptr 


00001111 11000111: mod 110 r/m 


VMPTRST—Store Pointer to Virtual-Machine Control Structur 


e 


Current_VMCS_ptr to mem32 


00001111 11000111: mod 111 r/m 


Current_VMCS_ptr to mem64 


00001111 11000111: mod 111 r/m 


VMREAD—Read Field from Virtual-Machine Control Structure 


132 (VMCS_fieldn) to r32 
132 (VMCS_fieldn) to mem32 
164 (VMCS_fieldn) to r64 
164 (VMCS_fieldn) to mem64 


00001111 01111000: 11 reg2 reg1 
00001111 01111000: mod r32 r/m 
00001111 01111000: 11 reg2 reg1 
00001111 01111000: mod r64 r/m 


VMWRITE—Write Field to Virtual-Machine Control Structure 


r32 to r32 (VMCS_fieldn) 
mem32 to r32 (VMCS_fieldn) 
r64 to r64 (VMCS_fieldn) 
mem64 to r64 (VMCS_fieldn) 


00001111 01111001: 11 regi reg2 
00001111 01111001: mod r32 r/m 
00001111 01111001: 11 reg1 reg2 
00001111 01111001: mod r64 r/m 


VMXOFF—Leave VMX Operation 


Leave VMX. 00001111 00000001 11000100 
VMXON—Enter VMX Operation 
Enter VMX. 11110011 000011111 11000111: mod 110 r/m 


B.19 SMX INSTRUCTIONS 


Table B-38 describes Safer Mode extensions (VMX). GETSEC leaf functions are selected by a valid value in EAX on input. 


Table B-41. Encodings for SMX Instructions 


Instruction and Format Encoding 

GETSEC—GETSEC leaf functions are selected by the value in EAX on input 

GETSEC[CAPABILITIES] 00001111 00110111 (EAX= 0) 
GETSEC[ENTERACCS] 00001111 00110111 (EAX= 2) 
GETSEC[EXITAC] 00001111 00110111 (EAX= 3) 
GETSEC[SENTER] 00001111 00110111 (EAX= 4) 
GETSEC[SEXIT] 00001111 00110111 (EAX= 5) 
GETSEC[PARAMETERS] 00001111 00110111 (EAX= 6) 
GETSECISMCTRL] 00001111 00110111 (EAX= 7) 
GETSEC[WAKEUP] 00001111 00110111 (EAX= 8) 
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APPENDIX C 
INTEL® C/C++ COMPILER INTRINSICS AND FUNCTIONAL EQUIVALENTS 


The two tables in this appendix itemize the Intel C/C++ compiler intrinsics and functional equivalents for the Intel 
MMX technology, SSE, SSE2, SSE3, and SSSE3 instructions. 


There may be additional intrinsics that do not have an instruction equivalent. It is strongly recommended that the 
reader reference the compiler documentation for the complete list of supported intrinsics. Please refer to 
http://www. intel.com/support/performancetools/. 


Table C-1 presents simple intrinsics and Table C-2 presents composite intrinsics. Some intrinsics are “composites” 
because they require more than one instruction to implement them. 


Intel C/C++ Compiler intrinsic names reflect the following naming conventions: 
_mm_<intrin_op>_<suffix> 


where: 
<intrin_op> Indicates the intrinsics basic operation; for example, add for addition and sub for subtrac- 
tion 
<suffix> Denotes the type of data operated on by the instruction. The first one or two letters of 


each suffix denotes whether the data is packed (p), extended packed (ep), or scalar (s). 
The remaining letters denote the type: 


Ss single-precision floating point 
d double-precision floating point 
i128 signed 128-bit integer 

i64 signed 64-bit integer 

u64 unsigned 64-bit integer 

i32 signed 32-bit integer 

u32 unsigned 32-bit integer 

i16 signed 16-bit integer 

ul6 unsigned 16-bit integer 

i8 signed 8-bit integer 

u8& unsigned 8-bit integer 


The variable r is generally used for the intrinsic's return value. A number appended to a variable name indicates the 
element of a packed object. For example, rO is the lowest word of r. 


The packed values are represented in right-to-left order, with the lowest value being used for scalar operations. 
Consider the following example operation: 


double a[2] = {1.0, 2.0}; 
__m128d t =_mm_load_pd(a); 
The result is the same as either of the following: 
__m128d t =_mm_set_pd(2.0, 1.0); 
__m128d t =_mm_setr_pd(1.0, 2.0); 
In other words, the XMM register that holds the value t will look as follows: 
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The “scalar” element is 1.0. Due to the nature of the instruction, some intrinsics require their arguments to be 
immediates (constant integer literals). 


To use an intrinsic in your code, insert a line with the following syntax: 


data_type intrinsic_name (parameters) 


Where: 
data_type Is the return data type, which can be either void, int, __m64, __m128, __m128d, or 
__m128i. Only the _mm_empty intrinsic returns void. 


intrinsic_name Is the name of the intrinsic, which behaves like a function that you can use in your C/C++ 
code instead of in-lining the actual instruction. 


parameters Represents the parameters required by each intrinsic. 


C.1 SIMPLE INTRINSICS 


NOTE 


For detailed descriptions of the intrinsics in Table C-1, see the corresponding mnemonic in Chapter 
3, “Instruction Set Reference, A-L” of the Inte/® 64 and IA-32 Architectures Software Developer's 

Manual, Volume 2A, Chapter 4, “Instruction Set Reference, M-U” of the Intel® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 2B, or Chapter 5, “Instruction Set Reference, V-Z,” 
of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2C. 


Table C-1. Simple Intrinsics 


Mnemonic Intrinsic 
ADDPD m128d __mm_add_pd(__m128d a,___m128d b) 
ADDPS m128 _mm_add_ps(__m128 a,__m128b) 
ADDSD m128d _mm_add_sd(__m128d a, __m128d b) 
ADDSS m128 _mm_add_ss(__m128 a,__m128 b) 
ADDSUBPD m128d __mm_addsub_pd(__m128d a, __m128d b) 
ADDSUBPS m128_mm_addsub_ps(__m128 a,__m128 b) 
AESDEC __m128i _mm_aesdec (__m128i,__m128i) 
AESDECLAST __m128i _mm_aesdeclast (__m128i,___m128i) 
AESENC __m128i _mm_aesenc (__m128i, __m128i) 
AESENCLAST __m128i _mm_aesenclast (__m128i,__m128i) 
AESIMC __m128i _mm_aesimc (__m128i) 
AESKEYGENASSIST __m128i _mm_aesimc (__m128i, const int) 
ANDNPD m128d_mm_andnot_pd(__m128d a,_m128d b) 
ANDNPS m128_mm_andnot_ps(__m128 a,__m128 b) 
ANDPD m128d_mm_and_pd(__m128d a,__m128db) 
ANDPS m128_mm_and_ps(__m128 a,__m128 b) 
BLENDPD m128d_mm_blend_pd(__m128d v1,__m128d v2, const int mask) 
BLENDPS m128_mm_blend_ps(__m128 v1,_m128 v2, const int mask) 
BLENDVPD m128d _mm_blendv_pd(__m128d v1,__m128d v2, __m128d v3) 
BLENDVPS m128_mm_blendv_ps(__m128 v1,__m128 v2,__m128 v3) 
CLFLUSH void _mm_clflush(void const *p) 
CMPPD m128d_mm_cmpeq_pd(__m128d a, ___m128d b) 
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Table C-1. Simple Intrinsics (Contd.) 


Mnemonic Intrinsic 


m128d_mm_cmplt_pd(__m128d a,__m128d b) 
m128d_mm_cmple_pd(__m128d a, ___m128d b) 


m128d_mm_cmpgt_pd(__m128d a,__m128d b) 
m128d_mm_cmpge_pd(__m128d a,__m128d b) 
__m128d_mm_cmpneq_pd(__m128d a,__m128d b) 


m128d _mm_cmpnit_pd(__m128d a,__m128d b) 
m128d b) 
__m128d_mm_cmpnge_pd(__m128d a,__m128d b) 
m128d_mm_cmpord_pd(__m128d a,__m128d b) 
__m128d_mm_cmpunord_pd(__m128d a,__m128d b) 
m128d _mm_cmpnle_pd(__m128d a,__m128d b) 


__m128d_mm_cmpngt_pd(__m128d a, 


CMPPS m128 _mm_cmpeq_ps(__m128 a,__m128 b) 
m128 _mm_cmplt_ps(__m128 a,__m128 b) 
m128 _mm_cmple_ps(__m128 a,__m128 b) 


m128 _mm_cmpgt_ps(__m128 a,__m128 b) 

m128 _mm_cmpge_ps(__m128 a,__m128 b) 

m128 __mm_cmpneq_ps(__m128 a,__m128 b) 
m128 __mm_cmpnit_ps(__m128 a,__m128 b) 
m128 _mm_cmpngt_ps(__m128 a,__m128 b) 
m128 __mm_cmpnge_ps(__m128 a,__m128 b) 
m128 _mm_cmpord_ps(__m128 a,__m128 b) 


__m128 _mm_cmpunord_ps(__m128 a,__m128 b) 


m128 b) 


m128 _mm_cmpnle_ps(__m128 a, 


CMPSD m128d_mm_cmpeq_sd(__m128d a, 
m128d_mm_cmplt_sd(__m128d a,__m128d b) 
m128d_mm_cmple_sd(__m128d a, ___m128d b) 
m128d_mm_cmpgt_sd(__m128d a,_m128d b) 


m128d b) 


m128d_mm_cmpge_sd(__m128d a,___m128d b) 
m128 _mm_cmpneq_sd(__m128d a,__m128d b) 
m128 _mm_cmpnit_sd(__m128d a, ___m128d b) 

m128d _mm_cmpnle_sd(__m128d a,___m128d b) 


__m128d_mm_cmpngt_sd(__m128d a,__m128d b) 
m128d b) 
m1 28d b) 
__m128d_mm_cmpunord_sd(__m128d a,___m128d b) 


__m128d_mm_cmpnge_sd(__m128d a, 


m128d _mm_cmpord_sd(__m128d a, 


CMPSS m128 _mm_cmpeq_ss(__m128 a,__m128 b) 
m128 _mm_cmplt_ss(__m128 a,__m128 b) 
m128 __mm_cmple_ss(__m128 a,__m128 b) 


m128 _mm_cmpgt_ss(__m128 a,__m128 b) 
m128 _mm_cmpge_ss(__m128 a,__m128 b) 
m128 __mm_cmpneq_ss(__m128 a,__m128 b) 
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Table C-1. Simple Intrinsics (Contd.) 
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Mnemonic Intrinsic 
m128 _mm_cmpnit_ss(__m128 a,__m128 b) 
m128 _mm_cmpnle_ss(__m128 a,__m128 b) 
m128 _mm_cmpngt_ss(__m128 a,__m128 b) 
m128 _mm_cmpnge_ss(__m128 a,__m128 b) 
m128_mm_cmpord_ss(__m128 a,__m128 b) 
__m128 _mm_cmpunord_ss(__m128 a,__m128 b) 

COMISD int __mm_comieq_sd(__m128d a,___m128d b) 
int __mm_comilt_sd(__m128d a,_m128d b) 
int __mm_comile_sd(__m128d a,__m128d b) 
int __mm_comigt_sd(__m128d a,___m128d b) 
int __mm_comige_sd(__m128d a,__m128d b) 
int __mm_comineq_sd(__m128d a,_m128d b) 

COMISS int__mm_comieq_ss(__m128 a,__m128 b) 
int __mm_comilt_ss(__m128 a, __m128 b) 
int __mm_comile_ss(__m128 a,__m128 b) 
int __mm_comigt_ss(__m128 a, ___m128 b) 
int__mm_comige_ss(__m128 a,__m128 b) 
int__mm_comineq_ss(__m128 a,__m128 b) 

CRC32 unsigned int __mm_crc32_u8(unsigned int crc, unsigned char data) 
unsigned int _mm_crc32_u16(unsigned int crc, unsigned short data) 
unsigned int _mm_crc32_u32(unsigned int crc, unsigned int data) 
unsigned __int64 _mm_crc32_u64(unsigned __int64 crc, unsigned __int64 data) 

CVTDQ2PD __m128d_mm_cvtepi32_pd(__m128i a) 

CVTDQ2PS __m128_mm_cvtepi32_ps(__m128i a) 

CVTPD2DQ m128i__mm_cvtpd_epi32(__m128d a) 

CVTPD2PI m64 _mm_cvtpd_pi32(__m128d a) 

CVTPD2PS m128 _mm_cvtpd_ps(__m128d a) 

CVTPI2PD __m128d_mm_cvtpi32_pd(__m64 a) 

CVTPI2PS mi28_mm_cvt_pi2ps(__m128 a,__m64 b) 

m128_mm_cvtpi32_ps(__m128 a,__m64 b) 

CVTPS2DQ m128i__mm_cvtps_epi32(__m128 a) 

CVTPS2PD m128d_mm_cvtps_pd(__m128 a) 

CVTPS2PI m64_mm_cvt_ps2pi(__m128 a) 

m64 _mm_cvtps_pi32(__m128 a) 

CVTSD2SI int__mm_cvtsd_si32(__m128d a) 

CVTSD2SS m128_mm_cvtsd_ss(__m128 a,__m128d b) 

CVTSI2SD m128d_mm_cvtsi32_sd(__m128d a, int b) 

CVTSI2SS m128_mm_cvt_si2ss(__m128 a, int b) 

m128_mm_cvtsi32_ss(__m128 a, int b) 

mi28 _mm_cvtsi64_ss(__m128 a,__int64 b) 
CVTSS2SD m128d_mm_cvtss_sd(__m128d a,__m128 b) 
CVTSS2SI int_mm_cvt_ss2si(__m128 a) 


int__mm_cvtss_si32(__m128 a) 
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Table C-1. Simple Intrinsics (Contd.) 


Mnemonic Intrinsic 
CVTTPD2DQ m128i __mm_cvttpd_epi32(__m128d a) 
CVTTPD2PI m64 _mm_cvttpd_pi32(__m128d a) 
CVTTPS2DQ m128i __mm_cvttps_epi32(__m128 a) 
CVTTPS2PI m64 _mm_cvtt_ps2pi(__m128 a) 
m64_mm_cvttps_pi32(__m128 a) 
CVTTSD2SI int__mm_cvttsd_si32(__m128d a) 
CVTTSS2SI int__mm_cvtt_ss2si(__m128 a) 
int __mm_cvttss_si32(__m128 a) 
m64_mm_cvtsi32_si64(int i) 
int __mm_cvtsi64_si32(__m64 m) 
DIVPD m128d _mm_div_pd(__m128d a, ___m128d b) 
DIVPS m128_mm_div_ps(__m128 a,__m128 b) 
DIVSD m128d _mm_div_sd(__m128d a, __m128d b) 
DIVSS m128_mm_div_ss(__m128 a,__m128 b) 
DPPD m128d_mm_dp_pd(__m128d a, ___m128d b, const int mask) 
DPPS m128_mm_dp_ps(__m128 a,__m128 b, const int mask) 
EMMS void _mm_empty() 
EXTRACTPS int __mm_extract_ps(__m128 src, const int ndx) 
HADDPD m128d __mm_hadd_pd(__m128d a,___m128d b) 
HADDPS m128 _mm_hadd_ps(__m128 a,__m128 b) 
HSUBPD m128d _mm_hsub_pd(__m128d a, ___m128d b) 
HSUBPS m128 _mm_hsub_ps(__m128 a,__m128 b) 
INSERTPS m128 _mm_insert_ps(__m128 dst, __m128 src, const int ndx) 
LDDQU m128i _mm_lddqu_si1 28(__m128i const *p) 
LDMXCSR __mm_setcsr(unsigned int i) 
LFENCE void _mm_Ifence(void) 
MASKMOVDQU void _mm_maskmoveu_si128(__m128i d, __m128i n, char *p) 
MASKMOVQ void _mm_maskmove_si64(__m64 d, __m64 n, char *p) 
MAXPD m128d _mm_max_pd(__m128d a, __m128d b) 
MAXPS m128 __mm_max_ps(__m128 a,__m128 b) 
MAXSD m128d _mm_max_sd(__m128d a,__m128d b) 
MAXSS m128 _mm_max_ss(__m128 a,__m128 b) 
MFENCE void _mm_mfence(void) 
MINPD m128d _mm_min_pd(__m128d a,__m128d b) 
MINPS m128_mm_min_ps(__m128 a,__m128 b) 
MINSD m128d_mm_min_sd(__m128d a,__m128d b) 
MINSS m128_mm_min_ss(__m128 a,__m128 b) 
MONITOR void _mm_monitor(void const *p, unsigned extensions, unsigned hints) 
MOVAPD m128d_mm_load_pd(double * p) 
void_mm_store_pd(double *p,___m128d a) 
MOVAPS m128 _mm_load_ps(float * p) 


void_mm_store_ps(float *p,__m128 a) 
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MOVD m128i_mm_cvtsi32_si128(int a) 
int__mm_cvtsil128_si32(__m128i a) 
m64 _mm_cvtsi32_si64(int a) 
int__mm_cvtsi64_si32(__m64 a) 
MOVDDUP __m128d_mm_movedup_pd(__m128d a) 
__m128d _mm_loaddup_pd(double const * dp) 
MOVDQA m128i __mm_load_sil28(__m128i * p) 
void_mm_store_si128(__m128i *p,__m128i a) 
MOVDQU m128i _mm_loadu_si128(__m128i * p) 
void_mm_storeu_si128(__m128i *p,__m128i a) 
MOVDQ2Q __m64 __mm_movepi64_pi64(__m128i a) 
MOVHLPS m128 _mm_movehl_ps(__m128 a,___m128 b) 
MOVHPD m128d_mm_loadh_pd(__m128d a, double * p) 
void _mm_storeh_pd(double * p,__m128d a) 
MOVHPS m128_mm_loadh_pi(__m128 a,__m64 * p) 
void _mm_storeh_pi(__m64 * p,__m128 a) 
MOVLPD m128d _mm_loadl_pd(__m128d a, double * p) 
void _mm_storel_pd(double * p,__m128d a) 
MOVLPS m128 _mm_loadl_pi(__m128 a,__m64 *p) 
void_mm_storel_pi(__m64 * p,__m128 a) 
MOVLHPS m128_mm_movelh_ps(__m128 a,_m128 b) 
MOVMSKPD int __mm_movemask_pd(__m128d a) 
MOVMSKPS int __mm_movemask_ps(__m128 a) 
MOVNTDOA m128i __mm_stream_load_si128(__m128i *p) 
MOVNTDQ void_mm_stream_sil28(__m128i * p,__m128i a) 
MOVNTPD void_mm_stream_pd(double * p,__m128d a) 
MOVNTPS void_mm_stream_ps(float * p,__m128 a) 
MOVNTI void_mm_stream_si32(int * p, int a) 
MOVNTQ void_mm_stream_pi(__m64 * p,___m64 a) 
MOVO m128i __mm_loadl_epi64(__m128i * p) 
void_mm_storel_epi64(_m128i * p,__m128i a) 
m128i_mm_move_epi64(__m128i a) 
MOVQ2DQ __m128i __mm_movpi64_epi64(__m64 a) 
MOVSD m128d_mm_load_sd(double * p) 
void_mm_store_sd(double * p,__m128d a) 
m128d_mm_move_sd(__m128d a,__m128d b) 
MOVSHDUP __m128 _mm_movehdup_ps(__m128 a) 
MOVSLDUP __m128_mm_moveldup_ps(__m128 a) 
MOVSS m128 _mm_load_ss(float * p) 


m128 a) 


void_mm_store_ss(float * p, 


m128_mm_move_ss(__m128 a,__m128 b) 
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MOVUPD m128d _mm_loadu_pd(double * p) 
void_mm_storeu_pd(double *p,__m128d a) 
MOVUPS m128 _mm_loadu_ps(float * p) 
void_mm_storeu_ps(float *p,__m128 a) 
MPSADBW __m128i __mm_mpsadbw_epu8(__m128is1,__m128i s2, const int mask) 
MULPD m128d_mm_mul_pd(__m128d a,__m128d b) 
MULPS m128_mm_mul_ss(__m128 a,__m128 b) 
MULSD m128d_mm_mul_sd(__m128da,_m128d b) 
MULSS m128_mm_mul_ss(__m128 a,__m128 b) 
MWAIT void _mm_mwait(unsigned extensions, unsigned hints) 
ORPD m128d_mm_or_pd(__m128d a,_m128d b) 
ORPS m128_mm_or_ps(__m128 a,__m128 b) 
PABSB m64 __mm_abs_pi8 (__m64 a) 
m128i __mm_abs_epi8 (__m128i a) 
PABSD m64 _mm_abs_pi32 (__m64 a) 
m128i__mm_abs_epi32 (__m128i a) 
PABSW m64 __mm_abs_pi16 (__m64 a) 
m128i__mm_abs_epi16 (__m128i a) 
PACKSSWB m128i __mm_packs_epi16(__m128i m1,_m128i m2) 
PACKSSWB m64 __mm_packs_pi16(__m64 m1,__m64 m2) 
PACKSSDW m128i _mm_packs_epi32 (__m128i m1,__m128i m2) 
PACKSSDW m64 __mm_packs_pi32 (__m64 m1,__m64 m2) 
PACKUSDW m128i_mm_packus_epi32(__m128i m1,__m128i m2) 
PACKUSWB m128i_mm_packus_epi16(__m128i m1,__m128i m2) 
PACKUSWB m64 __mm_packs_pu16(__m64 m1,__m64 m2) 
PADDB m128i _mm_add_epi8(__m128i m1,__m128i m2) 
PADDB m64 __mm_add_pi8(__m64 m1,_m64 m2) 
PADDW m128i __mm_add_epi16(__m128i m1, ___m128i m2) 
PADDW m64 _mm_add_pi16(__m64 m1,__ m64 m2) 
PADDD m128i _mm_add_epi32(__m128i m1, _m128i m2) 
PADDD m64 _mm_add_pi32(__m64 m1,__ m64 m2) 
PADDQ m128i__mm_add_epi64(__m128i m1,_m128i m2) 
PADDQ m64 __mm_add_si64(__m64 m1, __m64 m2) 
PADDSB m128i_mm_adds_epi8(__m128i m1,_m128i m2) 
PADDSB m64 __mm_adds_pi8(__m64 m1,__m64 m2) 
PADDSW m128i_mm_adds_epi16(__m128i m1,__m128i m2) 
PADDSW m64 _mm_adds_pi16(__m64 m1,__m64 m2) 
PADDUSB m128i _mm_adds_epu8(__m128i m1,__m128i m2) 
PADDUSB m64 __mm_adds_pu8(__m64 m1,__ m64 m2) 
PADDUSW m128i_mm_adds_epu16(__m128i m1,__m128i m2) 
PADDUSW m64 _mm_adds_pu16(__m64 m1,__m64 m2) 


Vol.2D C-7 


INTEL® C/C++ COMPILER INTRINSICS AND FUNCTIONAL EQUIVALENTS 


Table C-1. Simple Intrinsics (Contd.) 


Mnemonic Intrinsic 

PALIGNR m64 __mm_alignr_pi8 (__m64 a,__ m64 5, int n) 
m128i _mm_alignr_epi8 (__m128i a,__m128i, int n) 

PAND m128i _mm_and_si128(__m128i m1,__m128i m2) 
PAND m64 __mm_and_si64(__m64 m1,__m64 m2) 
PANDN m128i_mm_andnot_si128(__m128i m1, ___m128i m2) 
PANDN m64 _mm_andnot_si64(__m64 m1,__m64 m2) 
PAUSE void _mm_pause(void) 
PAVGB m128i _mm_avg_epu8(__m128i a, ___m128i b) 
PAVGB m64 _mm_avg_pu8(__m64 a,__m64 b) 
PAVGW m128i __mm_avg_epu16(__m128i a,__m128i b) 
PAVGW m64 __mm_avg_pu16(__m64 a,_m64 b) 
PBLENDVB m128i _mm_blendv_epi (__m128i v1,__m128i v2, ___m128i mask) 
PBLENDW m128i _mm_blend_epi16(__m128i v1, ___m128i v2, const int mask) 
PCLMULQDQ __m128i _mm_clmulepi64_si128 (__m128i, __m128i, const int) 
PCMPEQB m128i __mm_cmpeq_epi8(__m128i m1,_m128i m2) 
PCMPEQB m64_mm_cmpeq_pi8(__m64 m1,__m64 m2) 
PCMPEQQ m128i _mm_cmpeq_epi64(__m128i a,___m128i b) 
PCMPEQW m128i _mm_cmpeq_epi16 (__m128i m1,__m128i m2) 
PCMPEQW m64__mm_cmpeq_pi16 (__m64 m1,_m64 m2) 
PCMPEQD m128i _mm_cmpeq_epi32(__m128i m1,_m128i m2) 
PCMPEQD m64 __mm_cmpeq_pi32(__m64 m1,__m64 m2) 
PCMPESTRI int __mm_cmpestri (__m128i a, int la,__m128i b, int Ib, const int mode) 


int __mm_cmpestra 


— 


__m128i a, int la,__m128i 5, int Ib, const int mode 


wa 


int __mm_cmpestrc 


— 


—__m128i a, int la,__m128i b, int Ib, const int mode 


na 


int __mm_cmpestro 


— 


__m128i a, int la,__m128i b, int Ib, const int mode 


a 


int __mm_cmpestrs (__m128i a, int la,__m128i b, int Ib, const int mode 


— 
~~ 


int __mm_cmpestrz (__m128i a, int la,__m128i b, int Ib, const int mode) 
PCMPESTRM __m128i _mm_cmpestrm (__m128i a, int la, 


m1 28i b, int Ib, const int mode) 


int __mm_cmpestra (__m128i a, int la,__m128i b, int Ib, const int mode) 


int __mm_cmpestrc (__m128i a, int la,__m128i b, int Ib, const int mode) 


int __mm_cmpestro (__m128i a, int la,__m128ib, int Ib, const int mode) 


int __mm_cmpestrs (__m128i a, int la,___m128i b, int Ib, const int mode 


) 
int __mm_cmpestrz (__m128i a, int la,__m128i b, int lb, const int mode) 


PCMPGTB m128i _mm_cmpgt_epi8 (__m128i m1,__m128i m2) 

PCMPGTB m64 __mm_cmpgt_pi8 (__m64 m1,__m64 m2) 

PCMPGTW m128i _mm_cmpgt_epi16(__m128i m1,__m128i m2) 

PCMPGTW m64 _mm_cmpgt_pi16 (__m64 m1,__m64 m2) 

PCMPGTD m128i _mm_cmpgt_epi32(__m128i m1,__m128i m2) 

PCMPGTD m64 __mm_cmpgt_pi32(__m64 m1,__m64 m2) 

PCMPISTRI __m128i __mm_cmpestrm (__m128i a, int la,__m128i b, int Ib, const int mode) 


int __mm_cmpestra (__m128i a, int la,__m128i b, int Ib, const int mode) 
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int __mm_cmpestrc (__m128i a, int la,__m128i b, int Ib, const int mode) 
int __mm_cmpestro (__m128i a, int la,__m128i b, int Ib, const int mode) 
int __mm_cmpestrs (__m128i a, int la,__m128i b, int Ib, const int mode) 
int __mm_cmpistrz (__m128i a, __m128i b, const int mode) 
PCMPISTRM __m128i __mm_cmpistrm (__m128i a, __m128i b, const int mode) 
int __mm_cmpistra (__m128i a,__m128i b, const int mode) 
int __mm_cmpistrc (__m128i a,__m128i b, const int mode) 
int __mm_cmpistro (__m128i a,__m128i b, const int mode) 
int __mm_cmpistrs (__m128i a,__m128i b, const int mode) 
int __mm_cmpistrz (__m128i a, __m128i b, const int mode) 
PCMPGTQ m128i _mm_cmpgt_epi64(__m128i a, __m128i b) 
PEXTRB int __mm_extract_epi8 (__m128i src, const int ndx) 
PEXTRD int __mm_extract_epi32 (__m128i src, const int ndx) 
PEXTRQ int64 _mm_extract_epi64 (__m128i src, const int ndx) 
PEXTRW int __mm_extract_epi16(__m128i a, int n) 
PEXTRW int __mm_extract_pi16(__m64 a, int n) 
int __mm_extract_epi16 (__m128i src, int ndx) 
PHADDD m64 _mm_hadd_pi32 (__m64 a, ___m64 b) 
m128i_mm_hadd_epi32 (__m128i a,__m128i b) 
PHADDSW m64_mm_hadds_pi16 (__m64 a,__m64 b) 
m128i __mm_hadds_epi16 (__m128i a,__m128i b) 
PHADDW m64 __mm_hadd_pi16 (__m64 a,__m64 b) 
m128i_mm_hadd_epi16 (__m128i a,__m128i b) 
PHMINPOSUW m128i _mm_minpos_epu16(__m128i packed_words) 
PHSUBD m64 _mm_hsub_pi32 (__m64 a,__m64 b) 
m128i __mm_hsub_epi32 (__m128i a,__m128i b) 
PHSUBSW m64__mm_hsubs_pi16 (__m64 a,__m64 b) 
m128i__mm_hsubs_epi16 (__m128i a,__m128i b) 
PHSUBW m64 __mm_hsub_pi16 (__m64 a,__m64 b) 
m128i__mm_hsub_epi16 (__m128i a, ___m128i b) 
PINSRB m128i __mm_insert_epi8(__m128i s1, int s2, const int ndx) 
PINSRD m128i_mm_insert_epi32(__m128i s2, int s, const int ndx) 
PINSRQ m128i __mm_insert_epi64(__m128i s2, __int64 s, const int ndx) 
PINSRW m128i_mm_insert_epi16(__m128i a, int d, int n) 
PINSRW m64 _mm_insert_pi16(__m64 a, int d, int n) 
PMADDUBSW m64 _mm_maddubs_pi16 (__m64 a,__ m64 b) 
__m128i __mm_maddubs_epi16 (__m128i a,__m128i b) 
PMADDWD m128i __mm_madd_epi16(__m128i m1 __m128i m2) 
PMADDWD m64 __mm_madd_pi16(__m64 m1,___ m64 m2) 
PMAXSB m128i_mm_max_epi8(__m128i a,__m128i b) 
PMAXSD m128i _mm_max_epi32(__m128i a, __m128i b) 
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PMAXSW m128i _mm_max_epi16(__m128i a,__m128i b) 
PMAXSW m64 __mm_max_pi16(__m64 a,_ m64 b) 
PMAXUB m128i __mm_max_epu8(__m128i a, ___m128i b) 
PMAXUB m64 _mm_max_pu8(__m64 a, ___m64 b) 
PMAXUD m128i _mm_max_epu32(__m128i a,__m128i b) 
PMAXUW m128i _mm_max_epu16(__m128i a,__m128i b) 
PMINSB m128i _mm_min_epi8(__m128i a,__m128i b) 
PMINSD m128i _mm_min_epi32(__m128i a,__m128i b) 
PMINSW m128i _mm_min_epi16(__m128i a, __m128i b) 
PMINSW m64 _mm_min_pi16(__m64 a, ___m64 b) 

PMINUB m128i _mm_min_epu8(__m128i a, __m128i b) 
PMINUB m64 __mm_min_pu8(__m64 a, __m64 b) 
PMINUD m128i _mm_min_epu32 (__m128i a, ___m128i b) 
PMINUW m128i_mm_min_epu16 (__m128i a, ___m128i b) 
PMOVMSKB int __mm_movemask_epi8(__m128i a) 
PMOVMSKB int __mm_movemask_pi8(__m64 a) 
PMOVSXBW m128i_mm_ cvtepi8_epi16(__m128i a) 
PMOVSXBD m128i_mm_cvtepi8_epi32(__m128i a) 
PMOVSXBQ m128i__mm_cvtepi8_epi64(__m128i a) 
PMOVSXWD __m128i_mm_cvtepi16_epi32(__m128i a) 
PMOVSXWQ __m128i__mm_cvtepi16_epi64(__m128i a) 
PMOVSXDQ __m128i__mm_cvtepi32_epi64(__m128i a) 
PMOVZXBW __m128i _mm__cvtepu8_epi16(__m128i a) 
PMOVZXBD __m128i_mm_cvtepu8_epi32(__m128i a) 
PMOVZXBQ __m128i__mm_cvtepu8_epi64(__m128i a) 
PMOVZXWD __m128i __mm_cvtepu16_epi32(__m128i a) 
PMOVZXWQ __m128i__mm_cvtepu16_epi64(__m128i a) 
PMOVZXDQ __m128i__mm_cvtepu32_epi64(__m128i a) 
PMULDQ m128i __mm_mul_epi32(__m128i a, __m128i b) 
PMULHRSW m64 __mm_mulhrs_pi16 (__m64 a,_m64 b) 
m128i _mm_mulhrs_epi16 (__m128i a, __m128i b) 
PMULHUW m128i_mm_mulhi_epu16(__m128i a, __m128i b) 
PMULHUW m64 __mm_mulhi_pu16(__m64 a, __ m64 b) 
PMULHW m128i __mm_mulhi_epi16(__m128i m1, __m128i m2) 
PMULHW m64 __mm_mulhi_pi16(__m64 m1,__m64 m2) 
PMULLUD m128i _mm_mullo_epi32(__m128i a,___m128i b) 
PMULLW m128i_mm_mullo_epi16(__m128i m1, _m128i m2) 
PMULLW m64 __mm_mullo_pi16(__m64 m1, _m64 m2) 
PMULUDQ m64 __mm_mul_su32(__m64 m1, __m64 m2) 
m128i_mm_mul_epu32(__m128i m1,__m128i m2) 
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POPCNT int __mm_popcnt_u32(unsigned int a) 
int64_t __mm_popcnt_u64(unsigned __int64 a) 
POR m64 _mm_or_si64(__m64 m1,__m64 m2) 
POR m128i_mm_or_si128(__m128i m1,__m128i m2) 
PREFETCHh void _mm_prefetch(char *a, int sel) 
PSADBW m128i __mm_sad_epu8(__m128i a, ___m128i b) 
PSADBW m64 __mm_sad_pu8(__m64 a,__ m64 b) 
PSHUFB m64 _mm_shuffle_pi8 (__m64 a,__m64 b) 
m128i __mm_shuffle_epi8 (__m128i a,__m128i b) 
PSHUFD m128i __mm_shuffle_epi32(__m128i a, int n) 
PSHUFHW __m128i_mm_shufflehi_epi16(__m128i a, int n) 
PSHUFLW __m128i __mm_shufflelo_epi16(__m128i a, int n) 
PSHUFW m64 _mm_shuffle_pi16(__m64 a, int n) 
PSIGNB m64 _mm_sign_pi8 (__m64 a,__m64 b) 
m128i__mm_sign_epi8 (__m128i a,__m128ib) 
PSIGND m64 _mm_sign_pi32 (__m64 a,__m64 b) 
m128i_mm_sign_epi32 (__m128ia,__m128ib) 
PSIGNW m64_mm_sign_pil6 (__m64 a,__m64 b) 
m128i_mm_sign_epi16 (__m128i a, __m128ib) 
PSLLW m128i_mm_sll_epi16(__m128i m, __m128i count) 
PSLLW m128i_mm_slli_epi16(__m128i m, int count) 
PSLLW m64 _mm_sll_pi16(__m64 m, __m64 count) 
m64 _mm_slli_pi16(__m64 m, int count) 
PSLLD m128i_mm_slli_epi32(__m128i m, int count) 
m128i_mm_sll_epi32(__m128i m, __m128i count) 
PSLLD m64 _mm_slli_pi32(__m64 m, int count) 
m64 _mm_sll_pi32(__m64 m, __m64 count) 
PSLLO m64 _mm_sll_si64(__m64 m, __m64 count) 
m64 _mm_slli_si64(__m64 m, int count) 
PSLLO m128i __mm_sll_epi64(__m128i m, __m128i count) 
m128i_mm_slli_epi64(__m128i m, int count) 
PSLLDQ m128i __mm_slli_sil128(__m128i m, int imm) 
PSRAW m128i _mm_sra_epi16(__m128i m, __m128i count) 
m128i _mm_srai_epi16(__m128i m, int count) 
PSRAW m64 __mm_sra_pil16(__m64 m, __m64 count) 
m64 __mm_srai_pi16(__m64 m, int count) 
PSRAD m128i_mm_sra_epi32 (__m128i m,___m128i count) 
m128i_mm_srai_epi32 (__m128i m, int count) 
PSRAD m64 __mm_sra_pi32 (__m64 m, __m64 count) 
m64 _mm_srai_pi32 (__m64 m, int count) 
PSRLW m128i_mm_srl_epi16 (__m128i m, __m128i count) 
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m128i _mm_srli_epi16 (__m128i m, int count) 
m64 _mm_srl_pi16 (__m64 m, __m64 count) 
m64 _mm_srli_pi16(__m64 m, int count) 
PSRLD m128i __mm_srl_epi32 (__m128i m, __m128i count) 
m128i_mm_srli_epi32 (__m128i m, int count) 
PSRLD m64 __mm_srl_pi32 (__m64 m, __m64 count) 
m64 __mm_srli_pi32 (__m64 m, int count) 
PSRLOQ m128i __mm_srl_epi64 (__m128i m, __m128i count) 
m128i _mm_srli_epi64 (__m128i m, int count) 
PSRLOQ m64 _mm_srl_si64 (__m64 m, __m64 count) 
m64 _mm_srli_si64 (__m64 m, int count) 
PSRLDQ m128i __mm_srli_sil28(__m128i m, int imm) 
PSUBB m128i_mm_sub_epi8(__m128i m1,__m128i m2) 
PSUBB m64 __mm_sub_pi8(__m64 m1,__m64 m2) 
PSUBW m128i __mm_sub_epi16(__m128i m1,__m128i m2) 
PSUBW m64 __mm_sub_pi16(__m64 m1,__m64 m2) 
PSUBD m128i__mm_sub_epi32(__m128i m1,_m128i m2) 
PSUBD m64 _mm_sub_pi32(__m64 m1,__m64 m2) 
PSUBQ m128i _mm_sub_epi64(__m128i m1,__m128i m2) 
PSUBQ m64 _mm_sub_si64(__m64 m1,_m64 m2) 
PSUBSB m128i _mm_subs_epi8(__m128im1,__m128i m2) 
PSUBSB m64 _mm_subs_pi8(__m64 m1, ___m64 m2) 
PSUBSW m128i __mm_subs_epi16(__m128i m1,__m128i m2) 
PSUBSW m64 _mm_subs_pi16(__m64 m1,_m64 m2) 
PSUBUSB m128i _mm_subs_epu8(__m128i m1,_m128i m2) 
PSUBUSB m64 _mm_subs_pu8(__m64 m1,__m64 m2) 
PSUBUSW m128i __mm_subs_epu16(__m128i m1, _m128i m2) 
PSUBUSW m64 __mm_subs_pu16(__m64 m1,__m64 m2) 
PTEST int __mm_testz_sil28(__m128is1,__m128i s2) 
int __mm_testc_si128(__m128i s1,__m128i s2) 
int __mm_testnzc_si128(__m128i s1,__m128i s2) 
PUNPCKHBW m64 _mm_unpackhi_pi8(__m64 m1,__m64 m2) 
PUNPCKHBW __m128i _mm_unpackhi_epi8(__m128i m1,_m128i m2) 
PUNPCKHWD m64 _mm_unpackhi_pi16(__m64 m1,__m64 m2) 
PUNPCKHWD __m128i __mm_unpackhi_epi16(__m128i m1,__m128i m2) 
PUNPCKHDQ m64 _mm_unpackhi_pi32(__m64 m1, __m64 m2) 
PUNPCKHDQ __m128i _mm_unpackhi_epi32(__m128i m1, ___m128i m2) 
PUNPCKHQDQ __m128i _mm_unpackhi_epi64(__m128i m1, ___m128i m2) 
PUNPCKLBW m64 _mm_unpacklo_pi8 (__m64 m1,__m64 m2) 
PUNPCKLBW __m128i _mm_unpacklo_epi8 (__m128i m1,__m128i m2) 
PUNPCKLWD m64 _mm_unpacklo_pi16(__m64 m1,__m64 m2) 
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Table C-1. Simple Intrinsics (Contd.) 


Mnemonic Intrinsic 
PUNPCKLWD __m128i __mm_unpacklo_epi16(__m128i m1,_m128i m2) 
PUNPCKLDQ m64 _mm_unpacklo_pi32(__m64 m1,__m64 m2) 
PUNPCKLDQ __m128i _mm_unpacklo_epi32(__m128i m1, ___m128i m2) 
PUNPCKLQDQ __m128i __mm_unpacklo_epi64(__m128i m1, __m128i m2) 
PXOR m64 __mm_xor_si64(__m64 m1,__m64 m2) 

PXOR m128i_mm_xor_si128(__m128i m1, __m128i m2) 
RCPPS m128 _mm_rcp_ps(__m128 a) 
RCPSS m128_mm_rcp_ss(__m128 a) 
ROUNDPD __m128 mm_round_pd(__m128d s1, int iRoundMode) 
__m128 mm_floor_pd(__m128d s1) 
__m128 mm_ceil_pd(__m128d s1) 
ROUNDPS __m128 mm_round_ps(__m128 s1, int iRoundMode) 
__m128 mm_floor_ps(__m128 s1) 
__m128 mm_ceil_ps(__m128 s1) 
ROUNDSD __m128d mm_round_sd(__m128d dst, ___m128d s1, int iRoundMode) 
__m128d mm_floor_sd(__m128d dst,__m128ds1) 
__m128d mm_ceil_sd(__m128d dst, ___m128d s1) 
ROUNDSS __m128 mm_round_ss(__m128 dst, ___m128 s1, int iRoundMode) 
__m128 mm_floor_ss(__m128 dst,__m128 s1) 
__m128 mm_ceil_ss(__m128 dst,__m128 s1) 
RSQRTPS m128 _mm_rsqrt_ps(__m128 a) 
RSQRTSS m128 _mm_rsqrt_ss(__m128 a) 
SFENCE void_mm_sfence(void) 
SHUFPD m128d _mm_shuffle_pd(__m128d a, ___m128d b, unsigned int imm8) 
SHUFPS m128 _mm_shuffle_ps(__m128 a, __m128 b, unsigned int imm8) 
SQRTPD m128d _mm_sqrt_pd(__m128d a) 
SQRTPS m128 _mm_sqrt_ps(__m128 a) 
SQRTSD m128d _mm_sqrt_sd(__m128d a) 
SQRTSS m128 _mm_sqrt_ss(__m128 a) 
STMXCSR _mm_getcsr(void) 
SUBPD m128d_mm_sub_pd(__m128d a,__m128d b) 
SUBPS m128 _mm_sub_ps(__m128 a,__m128 b) 
SUBSD m128d_mm_sub_sd(__m128d a,__m128d b) 
SUBSS m128_mm_sub_ss(__m128 a,__m128 b) 
UCOMISD int__mm_ucomieq_sd(__m128d a,__m128d b) 
int __mm_ucomilt_sd(__m128d a,__m128d b) 
int __mm_ucomile_sd(__m128d a,__m128d b) 
int __mm_ucomigt_sd(__m128d a,__m128d b) 
int __mm_ucomige_sd(__m128d a,__m128d b) 
int __mm_ucomineq_sd(__m128d a,___m128d b) 
UCOMISS int__mm_ucomieq_ss(__m128 a,__m128 b) 
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Table C-1. Simple Intrinsics (Contd.) 


Mnemonic Intrinsic 
int__mm_ucomilt_ss(__m128 a,__m128 b) 
int__mm_ucomile_ss(__m128 a,__m128 b) 
int __mm_ucomigt_ss(__m128 a,__m128 b) 


int __mm_ucomige_ss(__m128 a,__m128 b) 


int__mm_ucomineq_ss(__m128 a,__m128 b) 


UNPCKHPD __m128d _mm_unpackhi_pd(__m128d a, ___m128d b) 
UNPCKHPS _—m128 _mm_unpackhi_ps(__m128 a,__m128 b) 
UNPCKLPD __m128d_mm_unpacklo_pd(__m128d a,___m128d b) 
UNPCKLPS __m128_mm_unpacklo_ps(__m128 a,_m128 b) 
XORPD m128d _mm_xor_pd(__m128d a,__m128d b) 
XORPS m128_mm_xor_ps(__m128 a,__m128 b) 


C2 COMPOSITE INTRINSICS 


Table C-2. Composite Intrinsics 


Mnemonic 


Intrinsic 


(composite) 


m128i _mm_set_epi64(__m64 q1,__m64 qO) 


(composite) 


m128i _mm_set_epi32(int i3, int i2, int i1, int iO) 


(composite) 


m128i_mm_set_epi16(short w7,short w6, short w5, short w4, short w3, short w2, 
short w1,short wO) 


(composite) 


m128i _mm_set_epi8(char w15,char w14, char w13, char w12, char w11, char w10, 
char w9, char w8, char w7,char w6, char w5, char w4, char w3, char w2,char w1, char wO) 
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(composite) m128i __mm_set1_epi64(__m64 q) 
(composite) m128i__mm_set1_epi32(int a) 
(composite) m128i __mm_set1_epi16(short a) 
(composite) m128i __mm_set1_epi8(char a) 
(composite) m128i __mm_setr_epi64(__m64 q1,__m64 q0) 
(composite) m128i __mm_setr_epi32(int i3, int i2, int 11, int i0) 
(composite) m128i __mm_setr_epi16(short w7,short w6, short w5, short w4, short w3, short w2, short w, 
short w0) 
(composite) m128i _mm_setr_epi8(char w15,char w14, char w13, char w12, char w11, char w10, 
char w9, char w8,char w7, char w6,char w5, char w4, char w3, char w2,char w1,char wO) 
(composite) m128i__mm_setzero_si128() 
(composite) m128 _mm_set_ps1(float w) 
m128 _mm_set1_ps(float w) 
(composite) __m128cmm_set1_pd(double w) 
(composite) m128d _mm_set_sd(double w) 
(composite) m128d_mm_set_pd(double z, double y) 
(composite) m128_mm_set_ps(float z, float y, float x, float w) 
(composite) m128d_mm_setr_pd(double z, double y) 
(composite) m128_mm_setr_ps(float z, float y, float x, float w) 
(composite) m128d_mm_setzero_pd(void) 
(composite) m128 _mm_setzero_ps(void) 
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Table C-2. Composite Intrinsics (Contd.) 
Mnemonic Intrinsic 


MOVSD + shuffle m128d_mm_load_pd(double * p) 
m128d_mm_load1_pd(double *p) 


MOVSS + shuffle m128 _mm_load_ps1 (float * p) 
m128 _mm_load1_ps(float *p) 


MOVAPD + shuffle |__m128d _mm_loadr_pd(double * p) 
MOVAPS + shuffle m128 __mm_loadr_ps(float * p) 
MOVSD + shuffle | void_mm_store1_pd(double *p,__m128d a) 


MOVSS + shuffle | void_mm_store_ps1(float * p,__m128 a) 
void _mm_store1_ps(float *p,__m128 a) 


MOVAPD + shuffle |_mm_storer_pd(double * p,__m128d a) 
MOVAPS + shuffle |_mm_storer_ps(float * p,__m128 a) 
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machine instructions B-1 
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special instruction encodings B-61 
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AAA instruction 3-18, 3-20 
AAD instruction 3-20 
AAM instruction 3-22 
AAS instruction 3-24 
ADC instruction 3-26, 3-592 
ADD instruction 3-18, 3-31, 3-310, 3-592 
ADDPD instruction 3-33 
ADDPS- Add Packed Single-Precision Floating-Point Values 3-36 
Addressing methods 

RIP-relative 2-12 
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ADDSD- Add Scalar Double-Precision Floating-Point Values 3-39 
ADDSD instruction 3-39 
ADDSS- Add Scalar Single-Precision Floating-Point Values 3-41 
ADDSUBPD instruction 3-43 
ADDSUBPS instruction 3-45 
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flow Flag 3-48 
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ing 128-Bit Key 3-52 
AESDEC256KL—Perform 14 Rounds of AES Decryption Flow Using 
256-Bit Key 3-54 
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3-56 
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Flow on 8 Blocks with 128-Bit Key 3-58 
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on 8 Blocks with 256-Bit Key 3-72 
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AESKEYGENASSIST - AES Round Key Generation Assist 3-75 
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AND instruction 3-77, 3-592 
ANDNPS- Bitwise Logical AND NOT of Packed Single Precision 
Floating-Point Values 3-89 
ANDPD- Bitwise Logical AND of Packed Double Precision Float- 
ing-Point Values 3-80 
ANDPD instruction 3-79 
ANDPS- Bitwise Logical AND of Packed Single Precision Float- 
ing-Point Values 3-83 
Arctangent, x87 FPU operation 3-402 
ARPL instruction 3-92 
authenticated code execution mode 6-3 
B 
Base (operand addressing) 2-3 
BCD integers 
packed 3-310, 3-312, 3-352, 3-354 
unpacked 3-18, 3-20, 3-22, 3-24 
BEXTR—Bit Field Extract 3-94 
Binary numbers 1-6 
Bit order 1-5 
BLENDPD — Blend Packed Double Precision Floating-Point Values 
3-95 
BLENDPS — Blend Packed Single Precision Floating-Point Values 
3-97 
BLSI-Extract Lowest Set Isolated Bit 3-104 
BLSMSK - Get Mask Up to Lowest Set Bit 3-105 
BLSR —Reset Lowest Set Bit 3-106 
BNDCL—Check Lower Bound 3-107 
BNDCU/BNDCN—Check Upper Bound 3-109 
BNDLDX—Load Extended Bounds Using Address Translation 
3-111 
BNDMK—Make Bounds 3-114 
BNDMOV—Move Bounds 3-116 
BNDSTX—Store Extended Bounds Using Address Translation 
3-119 
bootstrap processor 6-16, 6-21, 6-29, 6-30 
BOUND instruction 3-122 
BOUND range exceeded exception (#BR) 3-122 
BOUND—Check Array Index Against Bounds 3-122 
Branch hints 2-2 
Brand information 3-247 
processor brand index 3-249 
processor brand string 3-247 
BSF instruction 3-124 
BSR instruction 3-126 
BSWAP instruction 3-128 
BT instruction 3-129 
BTC instruction 3-131, 3-592 
BTR instruction 3-133, 3-592 
BTS instruction 3-135, 3-592 
Byte order 1-5 
BZHI —Zero High Bits Starting with Specified Bit Position 3-137 
C 
C/C++ compiler intrinsics 
compiler functional equivalents C-1 
composite C-14 
description of 3-12 
lists of C-1 
simple C-2 
Cache and TLB information 3-240 
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Cache Inclusiveness 3-216 
Caches, invalidating (flushing) 3-518, 5-589 
CALL instruction 3-138 
GETSEC 6-3 
CBW instruction 3-155 
CDQ instruction 3-309 
CDQE instruction 3-155 
CF (carry) flag, EFLAGS register 3-31, 3-129, 3-131, 3-133, 3-135, 
3-157, 3-172, 3-314, 3-488, 3-493, 4-150, 4-533, 4-608, 4-631, 
4-634, 4-675 
CLC instruction 3-157 
CLD instruction 3-158 
CLFLUSH instruction 3-161, 3-163 
CPUID flag 3-239 
CLI instruction 3-165 
CLTS instruction 3-169 
CMC instruction 3-172 
CMOVcc flag 3-239 
CMOVcc instructions 3-173 
CPUID flag 3-239 
CMP instruction 3-177 
CMPPD- Compare Packed Double-Precision Floating-Point Values 
3-179 
CMPPS- Compare Packed Single-Precision Floating-Point Values 
3-186 
CMPS instruction 3-193, 4-560 
CMPSB instruction 3-193 
CMPSD- Compare Scalar Double-Precision Floating-Point Values 
3-197 
CMPSD instruction 3-193 
CMPSQ instruction 3-193 
CMPSS- Compare Scalar Single-Precision Floating-Point Values 
3-201 
CMPSW instruction 3-193 
CMPXCHG instruction 3-205, 3-592 
CMPXCHG16B instruction 3-207 
CPUID bit 3-237 
CMPXCHG8B instruction 3-207 
CPUID flag 3-239 
COMISD- Compare Scalar Ordered Double-Precision Floating-Point 
Values and Set EFLAGS 3-210 
COMISS- Compare Scalar Ordered Single-Precision Floating-Point 
Values and Set EFLAGS 3-212 
Compatibility mode 
introduction 2-7 
see 64-bit mode 
summary table notation 3-9 
Compatibility, software 1-5 
Condition code flags, EFLAGS register 3-173 
Condition code flags, x87 FPU status word 
flags affected by instructions 3-14 
setting 3-438, 3-440, 3-443 
Conditional jump 3-534 
Conforming code segment 3-567 
Constants (floating point), loading 3-392 
Control registers, moving values to and from 4-40 
Cosine, x87 FPU operation 3-368, 3-420 
CPL 3-165, 5-97 
CPUID instruction 3-214, 3-239 
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36-bit page size extension 3-239 
APIC on-chip 3-239 

basic CPUID information 3-215 
cache and TLB characteristics 3-215 
CLFLUSH flag 3-239 

CLFLUSH instruction cache line size 3-236 
CMPXCHG16B flag 3-237 
CMPXCHG8B flag 3-239 

CPL qualified debug store 3-237 
debug extensions, CR4.DE 3-239 
debug store supported 3-240 


deterministic cache parameters leaf 3-215, 3-218, 3-220, 
3-221, 3-222, 3-223, 3-224, 3-225, 3-226, 3-227, 


3-231 
extended function information 3-232 
feature information 3-238 
FPU on-chip 3-239 
FSAVE flag 3-240 
FXRSTOR flag 3-240 
IA-32e mode available 3-233 
input limits for EAX 3-234 
L1 Context ID 3-237 
local APIC physical ID 3-236 
machine check architecture 3-239 
machine check exception 3-239 
memory type range registers 3-239 
MONITOR feature information 3-244 
MONITOR/MWAIT flag 3-237 


MONITOR/MWAIT leaf 3-216, 3-217, 3-220, 3-221, 3-227, 


3-231 
MWAIT feature information 3-244 
page attribute table 3-239 
page size extension 3-239 
performance monitoring features 3-245 
physical address bits 3-234 
physical address extension 3-239 
power management 3-244, 3-245, 3-246, 3-247 
processor brand index 3-236, 3-247 
processor brand string 3-233, 3-247 
processor serial number 3-215, 3-239 
processor type field 3-235 
RDMSR flag 3-239 
returned in EBX 3-236 
returned in ECX & EDX 3-236 
self snoop 3-240 
SpeedStep technology 3-237 
SS2 extensions flag 3-240 
SSE extensions flag 3-240 
SSE3 extensions flag 3-237 
SSSE3 extensions flag 3-237 
SYSENTER flag 3-239 
SYSEXIT flag 3-239 
thermal management 3-244, 3-245, 3-246, 3-247 
thermal monitor 3-237, 3-240 
time stamp counter 3-239 
using CPUID 3-214 
vendor ID string 3-234 
version information 3-215, 3-244 
virtual 8086 Mode flag 3-239 


virtual address bits 3-234 

WRMSR flag 3-239 
CQO instruction 3-309 
CRO control register 4-650 
CS register 3-139, 3-503, 3-525, 3-540, 4-36, 4-399 
CVTDQ2PD- Convert Packed Doubleword Integers to Packed Dou- 
ble-Precision Floating-Point Values 3-259, 5-28, 5-34, 5-53, 5-55, 
5-60, 5-65, 5-79, 5-81 
CVTDQ2PD instruction 3-256 
CVTDQ2PS- Convert Packed Doubleword Integers to Packed Sin- 
gle-Precision Floating-Point Values 3-263 
CVTPD2DQ- Convert Packed Double-Precision Floating-Point Val- 
ues to Packed Doubleword Integers 3-266 
CVTPD2PI instruction 3-270 
CVTPD2PS- Convert Packed Double-Precision Floating-Point Val- 
ues to Packed Single-Precision Floating-Point Values 3-271 
CVTPI2PD instruction 3-275 
CVTPI2PS instruction 3-276 
CVTPS2DQ- Convert Packed Single Precision Floating-Point Values 
to Packed Signed Doubleword Integer Values 3-277 
CVTPS2DQ- Convert Packed Single Precision Floating-Point Values 
to Packed Singed Doubleword Integer Values 5-50, 5-69, 5-71 
CVTPS2PI instruction 3-283 
CVTSD2SI- Convert Scalar Double Precision Floating-Point Value 
to Doubleword Integer 3-284 
CVTSI2SD- Convert Doubleword Integer to Scalar Double-Precision 
Floating-Point Value 5-28, 5-55, 5-60, 5-65, 5-81 
CVTSI2SS- Convert Doubleword Integer to Scalar Single-Precision 
Floating-Point Value 3-290 
CVTSS2SD- Convert Scalar Single-Precision Floating-Point Value 
to Scalar Double-Precision Floating-Point Value 3-292 
CVTSS2SI- Convert Scalar Single-Precision Floating-Point Value to 
Doubleword Integer 3-294 
CVTTPD2DQ- Convert with Truncation Packed Double-Precision 
Floating-Point Values to Packed Doubleword Integers 3-296 
CVTTPD2PI instruction 3-300 
CVTTPS2DQ- Convert with Truncation Packed Single-Precision 
Floating-Point Values to Packed Signed Doubleword Integer Val- 
ues 3-301 
CVTTPS2PI instruction 3-304 
CVTTSD2SI- Convert with Truncation Scalar Double-Precision 
Floating-Point Value to Signed Integer 3-305 
CVTTSS2SI- Convert with Truncation Scalar Single-Precision Float- 
ing-Point Value to Integer 3-307 
CWD instruction 3-309 
CWDE instruction 3-155 
D 
D (default operation size) flag, segment descriptor 4-403 
DAA instruction 3-310 
DAS instruction 3-312 
Debug registers, moving value to and from 4-43 
DEC instruction 3-314, 3-592 
Denormalized finite number 3-443 
Detecting and Enabling SMX 

level 2 6-1 
DF (direction) flag, EFLAGS register 3-158, 3-194, 3-497, 3-594, 
4-113, 4-182, 4-610, 4-664 
Displacement (operand addressing) 2-3 
DIV instruction 3-316 
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Divide error exception (#DE) 3-316 
DIVPD- Divide Packed Double-Precision Floating-Point Values 
3-319, 5-303 
DIVPS- Divide Packed Single-Precision Floating-Point Values 
3-322 
DIVSD- Divide Scalar Double-Precision Floating-Point Values 3-325 
DIVSS- Divide Scalar Single-Precision Floating-Point Values 3-327 
DS register 3-193, 3-573, 3-594, 4-113, 4-182 
E 
EDI register 4-610, 4-664, 4-668 
Effective address 3-577 
EFLAGS register 
condition codes 3-175, 3-360, 3-365 
flags affected by instructions 3-14 
popping 4-407 
popping on return from interrupt 3-525 
pushing 4-526 
pushing on interrupts 3-503 
saving 4-596 
Status flags 3-177, 3-537, 4-615, 4-700 
EIP register 3-139, 3-503, 3-525, 3-540 
EMMS instruction 3-334 
ENCODEKEY 1 28—Encode 128-Bit Key 3-335 
ENCODEKEY256—Encode 256-Bit Key 3-337 
Encodings 
See machine instructions, opcodes 
ENDBR32—Terminate an Indirect Branch in 32-bit and Compatibil- 
ity Mode 3-339 
ENTER instruction 3-341 
GETSEC 6-3, 6-10 
ES register 3-573, 4-182, 4-610, 4-668 
ESI register 3-193, 3-594, 4-113, 4-182, 4-664 
ESP register 3-139 
EVEX.R 3-5 
Exceptions 
BOUND range exceeded (#BR) 3-122 
notation 1-7 
overflow exception (HOF) 3-503 
returning from 3-525 
GETSEC 6-3, 6-5 
Exponent, extracting from floating-point number 3-458 
Extract exponent and significand, x87 FPU operation 3-458 
EXTRACTPS- Extract packed floating-point values 3-344 
F 
F2XM1 instruction 3-346, 3-458 
FABS instruction 3-348 
FADD instruction 3-349 
FADDP instruction 3-349 
Far pointer, loading 3-573 
Far return, RET instruction 4-563 
FBLD instruction 3-352 
FBSTP instruction 3-354 
FCHS instruction 3-356 
FCLEX instruction 3-358 
FCMOVcc instructions 3-360 
FCOM instruction 3-362 
FCOMI instruction 3-365 
FCOMIP instruction 3-365 
FCOMP instruction 3-362 
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FCOMPP instruction 3-362 FSAVE/FNSAVE instructions 3-411 
FCOS instruction 3-368 FSCALE instruction 3-416 
FDECSTP instruction 3-370 FSIN instruction 3-418 
FDIV instruction 3-371 FSINCOS instruction 3-420 
FDIVP instruction 3-371 FSORT instruction 3-422 
FDIVR instruction 3-374 FST instruction 3-424 
FDIVRP instruction 3-374 FSTCW instruction 3-426 
Feature information, processor 3-214 FSTENV instruction 3-428 
FFREE instruction 3-377 FSTP instruction 3-424 
FIADD instruction 3-349 FSTSW instruction 3-430 
FICOM instruction 3-378 FSUB instruction 3-432 
FICOMP instruction 3-378 FSUBP instruction 3-432 
FIDIV instruction 3-371 FSUBR instruction 3-435 
FIDIVR instruction 3-374 FSUBRP instruction 3-435 
FILD instruction 3-380 FTST instruction 3-438 
FIMUL instruction 3-398 FUCOM instruction 3-440 
FINCSTP instruction 3-382 FUCOMI instruction 3-365 
FINIT instruction 3-383 FUCOMIP instruction 3-365 
FINIT/FNINIT instructions 3-413 FUCOMP instruction 3-440 
FIST instruction 3-385 FUCOMPP instruction 3-440 
FISTP instruction 3-385 FXAM instruction 3-443 
FISTTP instruction 3-388 FXCH instruction 3-445 
FISUB instruction 3-432 FXRSTOR instruction 3-447 
FISUBR instruction 3-435 CPUID flag 3-240 
FLD instruction 3-390 FXSAVE instruction 3-450, 5-586, 5-587, 5-618, 5-630, 5-635, 
FLD1 instruction 3-392 5-639, 5-642, 5-645, 5-648, 5-651 
FLDCW instruction 3-394 CPUID flag 3-240 
FLDENV instruction 3-396 FXTRACT instruction 3-416, 3-458 
FLDL2E instruction 3-392 FYL2X instruction 3-460 
FLDL2T instruction 3-392 FYL2XP1 instruction 3-462 
FLDLG2 instruction 3-392 G 
FLDLN2 instruction 3-392 GDT (global descriptor table) 3-582, 3-585 
FLDPI instruction 3-392 GDTR (global descriptor table register) 3-582, 4-620 
FLDZ instruction 3-392 General-purpose instructions 
Floating point instructions 64-bit encodings B-18 
machine encodings B-61 non-64-bit encodings B-7 
Floating-point exceptions General-purpose registers 
SSE and SSE2 SIMD 3-16 moving value to and from 4-36 
x87 FPU 3-16 popping all 4-403 
Flushing pushing all 4-524 
caches 3-518, 5-589 GETSEC 6-1, 6-2, 6-5 
TLB entry 3-520 GS register 3-573 
FMUL instruction 3-398 H 
FMULP instruction 3-398 HADDPD instruction 3-471, 3-472 
FNCLEX instruction 3-358 HADDPS instruction 3-474 
FNINIT instruction 3-383 Hexadecimal numbers 1-6 
FNOP instruction 3-401 HLT instruction 3-477 
FNSAVE instruction 3-413 HSUBPD instruction 3-478 
FNSTCW instruction 3-426 HSUBPS instruction 3-481 
FNSTENV instruction 3-396, 3-428 I 
FNSTSW instruction 3-430 IA-32e mode 
FPATAN instruction 3-402 CPUID flag 3-233 
FPREM instruction 3-404 introduction 2-7, 2-13, 2-35 
FPREM1 instruction 3-406 see 64-bit mode 
FPTAN instruction 3-408 see compatibility mode 
FRNDINT instruction 3-410 IDIV instruction 3-484 
FRSTOR instruction 3-411 IDT (interrupt descriptor table) 3-504, 3-582 
FS register 3-573 IDTR (interrupt descriptor table register) 3-582, 4-646 
FSAVE instruction 3-413 IF (interrupt enable) flag, EFLAGS register 3-165, 4-665 
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Immediate operands 2-3 
IMUL instruction 3-487 
IN instruction 3-491 
INC instruction 3-493, 3-592 
Index (operand addressing) 2-3 
Initialization x87 FPU 3-383 
initiating logical processor 6-4, 6-5, 6-10, 6-21, 6-22 
INS instruction 3-497, 4-560 
INSB instruction 3-497 
INSD instruction 3-497 
INSERTPS- Insert Scalar Single-Precision Floating-Point Value 
3-500 
instruction encodings B-58, B-64, B-70 
Instruction format 
base field 2-3 
description of reference information 3-1 
displacement 2-3 
immediate 2-3 
index field 2-3 
Mod field 2-3 
ModR/M byte 2-3 
opcode 2-3 
operands 1-6 
prefixes 2-1 
r/m field 2-3 
reg/opcode field 2-3 
scale field 2-3 
SIB byte 2-3 
See also: machine instructions, opcodes 
Instruction reference, nomenclature 3-1 
Instruction set, reference 3-1 
INSW instruction 3-497 
INT 3 instruction 3-503 
Integer, storing, x87 FPU data type 3-385 
Intel 64 architecture 
instruction format 2-1 
Intel NetBurst microarchitecture 1-3 
Intel software network link 1-9 
Intel VTune Performance Analyzer 
related information 1-9 
Intel Xeon processor 1-1 
Intel® Trusted Execution Technology 6-3 
Inter-privilege level 
call, CALL instruction 3-138 
return, RET instruction 4-563 
Interrupts 
returning from 3-525 
software 3-503 
INTn instruction 3-503 
INTO instruction 3-503 
Intrinsics 
compiler functional equivalents C-1 
composite C-14 
description of 3-12 
list of C-1 
simple C-2 
INVD instruction 3-518 
INVLPG instruction 3-520 
IOPL (I/O privilege level) field, EFLAGS register 3-165 
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IRET instruction 3-525 
IRETD instruction 3-525 
J 

Jcc instructions 3-534 
JMP instruction 3-539 
Jump operation 3-539 

L 


L1 Context ID 3-237 
LAHF instruction 3-566 
LAR instruction 3-567 
Last branch 
interrupt & exception recording 
description of 4-578 
LDDQU instruction 3-570 
LDMXCSR instruction 3-572, 4-540, 5-593 
LDS instruction 3-573 
LDT (local descriptor table) 3-585 
LDTR (local descriptor table register) 3-585, 4-648 
LEA instruction 3-577 
LEAVE instruction 3-579 
LES instruction 3-573 
LFENCE instruction 3-581 
LFS instruction 3-573 
LGDT instruction 3-582 
LGS instruction 3-573 
LIDT instruction 3-582 
LLDT instruction 3-585 
LMSW instruction 3-587 
Load effective address operation 3-577 
LOADIWKEY—Load Internal Wrapping Key 3-589 
LOCK prefix 3-27, 3-32, 3-77, 3-131, 3-133, 3-135, 3-205, 3-314, 
3-493, 3-592, 4-167, 4-170, 4-172, 4-608, 4-675, 5-609, 5-614, 
5-622 
Locking operation 3-592 
LODS instruction 3-594, 4-560 
LODSB instruction 3-594 
LODSD instruction 3-594 
LODSQ instruction 3-594 
LODSW instruction 3-594 
Log (base 2), x87 FPU operation 3-462 
Log epsilon, x87 FPU operation 3-460 
LOOP instructions 3-597 
LOOPcc instructions 3-597 
LSL instruction 3-599 
LSS instruction 3-573 
LTR instruction 3-602 
LZCNT - Count the Number of Leading Zero Bits 3-604 
M 
Machine check architecture 
CPUID flag 3-239 
description 3-239 
Machine instructions 
64-bit mode B-1 
condition test (tttn) field B-6 
direction bit (d) field B-6 
floating-point instruction encodings B-61 
general description B-1 
general-purpose encodings B-7-B-37 
legacy prefixes B-1 
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MMX encodings B-38-B-41 
opcode fields B-2 
operand size (w) bit B-4 
P6 family encodings B-41 
Pentium processor family encodings B-37 
reg (reg) field B-3, B-4 
REX prefixes B-2 
segment register (sreg) field B-5 
sign-extend (s) bit B-5 
SIMD 64-bit encodings B-37 
special 64-bit encodings B-61 
special fields B-2 
special-purpose register (eee) field B-5 
SSE encodings B-42-B-47 
SSE2 encodings B-47-B-56 
SSE3 encodings B-57-B-58 
SSSE3 encodings B-58-B-60 
VMX encodings B-112, B-113 
See also: opcodes 
Machine status word, CRO register 3-587, 4-650 
MASKMOVDQU instruction 4-43 
MASKMOVQ instruction 5-296 
MAXPD- Maximum of Packed Double-Precision Floating-Point Val- 
ues 4-12 
MAXPS- Maximum of Packed Single-Precision Floating-Point Val- 
ues 4-15 
MAXSD- Return Maximum Scalar Double-Precision Floating-Point 
Value 4-18 
MAXSS- Return Maximum Scalar Single-Precision Floating-Point 
Value 4-20 
measured environment 6-1 
Measured Launched Environment 6-1, 6-25 
MFENCE instruction 4-22 
MINPD- Minimum of Packed Double-Precision Floating-Point Val- 
ues 4-23 
MINPS- Minimum of Packed Single-Precision Floating-Point Values 
4-26 
MINSD- Return Minimum Scalar Double-Precision Floating-Point 
Value 4-29 
MINSS- Return Minimum Scalar Single-Precision Floating-Point Val- 
ue 4-31 
MLE 6-1 
MMxX instructions 
CPUID flag for technology 3-240 
encodings B-38 
Mod field, instruction format 2-3 
Model & family information 3-244 
ModR/M byte 2-3 
16-bit addressing forms 2-5 
32-bit addressing forms of 2-6 
description of 2-3 
MONITOR instruction 4-33 
CPUID flag 3-237 
feature data 3-244 
MOV instruction 4-35 
MOV instruction (control registers) 4-40, 4-63, 4-65 
MOV instruction (debug registers) 4-43, 4-53 
MOVAPD- Move Aligned Packed Double-Precision Floating-Point 
Values 4-45 


INDEX-6 Vol. 2D 


MOVAPS- Move Aligned Packed Single-Precision Floating-Point 
Values 4-49 
MOVD instruction 4-53 
MOVDDUP- Replicate Double FP Values 4-60 
MOVDQ20 instruction 4-80 
MOVDQA- Move Aligned Packed Integer Values 4-67 
MOVDQU- Move Unaligned Packed Integer Values 4-72 
MOVHLPS - Move Packed Single-Precision Floating-Point Values 
High to Low 4-81 
MOVHPD- Move High Packed Double-Precision Floating-Point Val- 
ues 4-83 
MOVHPS- Move High Packed Single-Precision Floating-Point Val- 
ues 4-85 
MOVLPD- Move Low Packed Double-Precision Floating-Point Val- 
ues 4-89 
MOVLPS- Move Low Packed Single-Precision Floating-Point Values 
4-91 
MOVMSKPD instruction 4-93 
MOVMSKPS instruction 4-95 
MOVNTDO instruction 4-112 
MOVNTDOQ- Store Packed Integers Using Non-Temporal Hint 4-99 
MOVNTI instruction 4-112 
MOVNTPD- Store Packed Double-Precision Floating-Point Values 
Using Non-Temporal Hint 4-103 
MOVNTPS- Store Packed Single-Precision Floating-Point Values 
Using Non-Temporal Hint 4-105 
MOVNTQ instruction 4-107 
MOVQ instruction 4-53, 4-108 
MOVQ2D0 instruction 4-111 
MOVS instruction 4-113, 4-560 
MOVSB instruction 4-113 
MOVSD instruction 4-113 
MOVSD- Move or Merge Scalar Double-Precision Floating-Point 
Value 4-117 
MOVSHDUP- Replicate Single FP Values 4-120 
MOVSLDUP- Replicate Single FP Values 4-123 
MOVSQ instruction 4-113 
MOVSS- Move or Merge Scalar Single-Precision Floating-Point Val- 
ue 4-126 
MOVSW instruction 4-113 
MOVSX instruction 4-130 
MOVSXD instruction 4-130 
MOVUPD- Move Unaligned Packed Double-Precision Floating-Point 
Values 4-132 
MOVUPS- Move Unaligned Packed Single-Precision Floating-Point 
Values 4-136 
MOVZX instruction 4-140 
MSRs (model specific registers) 
reading 4-542 
MUL instruction 3-22, 4-150 
MULPD- Multiply Packed Double-Precision Floating-Point Values 
4-152 
MULPS- Multiply Packed Single-Precision Floating-Point Values 
4-155 
MULSD- Multiply Scalar Double-Precision Floating-Point Values 
4-158 
MULSS- Multiply Scalar Single-Precision Floating-Point Values 
4-160 
Multi-byte no operation 4-167, 4-169, B-13 


MULX - Unsigned Multiply Without Affecting Flags 4-162 
MVMM 6-1, 6-5, 6-37 
MWAIT instruction 4-164 
CPUID flag 3-237 
feature data 3-244 
N 
NaN. testing for 3-438 
Near 
return, RET instruction 4-563 
NEG instruction 3-592, 4-167 
NetBurst microarchitecture (see Intel NetBurst microarchitecture) 
No operation 4-167, 4-169, B-12 
Nomenclature, used in instruction reference pages 3-1 
NOP instruction 4-169 
NOT instruction 3-592, 4-170 
Notation 
bit and byte order 1-5 
exceptions 1-7 
hexadecimal and binary numbers 1-6 
instruction operands 1-6 
reserved bits 1-5 
segmented addressing 1-6 
Notational conventions 1-5 
NT (nested task) flag, EFLAGS register 3-525 
O 
OF (carry) flag, EFLAGS register 3-488 
OF (overflow) flag, EFLAGS register 3-31, 3-503, 4-150, 4-608, 
4-631, 4-634, 4-675 
Opcode format 2-3 
Opcodes 
addressing method codes for A-1 
extensions A-17 
extensions tables A-18 
group numbers A-17 
integers 
one-byte opcodes A-7 
two-byte opcodes A-7 
key to abbreviations A-1 
look-up examples A-3, A-17, A-20 
ModR/M byte A-17 
one-byte opcodes A-3, A-7 
opcode maps A-1 
operand type codes for A-2 
register codes for A-3 
superscripts in tables A-6 
two-byte opcodes A-4, A-5, A-7 
VMxX instructions B-112, B-113 
x87 ESC instruction opcodes A-20 
Operands 1-6 
OR instruction 3-592, 4-172 
ORPS- Bitwise Logical OR of Packed Single Precision Floating-Point 
Values 4-177 
OUT instruction 4-180 
OUTS instruction 4-182, 4-560 
OUTSB instruction 4-182 
OUTSD instruction 4-182 
OUTSW instruction 4-182 
Overflow exception (HOF) 3-503 
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P 
P6 family processors 
description of 1-1 
machine encodings B-41 
PABSB instruction 4-186, 4-200, 5-87, 5-426, 5-437, 5-452 
PABSD instruction 4-186, 4-200, 5-87, 5-426, 5-437, 5-452 
PABSW instruction 4-186, 4-200, 5-87, 5-426, 5-437, 5-452 
PACKSSDW instruction 4-192 
PACKSSWB instruction 4-192 
PACKUSWB instruction 4-205 
PADDB/PADDW/PADDD/PADDOQ - Add Packed Integers 4-210 
PADDSSB instruction 4-217 
PADDSwW instruction 4-217 
PADDUSB instruction 4-221 
PADDUSwW instruction 4-221 
PALIGNR instruction 4-225 
PAND instruction 4-229 
PANDN instruction 4-232 
GETSEC 6-4 
PAUSE instruction 4-235 
PAVGB instruction 4-236 
PAVGW instruction 4-236 
PCE flag, CR4 register 4-547 
PCLMULQDQ - Carry-Less Multiplication Quadword 5-322, 5-331 
PCMPEQB instruction 4-251 
PCMPEQD instruction 4-251 
PCMPEQW instruction 4-251 
PCMPGTB instruction 4-264 
PCMPGTD instruction 4-264 
PCMPGTW instruction 4-264 
PDEP - Parallel Bits Deposit 4-284 
PE (protection enable) flag, CRO register 3-587 
Pending break enable 3-240 
Pentium 4 processor 1-1 
Pentium Il processor 1-3 
Pentium Ill processor 1-3 
Pentium Pro processor 1-3 
Pentium processor 1-1 
Pentium processor family processors 
machine encodings B-37 
Performance-monitoring counters 
CPUID inquiry for 3-245 
PEXT - Parallel Bits Extract 4-286 
PEXTRW instruction 4-291 
PHADDD instruction 4-294 
PHADDSwW instruction 4-298 
PHADDwW instruction 4-294 
PHSUBD instruction 4-302 
PHSUBSW instruction 4-305 
PHSUBW instruction 4-302 
Pj 3-392 
PINSRW instruction 4-310, 4-437 
PMADDUBSwW instruction 4-312 
PMADDUDSW instruction 4-312 
PMADDWD instruction 4-315 
PMULHRSW instruction 4-375 
PMULHUW instruction 4-379 
PMULHW instruction 4-383 
PMULLW instruction 4-391 
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PMULUDQ instruction 4-395 
POP instruction 4-398 
POPA instruction 4-403 
POPAD instruction 4-403 
POPF instruction 4-407 
POPFD instruction 4-407 
POPFQ instruction 4-407 
POR instruction 4-41 1 
PREFETCHh instruction 4-414 
PREFETCHWT1—Prefetch Vector Data Into Caches with Intent to 
Write and T1 Hint 4-418 
Prefixes 
Address-size override prefix 2-2 
Branch hints 2-2 
branch hints 2-2 
instruction, description of 2-1 
legacy prefix encodings B-1 
LOCK 2-1, 3-592 
Operand-size override prefix 2-2 
REP or REPE/REPZ 2-1 
REP/REPE/REPZ/REPNE/REPNZ 4-559 
REPNE/REPNZ 2-1 
REX prefix encodings B-2 
Segment override prefixes 2-2 
PSADBW instruction 4-418 
PSHUFB instruction 4-422 
PSHUFD instruction 4-426 
PSHUFHW instruction 4-430 
PSHUFLW instruction 4-433 
PSHUFW instruction 4-436 
PSIGNB instruction 4-437 
PSIGND instruction 4-437 
PSIGNW instruction 4-437 
PSLLD instruction 4-443 
PSLLDQ instruction 4-441 
PSLLO instruction 4-443 
PSLLW instruction 4-443 
PSRAD instruction 4-455 
PSRAW instruction 4-455 
PSRLD instruction 4-467 
PSRLDQ instruction 4-465 
PSRLQ instruction 4-467 
PSRLW instruction 4-467 
PSUBB instruction 4-479 
PSUBD instruction 4-479 
PSUBQ instruction 4-486 
PSUBSB instruction 4-489 
PSUBSW instruction 4-489 
PSUBUSB instruction 4-493 
PSUBUSW instruction 4-493 
PSUBW instruction 4-479 
PTEST- Packed Bit Test 3-561 
PUNPCKHBW instruction 4-501 
PUNPCKHDQ instruction 4-501 
PUNPCKHQDO instruction 4-501 
PUNPCKHWD instruction 4-501 
PUNPCKLBW instruction 4-511 
PUNPCKLDO instruction 4-511 
PUNPCKLODOQ instruction 4-511 
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PUNPCKLWD instruction 4-511 
PUSH instruction 4-521 
PUSHA instruction 4-524 
PUSHAD instruction 4-524 
PUSHF instruction 4-526 
PUSHFD instruction 4-526 
PXOR instruction 4-528 
R 
R/m field, instruction format 2-3 
RC (rounding control) field, x87 FPU control word 3-385, 3-392, 
3-424 
RCL instruction 4-531 
RCPPS instruction 4-536 
RCPSS instruction 4-538 
RCR instruction 4-531 
RDMSR instruction 4-542, 4-555 
CPUID flag 3-239 
RDPMC instruction 4-545, 4-547, 5-597 
RDTSC instruction 4-549, 4-555, 4-557 
Reg/opcode field, instruction format 2-3 
Related literature 1-8 
Remainder, x87 FPU operation 3-406 
REP/REPE/REPZ/REPNE/REPNZ prefixes 3-194, 3-498, 4-183, 
4-559 
Reserved 
use of reserved bits 1-5 
Responding logical processor 6-4 
responding logical processor 6-4, 6-5 
RET instruction 4-563 
REX prefixes 
addressing modes 2-9 
and INC/DEC 2-8 
encodings 2-8, B-2 
field names 2-9 
ModR/M byte 2-8 
overview 2-8 
REX.B 2-8 
REX.R 2-8 
REX.W 2-8 
special encodings 2-11 
RIP-relative addressing 2-12 
ROL instruction 4-531 
ROR instruction 4-531 
RORX - Rotate Right Logical Without Affecting Flags 4-576 
Rounding 
modes, floating-point operations 4-578 
Rounding control (RC) field 
MXCSR register 4-578 
x87 FPU control word 4-578 
Rounding, round to integer, x87 FPU operation 3-410 
ROUNDPD- Round Packed Double-Precision Floating-Point Values 
4-676 
RPL field 3-92 
RSM instruction 4-587 
RSOQRTPS instruction 4-589 
RSORTSS instruction 4-591 
S 
Safer Mode Extensions 6-1 
SAHF instruction 4-596 


SAL instruction 4-598 
SAR instruction 4-598 
SBB instruction 3-592, 4-607 
Scale (operand addressing) 2-3 
Scale, x87 FPU operation 3-416 
Scan string instructions 4-610 
SCAS instruction 4-560, 4-610 
SCASB instruction 4-610 
SCASD instruction 4-610 
SCASW instruction 4-610 
Segment 
descriptor, segment limit 3-599 
limit 3-599 
registers, moving values to and from 4-36 
selector, RPL field 3-92 
Segmented addressing 1-6 
Self Snoop 3-240 
GETSEC 6-2, 6-4, 6-5 
SENTER sleep state 6-10 
SETcc instructions 4-614 
GETSEC 6-4 
SF (sign) flag, EFLAGS register 3-31 
SFENCE instruction 4-619 
SGDT instruction 4-620 
SHAF instruction 4-596 
Shift instructions 4-598 
SHL instruction 4-598 
SHLD instruction 4-631 
SHR instruction 4-598 
SHRD instruction 4-634 
SHUFPD - Shuffle Packed Double Precision Floating-Point Values 
4-637, 4-676 
SHUFPS - Shuffle Packed Single Precision Floating-Point Values 
4-642 
SIB byte 2-3 
32-bit addressing forms of 2-7, 2-21 
description of 2-3 
SIDT instruction 4-620, 4-646 
Significand, extracting from floating-point number 3-458 
SIMD floating-point exceptions, unmasking, effects of 3-572, 
4-540, 5-593 
Sine, x87 FPU operation 3-418, 3-420 
SINIT 6-4 
SLDT instruction 4-648 
GETSEC 6-4 
SMSW instruction 4-650 
SpeedStep technology 3-237 
SQRTPD- Square Root of Double-Precision Floating-Point Values 
4-676 
SQRTPD—Square Root of Double-Precision Floating-Point Values 
4-652 
SQRTPS- Square Root of Single-Precision Floating-Point Values 
4-655 
SQRTSD - Compute Square Root of Scalar Double-Precision Float- 
ing-Point Value 4-658, 4-676 
SQRTSS - Compute Square Root of Scalar Single-Precision Float- 
ing-Point Value 4-660 
Square root, Fx87 PU operation 3-422 
SS register 3-573, 4-36, 4-399 
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SSE extensions 
cacheability instruction encodings B-47 
CPUID flag 3-240 
floating-point encodings B-42 
instruction encodings B-42 
integer instruction encodings B-46 
memory ordering encodings B-47 
SSE2 extensions 
cacheability instruction encodings B-56 
CPUID flag 3-240 
floating-point encodings B-48 
integer instruction encodings B-52 
SSE3 
CPUID flag 3-237 
SSE3 extensions 
CPUID flag 3-237 
event mgmt instruction encodings B-57 
floating-point instruction encodings B-57 
integer instruction encodings B-57, B-58 
SSSE3 extensions B-58, B-64, B-70 
CPUID flag 3-237 
Stack, pushing values on 4-521 
Status flags, EFLAGS register 3-175, 3-177, 3-360, 3-365, 3-537, 
4-615, 4-700 
STC instruction 4-663 
STD instruction 4-664 
Stepping information 3-244 
STI instruction 4-665 
STMXCSR instruction 4-667 
STOS instruction 4-560, 4-668 
STOSB instruction 4-668 
STOSD instruction 4-668 
STOSQ instruction 4-668 
STOSW instruction 4-668 
STR instruction 4-672 
String instructions 3-193, 3-497, 3-594, 4-113, 4-182, 4-610, 
4-668 
SUB instruction 3-24, 3-312, 3-592, 4-674 
SUBPD- Subtract Packed Double Precision Floating-Point Values 
4-676 
SUBPD- Subtract Packed Double-Precision Floating-Point Values 
4-676 
SUBPS- Subtract Packed Single-Precision Floating-Point Values 
4-679 
SUBSD- Subtract Scalar Double-Precision Floating-Point Values 
4-682 
SUBSS- Subtract Scalar Single-Precision Floating-Point Values 
4-684 
SWAPGS instruction 4-686 
SYSCALL instruction 4-688 
SYSENTER instruction 4-691 
CPUID flag 3-239 
SYSEXIT instruction 4-694 
CPUID flag 3-239 
SYSRET instruction 4-697 
T 
Tangent, x87 FPU operation 3-408 
Task register 
loading 3-602 
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storing 4-672 
Task switch 

CALL instruction 3-138 

return from nested task, IRET instruction 3-525 
TEST instruction 4-700, 5-583 
Thermal Monitor 

CPUID flag 3-240 
Thermal Monitor 2 3-237 

CPUID flag 3-237 
Time Stamp Counter 3-239 
Time-stamp counter, reading 4-555, 4-557 
TLB entry, invalidating (flushing) 3-520 
Trusted Platform Module 6-5 
TS (task switched) flag, CRO register 3-169 
TSS, relationship to task register 4-672 
TZCNT - Count the Number of Trailing Zero Bits 4-704 
U 
UCOMISD - Unordered Compare Scalar Double-Precision Float- 
ing-Point Values and Set EFLAGS 4-706 
UCOMISD instruction 4-704 
UCOMISS - Unordered Compare Scalar Single-Precision Float- 
ing-Point Values and Set EFLAGS 4-708 
UD2 instruction 4-710 
Undefined, format opcodes 3-438 
Unordered values 3-362, 3-438, 3-440 
UNPCKHPD- Unpack and Interleave High Packed Double-Precision 
Floating-Point Values 4-715 
UNPCKHPS- Unpack and Interleave High Packed Single-Precision 
Floating-Point Values 4-719 
UNPCKLPD- Unpack and Interleave Low Packed Double-Precision 
Floating-Point Values 4-723 
UNPCKLPS- Unpack and Interleave Low Packed Single-Precision 
Floating-Point Values 4-727 
Vv 
VALIGND/VALIGNQ- Align Doubleword/Quadword Vectors 5-5 
VBLENDMPD- Blend Float64 Vectors Using an OpMask Control 5-9 
VCVTPD2UDQ- Convert Packed Double-Precision Floating-Point 
Values to Packed Unsigned Doubleword Integers 5-31 
VCVTPS2UDQ- Convert Packed Single Precision Floating-Point Val- 
ues to Packed Unsigned Doubleword Integer Values 5-44 
VCVTSD2USI- Convert Scalar Double Precision Floating-Point Val- 
ue to Unsigned Doubleword Integer 5-57 
VCVTSS2USI- Convert Scalar Single-Precision Floating-Point Value 
to Unsigned Doubleword Integer 5-58 
VCVTTPD2UDQ- Convert with Truncation Packed Double-Preci- 
sion Floating-Point Values to Packed Unsigned Doubleword Inte- 
gers 5-62 
VCVTTPS2UDQ- Convert with Truncation Packed Single-Precision 
Floating-Point Values to Packed Unsigned Doubleword Integer 
Values 5-67 
VCVTTSD2USI- Convert with Truncation Scalar Double-Precision 
Floating-Point Value to Unsigned Integer 5-73 
VCVTTSS2USI- Convert with Truncation Scalar Single-Precision 
Floating-Point Value to Unsigned Integer 5-74 
VCVTUDQ2PD- Convert Packed Unsigned Doubleword Integers to 
Packed Double-Precision Floating-Point Values 5-75 
VCVTUDQ2PS- Convert Packed Unsigned Doubleword Integers to 
Packed Single-Precision Floating-Point Values 5-77 
VCVTUSI2SD- Convert Unsigned Integer to Scalar Double-Preci- 
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sion Floating-Point Value 5-83 

VCVTUSI2SS- Convert Unsigned Integer to Scalar Single-Precision 
Floating-Point Value 5-85 

VERR instruction 5-97 

Version information, processor 3-214 

VERW instruction 5-97 

VEX 3-3 

VEX.B 3-3 

VEX.L 3-3, 3-4 

VEX.mmmmm 3-3 

VEX.pp 3-3, 3-4 

VEX.R 3-4 

VEX.W 3-3 

VEX.X 3-3 

VEXP2PD—Approximation to the Exponential 2*x of Packed Dou- 
ble-Precision Floating-Point Values with Less Than 2*-23 Relative 
Error 5-99 

VEXP2PS—Approximation to the Exponential 2*x of Packed Sin- 
gle-Precision Floating-Point Values with Less Than 2*-23 Relative 
Error 6-10 

VEXTRACTF1 28- Extract Packed Floating-Point Values 5-99 
VFMADD132SS/VFMADD213SS/VFMADD231SS - Fused Multi- 
ply-Add of Scalar Single-Precision Floating-Point Values 5-142 
VFMADDSUB1 32PD/VFMADDSUB213PD/VFMADDSUB231PD_- 
Fused Multiply-Alternating Add/Subtract of Packed Double-Preci- 
sion Floating-Point Values 5-145 

VFMADDSUB1 32PS/VFMADDSUB213PS/VFMADDSUB231PS _ - 
Fused Multiply-Alternating Add/Subtract of Packed Single-Preci- 
sion Floating-Point Values 5-155 
VFMSUB132PS/VFMSUB213PS/VFMSUB231PS - Fused Multi- 
ply-Subtract of Packed Single-Precision Floating-Point Values 
5-191 

VFMSUB132SD/VFMSUB213SD/VFMSUB231SD - Fused Multi- 
ply-Subtract of Scalar Double-Precision Floating-Point Values 
5-198 

VFMSUB132SS/VFMSUB213SS/VFMSUB231SS - Fused Multi- 
ply-Subtract of Scalar Single-Precision Floating-Point Values 
5-201 
VFMSUBADD132PD/VFMSUBADD213PD/VFMSUBADD231PD_ - 
Fused Multiply-Alternating Subtract/Add of Packed Double-Preci- 
sion Floating-Point Values 5-164 
VFNMADD132PD/VFMADD213PD/VFMADD231PD - Fused Nega- 
tive Multiply-Add of Packed Double-Precision Floating-Point Val- 
ues 5-204 

VFNMADD132PS/VFNMADD213PS/VFNMADD231PS_ - Fused 
Negative Multiply-Add of Packed Single-Precision Floating-Point 
Values 5-211 
VFNMADD132SD/VFNMADD213SD/VFNMADD231SD - Fused 
Negative Multiply-Add of Scalar Double-Precision Floating-Point 
Values 5-217 
VFNMSUB132SD/VFNMSUB213SD/VFNMSUB231SD - Fused Neg- 
ative Multiply-Subtract of Scalar Double-Precision Floating-Point 
Values 5-235 

VGATHERDPS/VGATHERDPD - Gather Packed Single, Packed Dou- 
ble with Signed Dword 5-260 

VGATHERDPS/VGATHEROPS - Gather Packed SP FP values Using 
Signed Dword/Qword Indices 5-255 
VGATHERPFODPS/VGATHERPFOQPS/VGATHERPFODPD/VGATHE 
RPFOQPD - Sparse Prefetch Packed SP/DP Data Values with 


Signed Dword, Signed Qword Indices Using TO Hint 5-263 
VGATHERPF1DPS/VGATHERPF1 QPS/VGATHERPF 1 DPD/VGATHE 
RPF1QPD - Sparse Prefetch Packed SP/DP Data Values with 
Signed Dword, Signed Qword Indices Using T1 Hint 6-14 
VGATHERQPS/VGATHEROQPD -Gather Packed Single, Packed Dou- 
ble with Signed Qword Indices 5-263 
VINSERTF128/VINSERTF32x4/VINSERTF64x4- 
Floating-Point Values 5-288 

VINSERTI1 28/VINSERTI32x4/VINSERTI64x4- Insert Packed Inte- 
ger Values 5-292 

Virtual Machine Monitor 6-1 

VM (virtual 8086 mode) flag, EFLAGS register 3-525 

VMM 6-1 

VPBLENDMD- Blend Int32 Vectors Using an OpMask Control 5-305 
VPBROADCASTM—Broadcast Mask to Vector Register 5-20 
VPCMPD/VPCMPUD - Compare Packed Integer Values into Mask 
5-325 

VPCMPQ/VPCMPUQ - Compare Packed Integer Values into Mask 
5-328 

VPCONFLICTD/Q - Detect Conflicts Within a Vector of Packed 
Dword, Packed Qword Values into Dense Memory/Register 5-99 
VPERM21128 - Permute Integer Values 5-354 

VPERMIZB - Full Permute of Bytes from Two Tables Overwriting 
the Index 5-5, 6-6 

VPERMILPD- Permute Double-Precision Floating-Point Values 
5-369 
VPERMILPS- 
5-374 
VPERMPD - Permute Double-Precision Floating-Point Elements 
5-354 

VPERMT2W/D/Q/PS/PD—Full Permute from Two Tables Overwrit- 
ing one Table 5-388 

VPGATHERDD/VPGATHERDQ- Gather Packed Dword, Packed 
Qword with Signed Dword Indices 5-406 
VPGATHERDQ/VPGATHERQOQ - Gather Packed Qword values Using 
Signed Dword/Qword Indices 5-409 
VPGATHERQD/VPGATHERQQ- Gather Packed Dword, Packed 
Qword with Signed Qword Indices 5-413 

VPLZCNTD/Q—Count the Number of Leading Zero Bits for Packed 
Dword, Packed Qword Values 5-416 
VPMOVDB/VPMOVSDB/VPMOVUSDB - Down Convert DWord to 
Byte 5-429 

VPMOVDW/VPMOVSDW/VPMOVUSDW - Down Convert DWord to 
Word 5-433 

VPMOVQB/VPMOVSQB/VPMOVUSQB - Down Convert QWord to 
Byte 5-440 

VPMOVQD/VPMOVSQD/VPMOVUSQD - Down Convert QWord to 
DWord 5-444 

VPMOVQW/VPMOVSQW/VPMOVUSQW - Down Convert QWord to 
Word 5-448 

VPMULTISHIFTQB - Select Packed Unaligned Bytes from Quad- 
word Source 5-300, 5-348 

VPTERNLOGD/VPTERNLOGQ - Bitwise Ternary Logic 5-503 
VPTESTMD/VPTESTMQ - Logical AND and Set Mask 5-506 
VRCP28PD—Approximation to the Reciprocal of Packed Dou- 
ble-Precision Floating-Point Values with Less Than 2*-28 Relative 
Error 5-536 

VRCP28PS—Approximation to the Reciprocal of Packed Sin- 
gle-Precision Floating-Point Values with Less Than 2*-28 Relative 
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INDEX 


Error 5-536 
VRCP28SD—Approximation to the Reciprocal of Scalar Dou- 
ble-Precision Floating-Point Value with Less Than 2*-28 Relative 
Error 6-22 
VRCP28SS—Approximation to the Reciprocal of Scalar Single-Pre- 
cision Floating-Point Value with Less Than 2*-28 Relative Error 
6-26 
VRSQRT28PD—Approximation to the Reciprocal Square Root of 
Packed Double-Precision Floating-Point Values with Less Than 
2°-28 Relative Error 5-564 
VRSQRT28PS—Approximation to the Reciprocal Square Root of 
Packed Single-Precision Floating-Point Values with Less Than 
2-28 Relative Error 6-32 
VRSQRT28SD—Approximation to the Reciprocal Square Root of 
Scalar Double-Precision Floating-Point Value with Less Than 
2*-28 Relative Error 6-30 
VRSQRT28SS—Approximation to the Reciprocal Square Root of 
Scalar Single-Precision Floating-Point Value with Less Than 2*-28 
Relative Error 6-34 
VSCATTERPFODPS/VSCATTERPFOQPS/VSCATTERPFODPD/VSCA 
TTERPFOQPD—Sparse Prefetch Packed SP/DP Data Values with 
Signed Dword, Signed Qword Indices Using TO Hint with Intent to 
Write 5-578 
VSCATTERPF1DPS/VSCATTERPF1QPS/VSCATTERPF1DPD/VSCA 
TTERPF1QPD—Sparse Prefetch Packed SP/DP Data Values with 
Signed Dword, Signed Qword Indices Using T1 Hint with Intent to 
Write 6-38 
W 
WAIT/FWAIT instructions 5-588 
GETSEC 6-4 
WBINVD instruction 5-589, 5-591 
WBINVD/INVD bit 3-216 
Write-back and invalidate caches 5-589 
WRMSR instruction 5-595 

CPUID flag 3-239 
X 
x87 FPU 

checking for pending x87 FPU exceptions 5-588 

constants 3-392 

initialization 3-383 

instruction opcodes A-20 
x87 FPU control word 

loading 3-394, 3-396 

RC field 3-385, 3-392, 3-424 

restoring 3-411 

saving 3-413, 3-428 

storing 3-426 
x87 FPU data pointer 3-396, 3-411, 3-413, 3-428 
x87 FPU instruction pointer 3-396, 3-411, 3-413, 3-428 
x87 FPU last opcode 3-396, 3-411, 3-413, 3-428 
x87 FPU status word 

condition code flags 3-362, 3-378, 3-438, 3-440, 3-443 

loading 3-396 

restoring 3-411 

saving 3-413, 3-428, 3-430 

TOP field 3-382 

x87 FPU flags affected by instructions 3-14 
x87 FPU tag word 3-396, 3-411, 3-413, 3-428 
XABORT - Transaction Abort 5-607 
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XADD instruction 3-592, 5-609 

XCHG instruction 3-592, 5-614 

XCRO 5-651, 5-652 

XEND - Transaction End 5-616 

XGETBV 5-618, 5-630, 5-635, B-41 

XLAB instruction 5-620 

XLAT instruction 5-620 

XOR instruction 3-592, 5-622 

XORPD- Bitwise Logical XOR of Packed Double Precision Float- 
ing-Point Values 5-624 

XORPS- Bitwise Logical XOR of Packed Single Precision Float- 
ing-Point Values 5-627 

XRSTOR B-41 

XSAVE 5-618, 5-633, 5-634, 5-637, 5-638, 5-639, 5-640, 5-641, 
5-642, 5-643, 5-644, 5-645, 5-647, 5-648, 5-650, 5-651, 5-652, 
B-41 

XSETBV 5-645, 5-651, B-41 

XTEST - Test If In Transactional Execution 5-653 

Z 

ZF (zero) flag, EFLAGS register 3-205, 3-567, 3-597, 3-599, 
4-560, 5-97 
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